OSV API exposes syntactically incorrect CVSSv4 scores
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
**Describe the bug**
A number of OSV records from multiple ecosystems provide a CVSSv4 vector with a trailing slash which is not valid syntax per the CVSSv4 [schema](https://www.first.org/cvss/cvss-v4.0.json) and any schema-compliant parsing library will trip up when processing such CVSSv4 vectors.
Some examples:
https://api.osv.dev/v1/vulns/GHSA-g357-x5c3-c72p
https://api.osv.dev/v1/vulns/GHSA-9p7c-v5x3-rfx8
https://api.osv.dev/v1/vulns/GHSA-78fc-9688-w8xw
**To Reproduce**
Steps to reproduce the behaviour:
1. Go to any of the above links
2. Copy the CVSSv4 vector
3. Pass it to any schema-compliant CVSS parsing library
4. Library will raise an error
**Expected behaviour**
Error is not raised, CVSSv4 vector complies with the schema.
**Screenshots**
N/A
**Additional context**
N/A
Contributor guide
Research direction
Start with the API responses for GHSA-g357-x5c3-c72p, GHSA-9p7c-v5x3-rfx8, and GHSA-78fc-9688-w8xw, then trace where their CVSSv4 vectors are stored or serialized. Compare the vectors with the CVSSv4 schema and verify them with a schema-compliant parsing library. Done means the affected API responses contain syntactically valid vectors without the trailing slash.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100