Skip to content

Incorrect CVSS scores in GitLab v2 advisories #2330

New issue
New issue
Open
#2430
Open
Incorrect CVSS scores in GitLab v2 advisories#2330
#2430
Labels
bug

Description

@keshav-space
keshav-space
opened on Jun 9, 2026

Rather than storing None, the pipeline should compute and store valid CVSS scores from CVSS vector using Cvssv2ScoringSystem.compute and Cvssv3ScoringSystem.compute.

vulnerablecode/vulnerabilities/pipelines/v2_importers/gitlab_importer.py

Lines 306 to 323 in 77e9052

VulnerabilitySeverity(
system=SCORING_SYSTEMS["cvssv2"],
scoring_elements=cvss_v2,
value=None,
url=advisory_url,
)
)
if cvss_v3:
scoring_system = SCORING_SYSTEMS["cvssv3"]
if cvss_v3.startswith("CVSS:3.1/"):
scoring_system = SCORING_SYSTEMS["cvssv3.1"]
severities.append(
VulnerabilitySeverity(
system=scoring_system,
scoring_elements=cvss_v3,
value=None,
url=advisory_url,
)

Activity

  1. keshav-space
    added
    bug
    on Jun 9, 2026

  2. TG1999 commented on Jun 9, 2026

    @TG1999
    TG1999
    on Jun 9, 2026
    Contributor

    This should be an improvement process not an import process, since gitlab does not provide numerical risk scores by itself

  3. hardikkaurani
    added a commit that references this issue on Sep 13, 2026

    Compute valid CVSS scores from vectors in GitLab importer

    ed78fbc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bug

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions