fix(cvss): honor Exploit Maturity threat metric in CVSS v4.0 scoring by mrrajan · Pull Request #2569 · guacsec/trustify

mrrajan · 2026-08-11T15:00:00Z

Summary

Use calculated_full_score() instead of calculated_base_score() for CVSS v4.0 so the Exploit Maturity (E) threat metric is included in scoring. Fixes inflated scores for CVEs with E:P or E:U (e.g., 10.0 instead of 9.3 for CVE-2026-18236).

Only the v4.0 From impl is changed; v2/v3 are unaffected
No-op for CVEs without an E metric
Adds 3 reproducer tests (E:P → 9.3, E:U → 9.1, no-E → 10.0)

Implements TC-5626

Summary by Sourcery

Honor CVSS v4.0 Exploit Maturity in score calculation to avoid inflated scores and validate behavior with new tests.

Bug Fixes:

Fix CVSS v4.0 scoring to include the Exploit Maturity (E) threat metric instead of using pure base score, preventing inflated scores for partially or unreported exploits.

Tests:

Add CVSS v4.0 regression tests covering Exploit Maturity values E:P, E:U, and absence of E to ensure expected scores and severities.

Use calculated_full_score() instead of calculated_base_score() for v4.0 so E:P/E:U are not stripped. No change for CVEs without an E metric. Implements TC-5626 Assisted-by: Claude Code

sourcery-ai · 2026-08-11T15:00:08Z

Reviewer's Guide

CVSS v4.0 scoring is updated to use the full score (including Exploit Maturity) when building ScoreInformation, and new tests verify the expected scores for different E metrics and the no-E case.

File-Level Changes

Change	Details	Files
Use CVSS v4.0 full score (including Exploit Maturity threat metric) when converting to ScoreInformation instead of the base score.	Replace calculated_base_score() calls with calculated_full_score() in the CvssV4 -> ScoreInformation From implementation. Keep fallback parsing behavior but change it to use calculated_full_score() on the reparsed vector. Preserve existing behavior of falling back to cvss.base_score when no calculated score is available.	`modules/ingestor/src/graph/cvss.rs`
Add regression tests to confirm CVSS v4.0 scores correctly honor the Exploit Maturity (E) metric and do not regress for vectors without E.	Add test for CVSS v4.0 vector with E:P to assert score 9.3 and Critical severity. Add test for CVSS v4.0 vector without E to assert score remains 10.0. Add test for CVSS v4.0 vector with E:U to assert score 9.1.	`modules/ingestor/src/graph/cvss.rs`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

sourcery-ai

Hey - I've reviewed your changes and they look great!

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

PhilipCattanach · 2026-08-11T15:14:27Z

Many thanks @mrrajan
It is something we need to backport into the 3.1after it is merged to main.

rh-jfuller

LGTM

Add missing test for CVSS v4.0 with E:A (Attacked) exploit maturity metric as requested in PR review. Also fix variable name inconsistency where the local variable was renamed to full_score but still referenced cvss.full_score instead of cvss.base_score in the fallback. Addresses review feedback on PR guacsec#2569 Co-Authored-By: Claude Code <noreply@anthropic.com>

mrrajan · 2026-08-12T08:30:32Z

Thanks for the review @rh-jfuller I just addressed the requested changes :) Please let me know.

trustify-ci-bot · 2026-08-12T14:02:34Z

Successfully created backport PR for release/0.6.z:

fix(cvss): honor Exploit Maturity threat metric in CVSS v4.0 scoring [Backport release/0.6.z] #2575

…[Backport release/0.6.z] (#2575) * fix: persist total_components count for EI analysis when job terminates (cherry picked from commit 155a5c9) * fix(cvss): honor Exploit Maturity threat metric in CVSS v4.0 scoring Use calculated_full_score() instead of calculated_base_score() for v4.0 so E:P/E:U are not stripped. No change for CVEs without an E metric. Implements TC-5626 Assisted-by: Claude Code (cherry picked from commit ca49359) * test(cvss): add E:A test coverage and fix variable reference Add missing test for CVSS v4.0 with E:A (Attacked) exploit maturity metric as requested in PR review. Also fix variable name inconsistency where the local variable was renamed to full_score but still referenced cvss.full_score instead of cvss.base_score in the fallback. Addresses review feedback on PR #2569 Co-Authored-By: Claude Code <noreply@anthropic.com> (cherry picked from commit a837282) --------- Co-authored-by: Noah Santschi-Cooney <noah@santschi-cooney.ch> Co-authored-by: mrrajan <86094767+mrrajan@users.noreply.github.com> Co-authored-by: Claude Code <noreply@anthropic.com>

mrrajan · 2026-08-13T11:38:29Z

/backport release/0.5.z

trustify-ci-bot · 2026-08-13T11:38:51Z

Backport failed for release/0.5.z, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release/0.5.z
git worktree add -d .worktree/backport-2569-to-release/0.5.z origin/release/0.5.z
cd .worktree/backport-2569-to-release/0.5.z
git switch --create backport-2569-to-release/0.5.z
git cherry-pick -x 155a5c99bda57dabccbc064b2dcc819af4f921ae ca49359cf84fce0e0cc7a8fe3f7b19af4c0eae58 a837282f4375f704dbd467b623b7798a5d8d2baf

trustify-ci-bot · 2026-08-13T11:38:52Z

Backport failed for release/0.6.z, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release/0.6.z
git worktree add -d .worktree/backport-2569-to-release/0.6.z origin/release/0.6.z
cd .worktree/backport-2569-to-release/0.6.z
git switch --create backport-2569-to-release/0.6.z
git cherry-pick -x 155a5c99bda57dabccbc064b2dcc819af4f921ae ca49359cf84fce0e0cc7a8fe3f7b19af4c0eae58 a837282f4375f704dbd467b623b7798a5d8d2baf

trustify-ci-bot · 2026-08-13T11:38:56Z

Backport failed for release/0.5.z, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release/0.5.z
git worktree add -d .worktree/backport-2569-to-release/0.5.z origin/release/0.5.z
cd .worktree/backport-2569-to-release/0.5.z
git switch --create backport-2569-to-release/0.5.z
git cherry-pick -x 155a5c99bda57dabccbc064b2dcc819af4f921ae ca49359cf84fce0e0cc7a8fe3f7b19af4c0eae58 a837282f4375f704dbd467b623b7798a5d8d2baf

trustify-ci-bot · 2026-08-13T11:38:57Z

Backport failed for release/0.6.z, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin release/0.6.z
git worktree add -d .worktree/backport-2569-to-release/0.6.z origin/release/0.6.z
cd .worktree/backport-2569-to-release/0.6.z
git switch --create backport-2569-to-release/0.6.z
git cherry-pick -x 155a5c99bda57dabccbc064b2dcc819af4f921ae ca49359cf84fce0e0cc7a8fe3f7b19af4c0eae58 a837282f4375f704dbd467b623b7798a5d8d2baf

fix(cvss): honor Exploit Maturity threat metric in CVSS v4.0 scoring

ae224a6

Use calculated_full_score() instead of calculated_base_score() for v4.0 so E:P/E:U are not stripped. No change for CVEs without an E metric. Implements TC-5626 Assisted-by: Claude Code

github-project-automation Bot added this to Trustify Aug 11, 2026

mrrajan requested review from ctron and rh-jfuller August 11, 2026 15:00

sourcery-ai Bot reviewed Aug 11, 2026

View reviewed changes

mrrajan added backport release/0.5.z Backport (0.5.z) backport release/0.6.z and removed backport release/0.5.z Backport (0.5.z) labels Aug 11, 2026

rh-jfuller reviewed Aug 12, 2026

View reviewed changes

Comment thread modules/ingestor/src/graph/cvss.rs Outdated

rh-jfuller reviewed Aug 12, 2026

View reviewed changes

Comment thread modules/ingestor/src/graph/cvss.rs

rh-jfuller approved these changes Aug 12, 2026

View reviewed changes

mrrajan enabled auto-merge August 12, 2026 08:59

Merge branch 'main' into TC-5626

9701be1

mrrajan added this pull request to the merge queue Aug 12, 2026

Merged via the queue into guacsec:main with commit a837282 Aug 12, 2026
9 checks passed

mrrajan deleted the TC-5626 branch August 12, 2026 14:02

github-project-automation Bot moved this to Done in Trustify Aug 12, 2026

trustify-ci-bot Bot mentioned this pull request Aug 12, 2026

fix(cvss): honor Exploit Maturity threat metric in CVSS v4.0 scoring [Backport release/0.6.z] #2575

Merged

matejnesuta mentioned this pull request Aug 12, 2026

chore(test): adjust order of vulnerabilities after a backend change guacsec/trustify-ui#1205

Merged

mrrajan added the backport release/0.5.z Backport (0.5.z) label Aug 13, 2026

mrrajan mentioned this pull request Aug 13, 2026

fix(cvss): honor Exploit Maturity threat metric in CVSS v4.0 scoring [Backport release/0.5.z] #2578

Merged

Uh oh!

Conversation

mrrajan commented Aug 11, 2026 • edited by sourcery-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Summary by Sourcery

Uh oh!

sourcery-ai Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer's Guide

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

PhilipCattanach commented Aug 11, 2026

Uh oh!

Uh oh!

Uh oh!

rh-jfuller left a comment

Choose a reason for hiding this comment

Uh oh!

mrrajan commented Aug 12, 2026

Uh oh!

Uh oh!

trustify-ci-bot Bot commented Aug 12, 2026

Uh oh!

mrrajan commented Aug 13, 2026

Uh oh!

trustify-ci-bot Bot commented Aug 13, 2026

Uh oh!

trustify-ci-bot Bot commented Aug 13, 2026

Uh oh!

trustify-ci-bot Bot commented Aug 13, 2026

Uh oh!

trustify-ci-bot Bot commented Aug 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mrrajan commented Aug 11, 2026 •

edited by sourcery-ai Bot

Loading

sourcery-ai Bot commented Aug 11, 2026 •

edited

Loading