Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

CVSS 4.0 calculator on advisory improvement screen does not support non-base metrics

Open
#5,357 1 comment 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Domain
frontend, security

Research direction

Start by reproducing the CVSS 4.0 calculator error with a vector containing the E threat metric, then read the linked CVSS 4.0 specification and example advisory pull request #5356. Done means non-base threat, environmental, and supplemental metrics are accepted, included appropriately in severity calculation, and no longer block advisory improvement submission.

Written by the indexing model from the issue text.

Description

The CVSS 4.0 calculator on the advisory improvement screen does not support non-base (i.e. threat, environmental, and supplemental) metrics, as defined in the spec. There are a couple problems with this:

  1. The calculator does not consider them in its calculation of severity (I'm not sure how big of a problem this is)
  2. It's not possible to submit the advisory improvement request if any of those metrics is present (even if it is already present)

Here's an example of a PR where I was required to remove the E threat metric, even though that wasn't something that I wanted to do, in order to submit the page. With the E metric there, I see an error (The entered vector string contains an error and cannot populate a score.).

Dominant language
No language data
Stars
2.5k
Forks
772
Avg merge
3d 15h
Merged PRs (30d)
46

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/advisory-database

All issues in github/advisory-database

Similar issues

More Web Dev issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.