[GHSA-5ghq-42rg-769x] [CVE-2026-35035] - Request for CVSS correction or clarification

Open

#7,371 opened on Apr 12, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 4/5
Estimated time: 3-5 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Quiet
Tech stack: github
Domain: security

Research direction

Start with the advisory for CVE-2026-35035 and compare its published CVSS vector with the CVSS v3.1 and v4.0 guidance linked in the issue. Confirm whether the proposed UI and impact metrics are justified; done means the advisory vector or its explanation is corrected, or the requested clarification is provided.

Written by the indexing model from the issue text.

Description

Hi GitHub,

Our automated CVSS enrichment pipeline detected some discrepancies between GitHub's provided vector and ours. Since this also passed a GitHub review, I thought it would be helpful to share my insights here, so that the vector or its justification might be corrected. For reference, this was the output from our AI pipeline: https://graph.volerion.com/view?id=CVE-2026-35035.

For the current vector, UI:N was set rather than UI:R, likely due to the fact that the Cross-Site Scripting payload triggers on the main landing page, but that is still considered user interaction in CVSS terms. i.e. the attacker cannot exploit this at will and user participation is required in some manner. This was later clarified in the documentation for CVSS v4.

Additionally, impact represents the delta change in capabilities and an attacker with administrator access already has complete or near-complete control over their domain, so C:H/I:H/A:H seems like an impossible stretch.

My suggestion would be to change UI:N to UI:R and C:H/I:H/A:H to C:L/I:L/A:N, which is the higher-scoring impact group taken from the subsequent browser system, rather than the potential low-integrity repudiation impact suffered by the vulnerable system.

The final vector would then be:
https://volerion.com/cvss/3.1#vector=CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
which comes down to a base score of 4.8, a serious downgrade from 9.1.

Thanks!

Dominant language: No language data
Stars: 2.5k
Forks: 772
Avg merge: 3d 15h
Merged PRs (30d): 46

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

OpenVEX statements carry no subcomponent package or version Open

needs-triage

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

NVIDIA/aicr#2945 · Opened Sep 23, 2026
Signed left-shift undefined behavior in `nbase/nbase_addrset.c` (`(1<<31)`, 4 sites) Open

Nmap

Difficulty 1/5 Under an hour Newbie friendliness 85/100

nmap/nmap#3514 · Opened Sep 23, 2026
CVE-2026-93748 (High) detected in http-cache-semantics-4.1.1.tgz Open

Mend: dependency security vulnerability untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

opensearch-project/OpenSearch-Dashboards#12806 · Opened Sep 23, 2026
False positive: TurkScan.com / TurkChain network Open

blocklist removal

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

MetaMask/eth-phishing-detect#296544 · Opened Sep 23, 2026
Usage of curl in mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated10.0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

Azure/azure-functions-docker#1257 · Opened Sep 23, 2026

More Security issues