[GHSA-cj4v-437j-jq4c] [CVE-2026-25921] - Request for CVSS correction or clarification
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 45/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 领域
- security
调研方向
根据提议的 CVSS:3.1 向量和链接的 FIRST CVSS v3.1 user guide，审查 advisory 当前的 CVSS 向量。验证 Scope、Complexity、User Interaction 和 Availability 的理由，然后在分析支持的情况下记录或应用修正后的分数。
由索引模型根据 Issue 内容生成。
描述
Hi GitHub,
Our automated CVSS enrichment pipeline detected some discrepancies between GitHub's provided vector and ours. Since this also passed a GitHub review, I thought it would be helpful to share my insights here, so that the vector or its justification might be corrected. For reference, this was the output from our AI pipeline: https://graph.volerion.com/view?id=CVE-2026-25921.
For the current vector, Scope is Changed (S:C), due to the stated supply-chain attack vector, but I believe this to be secondary impact that an attacker cannot expect to achieve for all or most instances of an attack against this product. Otherwise, including that 'appendage' would increase attack complexity via either AC (an automated system must later pull and utilize the poisoned source) or UI (a user does the same).
Additionally, A:L may have been set due to a common misconception regarding Availability impact. The vulnerable system is still fully available, albeit serving different content than intended, and therefore directly suffers a serious loss of integrity only.
The final vector would then be:
https://volerion.com/cvss/3.1#vector=CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
With a changed base score from 9.3 to 7.5.
Thanks!
- 主要语言
- 没有语言数据
- 星标
- 2.5k
- 派生
- 772
- 平均合并
- 3 天 15 小时
- 30 天内合并 PR
- 46
贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
github/advisory-database 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
github/advisory-database#9255 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#9164 · 1 个 reaction ·
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#8994 ·
-
难度 2/5 1-3 小时 新手友好度 68/100
github/advisory-database#8898 · 4 条评论 · 1 个 reaction ·
-
难度 2/5 1-3 小时 新手友好度 72/100
github/advisory-database#8841 ·
查看 github/advisory-database 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
-
oblt-aw/detector/security
难度 2/5 1-3 小时 新手友好度 70/100
-
setup tools wizard offers no GitHub auth path, and setup summary doesn't recognize `gh` CLI auth 未关闭area/auth comp/cli P3 tool/skills type/bug
难度 2/5 1-3 小时 新手友好度 75/100
NousResearch/hermes-agent#121131 ·
-
难度 2/5 1-3 小时 新手友好度 75/100
trailofbits/skills#330 ·
-
accepted
难度 2/5 1-3 小时 新手友好度 75/100