cvss

cvss is a Python package maintained by Red Hat Product Security that implements the Common Vulnerability Scoring System (CVSS) versions 2, 3, and 4. It parses CVSS vector strings, validates them against each specification’s mandatory and optional metrics, and computes base, temporal, and environmental scores along with their qualitative severity ratings (None/Low/Medium/High/Critical).

Beyond the standard vector format, the library understands Red Hat’s own notation (a score prepended to the vector) and can cross-check that the embedded score matches the computed one, raising a dedicated exception when they diverge. A text-parsing utility scans arbitrary strings for CVSS-looking substrings and returns the CVSS objects it can successfully construct, which is useful for extracting scores from advisories, changelogs, or free-form vulnerability reports.

For interactive use, the package ships a cvss_calculator console script that walks a user through selecting metric values (or accepts a full vector on the command line) and prints the resulting scores, severities, and a normalized vector string, with optional JSON output and colorized terminal formatting.

What You Get

• CVSS2, CVSS3, and CVSS4 classes that parse a vector string and expose .scores() and .severities() for base, temporal, and environmental metrics
• clean_vector() to normalize a vector by dropping metrics set to their default (not-defined) value
• from_rh_vector() to parse Red Hat’s notation (score + vector) and raise CVSS3RHScoreDoesNotMatch if the embedded score disagrees with the computed one
• parser.parse_cvss_from_text() to scan arbitrary text and extract every valid CVSS2/3/4 vector it finds as constructed objects
• A cvss_calculator CLI with an interactive prompt mode, direct --vector input, and --json output
• Version-specific exception classes (CVSS2Error, CVSS3Error, CVSS4Error) for precise error handling on malformed or incomplete vectors

Common Use Cases

• Computing a numeric severity score and label from a CVSS vector supplied by a vulnerability scanner or CVE feed
• Validating that a CVSS score published alongside a Red Hat security advisory actually matches its vector
• Extracting CVSS vectors embedded in free-form text such as changelogs, issue trackers, or vendor bulletins
• Building an internal vulnerability triage tool that needs consistent CVSS math across v2, v3, and v4
• Offering an interactive terminal calculator for security analysts who don’t want to hand-compute scores

Under The Hood

Architecture The package is organized as one module per CVSS version (cvss2.py, cvss3.py, cvss4.py), each exposing a self-contained class that takes a vector string, parses it against a version-specific metrics table in the matching constants*.py file, checks mandatory fields, fills in optional ones, and computes base/temporal/environmental scores per the official FIRST.org specification formulas. A parser.py module builds on top of these classes with a regex-based text scanner, and cvss_calculator.py plus interactive.py layer a CLI and interactive prompt over the same class APIs — so the library, text-extraction, and CLI surfaces all funnel through the same three version classes, meaning a change to how a version computes scores only needs to happen in that version’s module.

Tech Stack Pure Python with no runtime dependencies (the ordereddict backport is only pulled in on very old Python 2 environments), built and packaged via setuptools. Development tooling includes tox for running the test suite across Python 3.6 through 3.13, with black, isort, and flake8 enforced as separate CI jobs. jsonschema is used only for validating test fixtures.

Code Quality The project has an extensive test suite in tests/, with dedicated test files per CVSS version plus large generated vector fixture files (vectors_random*, vectors_simple*, vectors_calculator*, vectors_cvsslib*) that were produced using FIRST.org’s own JavaScript reference calculators and the third-party cvsslib project, giving strong cross-validation of the scoring math. Error handling is explicit and typed, using a dedicated exception hierarchy per CVSS version rather than generic exceptions. GitHub Actions runs the full tox matrix (multiple Python versions plus lint/format checks) on every push and pull request.

What Makes It Unique Most open-source CVSS calculators implement only one version of the spec; this library covers v2, v3, and v4 behind a consistent interface, and its Red Hat-notation support with automatic score/vector consistency checking is a feature born directly from maintaining real-world security advisories at scale, not a generic textbook implementation.