cvss

library3.6pypypi✓ verified 24d ago

The `cvss` library provides a Python implementation for calculating and parsing Common Vulnerability Scoring System (CVSS) scores for versions 2, 3, and 4. It enables users to convert CVSS vectors into human-readable scores and provides programmatic access to individual metric values. The current version is 3.6, and it sees active maintenance with several releases per year addressing bug fixes and new CVSS specification versions.

auth-security

pip install cvss

github ↗package ↗changelog ↗

INSTALL

IMPORT

SIG · CVSS

cvss

auth-securitypythonv3.6

Install

1.6s avg

Import

14ms

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v3.6 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.014s · 18MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 1.6s · import 0.014s · 19MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

CVSS2

✓ from cvss import CVSS2

CVSS3

✓ from cvss import CVSS3

CVSS4

✓ from cvss import CVSS4

Initialize CVSS objects with a vector string and retrieve base scores and individual metrics.

from cvss import CVSS3, CVSS4 # Example CVSS v3.1 vector cvss3_vector = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" cvss3_obj = CVSS3(cvss3_vector) print(f"CVSS v3 Base Score: {cvss3_obj.base_score}") print(f"CVSS v3 Vector: {cvss3_obj.vector}") # Example CVSS v4.0 vector cvss4_vector = "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" cvss4_obj = CVSS4(cvss4_vector) print(f"CVSS v4 Base Score: {cvss4_obj.base_score}") print(f"CVSS v4 Vector: {cvss4_obj.vector}")

Debug

Known issues

breakingPython 2.7 support was officially removed in version 3.5. Users running on Python 2.x will need to upgrade to Python 3.7+.

fix

Upgrade your Python environment to 3.7 or newer. If you must use Python 2.7, use an older version of the `cvss` library (e.g., <3.5), but note it will not support CVSS v4.0.

affects: >=3.5

breakingStarting with version 3.5, the library officially requires Python 3.7 or newer.

fix

Ensure your Python environment is version 3.7 or higher.

affects: >=3.5

gotchaWhen parsing CVSS vectors, you must use the correct class (`CVSS2`, `CVSS3`, or `CVSS4`) corresponding to the vector's version. Attempting to parse a CVSS v3 vector with `CVSS2` will result in errors or incorrect parsing.

fix

Inspect the CVSS vector string (e.g., 'CVSS:3.1/' indicates v3.1, 'CVSS:4.0/' indicates v4.0) and instantiate the appropriate class (e.g., `CVSS3(...)` or `CVSS4(...)`).

affects: All

gotchaEarly versions of CVSS v4.0 implementation in the library (v3.0, v3.1) had rounding issues for base scores that did not match the official specification. This was fixed in v3.2.

fix

Ensure you are using `cvss` library version 3.2 or newer when calculating CVSS v4.0 scores for accurate rounding.

affects: 3.0, 3.1

gotchaThe `CVSS3.as_json()` method has a `minimal` parameter, which if set to `True`, will output a JSON representation containing only the metrics that the CVSS3 object was initiated with, rather than all possible metrics.

fix

Be aware of the `minimal` parameter's effect when generating JSON output, especially if you expect a full representation of all metrics regardless of input.

affects: >=2.6

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'cvss'

The 'cvss' Python package is not installed in your active Python environment.

fix

Install the package using pip: `pip install cvss`

ValueError: Malformed CVSS3 vector

The provided CVSS v3.x vector string does not adhere to the official CVSS v3.x specification, possibly due to a missing or incorrect 'CVSS:3.x/' prefix, invalid metric ordering, or unrecognized metric-value pairs.

fix

Ensure the CVSS vector string strictly follows the CVSS specification for the intended version, including the correct prefix (e.g., 'CVSS:3.1/') and valid metric abbreviations and values. Example: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.

cvss.exceptions.CVSS4MalformedError: Malformed CVSS4 vector

The input CVSS v4 vector string contains invalid syntax, such as missing mandatory base metrics, an incorrect 'CVSS:4.0/' prefix, or unrecognized metric values, as defined by the CVSS v4.0 specification.

fix

Review the CVSS v4.0 specification and ensure the vector string precisely includes all required base metrics and uses correct abbreviations and values. Example: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`.

Upgrade

Version history

3.6latest on PyPI · released Aug 4, 2025

Audit

Dependencies

No dependency data recorded yet.

Agent activity

22 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/RedHatProductSecurity/cvss ↗

packagehttps://pypi.org/project/cvss/ ↗

changeloghttps://github.com/RedHatProductSecurity/cvss/releases ↗