osv-severity

Analyze CVSS severity data from OSV records.

Trigger: mentions of CVSS scores, vulnerability severity assessment, risk rating, or evaluating impact. Skill source: .claude/skills/osv-severity/SKILL.md

CLI

Severity is queried via osv query:

osv query --severity cvss3 vulnerability.json  # CVSS v3 entry + parsed score (0.0 on a vector string)
osv query --severity cvss2 vulnerability.json  # CVSS v2

Or see all severities at once with osv parse -v.

SDK

// CVSS v3 entry (nil if absent — check before use)
s := v.Severity.GetCVSS3()
if s == nil {
    return // no CVSS v3 entry
}

// Parsed numeric score
fmt.Println(s.GetScore())        // float64, 0.0 if unparseable
score, err := s.GetScoreAsFloat() // with error
ptr := s.GetScoreAsPointer()     // *float64, nil on error

CVSS score table

Score range	Severity
0.1–3.9	Low
4.0–6.9	Medium
7.0–8.9	High
9.0–10.0	Critical

The bands are contiguous — 0.1 is the first rankable score, so a real 0.0 never lands in Low; it means "no numeric score" (a vector string that GetScore() couldn't parse, or a missing field). That is why the table starts at 0.1 while the SDK getter returns 0.0 for the unrankable case.

Decision tree

Parsing path: vector vs number

Top-level vs per-affected severity

affected[].severity is an optional severity slice scoped to a single affected entry (type []*Severity — note this is a bare slice, not SeveritySlice, so it has no GetCVSS3() helper; iterate it directly). It is separate from the top-level severity.

Anatomy of a CVSS vector

When score is a vector string rather than a number, this is what those slash-separated tokens mean — the reason GetScore() can't just ParseFloat it.

Vector → number needs a CVSS calculator

The numeric 0–10 score is derived from these metrics by the CVSS formula, not stored in the string. That is why the SDK hands you the vector verbatim and leaves scoring to a dedicated CVSS library — the OSV record itself only guarantees the vector.

Notes

• OSV score may be a CVSS vector string (CVSS:3.1/AV:N/...) rather than a number — in that case GetScore() returns 0.0. Parse the vector yourself if you need the numeric score from a vector.
• SeverityTypeCVSS2 = "CVSS_V2", SeverityTypeCVSS3 = "CVSS_V3"

Cross-references

• [[osv-query]] — the --severity flag lives here
• [[osv-affected]] — per-affected severity (affected[].severity)
• Methods — full severity API