module

CVSS

JSON serialization for CVSS vectors.

Vector#to_json emits a payload modeled after the FIRST CVSS JSON Schema (https://www.first.org/cvss/cvss-v3.1.json) and the NVD CVE feed format, limited to the fields that round-trip cleanly:

{
  "version": "3.1",
  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "baseScore": 9.8,
  "baseSeverity": "CRITICAL"
}

CVSS.from_json(input) accepts either:

  • A bare CVSS JSON object ({"vectorString": "..."}) or
  • An NVD-nested payload ({"cvssData": {"vectorString": "..."}})

and returns the parsed Vector. Other JSON fields (baseScore, baseSeverity, etc.) are recomputed from the vectorString — they are never trusted from the input, so a tampered payload still produces a correctly-scored vector.

Constants

VERSION = "0.1.0"

Class methods

from_json(input : String | IO) : Vector

Read a Vector from a JSON string or IO. Looks for a vectorString key, either at the top level or nested under cvssData (NVD format).

Source
parse(input : String) : Vector

Parse a CVSS vector string of any supported version.

CVSS.parse("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H").base_score # => 9.8
CVSS.parse("AV:N/AC:L/Au:N/C:P/I:P/A:P").base_score                   # => 7.5
Source
parse?(input : String) : Vector | Nil

Non-raising parse — returns nil if the input is malformed or its CVSS version is unsupported.

CVSS.parse?("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H").try(&.base_score) # => 9.8
CVSS.parse?("garbage")                                                        # => nil
Source
round1(x : Float64) : Float64

Round x to one decimal place, half-away-from-zero. Used by the v2 and v3 score formulas (the v4 algorithm rounds inline). Centralised here so the score module and the JSON serialiser cannot drift apart.

Source

Nested types