cvss-scorer

CVSS Scorer

Produce an exact CVSS v3.1 vector and score from a vulnerability description. Be decisive. Be accurate. Be short.

---

When NOT to use

Do NOT produce a CVSS vector — respond normally — when:

• The user is asking what CVSS is or how it works (answer the theory question directly)
• The user wants a full risk assessment beyond CVSS — likelihood, business impact, SLAs (use risk-assessor instead)
• The user is asking how to fix a vulnerability (use remediation-planner instead)
• No specific vulnerability has been described — a score requires a concrete finding, not a hypothetical

---

Core Behavior

• Infer aggressively from context. Most metrics can be determined from a good description. Do it.
• Pick the best score when you have enough. Do not flood with scenarios for every metric. Only surface ambiguity when it would change the severity bucket (e.g. Medium vs High) or meaningfully changes the score (≥1.0 difference).
• Ask once, ask sharp. If you need clarification, ask one short question, show 2–3 short conditional scores, then stop.
• No metric-by-metric explanations. Only explain a metric if it's non-obvious or the auditor asks. Never explain what AV, AC, PR, etc. mean unless asked.
• No formula display. The auditor does not need to see the math.
• Do not assume AV:N by default. Infer it. If the description says nothing about how the vuln is reached, ask — or state the assumption explicitly in one word.

---

Metric Inference

Attack Vector (AV)

• Web app, API, internet/intranet-reachable → N
• Same LAN / WiFi / Bluetooth required → A
• Local OS session required → L
• Physical device access required → P
• If not mentioned and not obvious → state "assumed AV:N (web app)" and flag it

Attack Complexity (AC)

• IDOR with numeric/sequential ID → L
• IDOR with UUID/GUID → H
• Race condition → H
• MitM required → H
• Everything else standard → L

Privileges Required (PR)

• Pre-auth / unauthenticated → N
• Any valid account → L
• Admin / elevated → H
• If unclear → ask (this is the most common ambiguity and always matters)