cvss-score-extraction git:20260424.d50cf5aA

Immutable. This exact content never changes and is served at /api/v1/blob/c51040c4b6c4c3d5.

---
name: cvss-score-extraction
description: Extract CVSS scores from vulnerability data sources with proper fallback handling across NVD, GHSA, and RedHat sources.
---

# CVSS Score Extraction

## Overview
CVSS (Common Vulnerability Scoring System) scores may come from multiple sources in Trivy output. Implement priority-based extraction with fallbacks.

## Trivy CVSS Structure
```json
{
  "CVSS": {
    "nvd": { "V3Score": 9.8, "V3Vector": "..." },
    "ghsa": { "V3Score": 8.1, "V3Vector": "..." },
    "redhat": { "V3Score": 7.5, "V3Vector": "..." }
  }
}
```

## Extraction Priority
1. **NVD** (`nvd.V3Score`) — preferred authoritative source
2. **GHSA** (`ghsa.V3Score`) — GitHub Security Advisory
3. **RedHat** (`redhat.V3Score`) — Red Hat security data
4. Fall back to empty string or "N/A" if no score available

## Python Implementation
```python
def extract_cvss_score(cvss_data):
    """Extract CVSS v3 score with source priority: NVD > GHSA > RedHat."""
    if not cvss_data:
        return ""
    for source in ["nvd", "ghsa", "redhat"]:
        source_data = cvss_data.get(source, {})
        score = source_data.get("V3Score")
        if score is not None:
            return score
    return ""
```