cvss

What it is and what it does

This package implements the Common Vulnerability Scoring System (CVSS) standards for Python, supporting all three major versions: v2, v3, and v4. It takes a CVSS vector string—a standardized notation that encodes vulnerability characteristics like attack vector, complexity, and impact—and computes the corresponding numeric score (0–10) and severity rating (e.g., 'Critical', 'High', 'Medium'). The library includes both a programmatic API for scripting and an interactive command-line calculator for manual scoring.

The package has no runtime dependencies and is tested across modern Python versions (3.6 through 3.13). It is designed to be lightweight and portable, making it suitable for integration into security tools, vulnerability databases, and assessment workflows where standardized severity ratings are needed.

Use it for:

• Score vulnerabilities in a security scanner or vulnerability management system using standardized CVSS ratings.
• Parse and validate CVSS vector strings from security advisories or CVE databases.
• Generate severity reports that map raw vulnerability data to standardized impact levels for stakeholder communication.
• Automate vulnerability triage by computing scores for large batches of security issues.
• Build a command-line tool for security analysts to interactively calculate CVSS scores during incident response.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses and scores CVSS v2, v3, and v4 vulnerability severity vectors, returning standardized numeric scores and severity ratings from 0 to 10.

Yes. The package is stable, dependency-free, and fills a clear need for standardized vulnerability scoring. The copyleft license is a minor consideration only if you plan to redistribute modified code. The aging maintenance status (375 days since last release) is not a blocker for a mature, narrow-scope library, but verify that the v2/v3/v4 standards it implements match your current security requirements.

Install

cvss on PyPI

pip install cvss

uv add cvss

poetry add cvss

Installing cvss

Before you install

Low friction installation with no runtime dependencies. Maintenance status is aging—last release was 375 days ago—but the repository remains active and the package is marked Production/Stable.

License in practice

Licensed under LGPLv3+, a copyleft license. Any derivative work or modification must be distributed under the same or compatible license terms.

Quickstart

pip install cvss

from cvss import CVSS3
vector = 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
c = CVSS3(vector)
print(c.scores())
print(c.severities())

Verify before relying

• Whether the package is actively maintained or in maintenance-only mode given the 375-day gap since last release

Package facts

Evidence: cvss-3.6-py2.py3-none-any.whl

Keywords: security, cvss, score, calculator

Tags

More Security packages