---
id: cvss
version: "3.6"
license: LGPLv3+
license_treatment: copyleft
maintenance: aging
---

# cvss — CVSS2/3/4 library with interactive calculator for Python 2 and Python 3

License: copyleft · Maintenance: aging · Downloads: 2.0M/mo

## What it is and what it does

This package implements the Common Vulnerability Scoring System (CVSS) standards for Python, supporting all three major versions: v2, v3, and v4. It takes a CVSS vector string—a standardized notation that encodes vulnerability characteristics like attack vector, complexity, and impact—and computes the corresponding numeric score (0–10) and severity rating (e.g., 'Critical', 'High', 'Medium'). The library includes both a programmatic API for scripting and an interactive command-line calculator for manual scoring.

The package has no runtime dependencies and is tested across modern Python versions (3.6 through 3.13). It is designed to be lightweight and portable, making it suitable for integration into security tools, vulnerability databases, and assessment workflows where standardized severity ratings are needed.

Use it for:

- Score vulnerabilities in a security scanner or vulnerability management system using standardized CVSS ratings.
- Parse and validate CVSS vector strings from security advisories or CVE databases.
- Generate severity reports that map raw vulnerability data to standardized impact levels for stakeholder communication.
- Automate vulnerability triage by computing scores for large batches of security issues.
- Build a command-line tool for security analysts to interactively calculate CVSS scores during incident response.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses and scores CVSS v2, v3, and v4 vulnerability severity vectors, returning standardized numeric scores and severity ratings from 0 to 10.

Yes. The package is stable, dependency-free, and fills a clear need for standardized vulnerability scoring. The copyleft license is a minor consideration only if you plan to redistribute modified code. The aging maintenance status (375 days since last release) is not a blocker for a mature, narrow-scope library, but verify that the v2/v3/v4 standards it implements match your current security requirements.

## Install

pip install cvss
uv add cvss
poetry add cvss

## Installing cvss

Before you install: Low friction installation with no runtime dependencies. Maintenance status is aging—last release was 375 days ago—but the repository remains active and the package is marked Production/Stable.

License in practice: Licensed under LGPLv3+, a copyleft license. Any derivative work or modification must be distributed under the same or compatible license terms.

Quickstart:

pip install cvss

from cvss import CVSS3
vector = 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
c = CVSS3(vector)
print(c.scores())
print(c.severities())

Verify before relying:

- Whether the package is actively maintained or in maintenance-only mode given the 375-day gap since last release

## Package facts

- License: LGPLv3+ (copyleft)
- Python support: unspecified
- Install friction: low
- Maintenance: aging
- Downloads: 2.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

cvss score calculator, vulnerability severity rating, cvss vector parser, security scoring library, cvss2 cvss3 cvss4, common vulnerability scoring system, vulnerability assessment tool, vulnerability-scoring, security-standards

[View on SkillFed](https://skillfed.io/packages/cvss) · [View on PyPI](https://pypi.org/project/cvss/)