@hailbytes/cvss-calc

Zero-dependency CVSS v3.1 and v4.0 calculator. Parse and score vulnerability vectors as a library or embedded web component — no network calls, no build step required.

What it does

Parse and score any CVSS v3.1 or v4.0 vector string in milliseconds — fully offline, zero dependencies. Use the calculate() function in your CI pipeline, vuln management tool, or ticketing integration, or drop the <hailbytes-cvss-calc> web component directly into any page.

Install

npm install @hailbytes/cvss-calc

Quick Start

Library

import { calculate } from '@hailbytes/cvss-calc';

// Score a CVSS v3.1 vector
const result = calculate('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H');
console.log(result.score);    // 9.8
console.log(result.severity); // 'Critical'
console.log(result.version);  // '3.1'

// Score a CVSS v4.0 vector
const v4 = calculate('CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N');
console.log(v4.score);    // 10.0
console.log(v4.severity); // 'Critical'

Lower-level API

import { parseVector, score } from '@hailbytes/cvss-calc';

const metrics = parseVector('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H');
const result = score(metrics);

Web Component

<!-- via npm -->
<script type="module">
  import '@hailbytes/cvss-calc/element';
</script>

<!-- or CDN -->
<script type="module" src="https://cdn.jsdelivr.net/npm/@hailbytes/cvss-calc/dist/element.js"></script>

<hailbytes-cvss-calc></hailbytes-cvss-calc>

<!-- Pre-populate with a vector -->
<hailbytes-cvss-calc vector="CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"></hailbytes-cvss-calc>

<!-- Listen for results -->
<script>
document.querySelector('hailbytes-cvss-calc').addEventListener('cvss-calculated', (e) => {
  console.log(e.detail.score, e.detail.severity);
});
</script>

Result Shape

interface CvssResult {
  score: number;           // 0.0 – 10.0
  severity: Severity;      // 'None' | 'Low' | 'Medium' | 'High' | 'Critical'
  version: '3.1' | '4.0'; // CVSS version parsed from the vector
  vector: string;          // Normalized vector string
}

Severity Ratings

| Severity | Score Range | |---|---| | None | 0.0 | | Low | 0.1 – 3.9 | | Medium | 4.0 – 6.9 | | High | 7.0 – 8.9 | | Critical | 9.0 – 10.0 |

Scoring follows the official FIRST CVSS v3.1 specification and CVSS v4.0 specification.

Who Is This For

Security engineers and DevSecOps teams building vuln management tooling, ticketing integrations, SIEM dashboards, or any tool that needs to parse and display CVSS scores without a third-party API or server call.

See Also

• @hailbytes/sbom-diff — Diff CycloneDX/SPDX SBOMs and surface new CVEs
• @hailbytes/asm-scope-parser — Parse and normalize attack surface scope definitions
• HailBytes ASM — Attack Surface Management platform

Part of the HailBytes open-source security toolkit.