The {metæffekt} CVSS Calculator supports all versions of the CVSS standard by FIRST to model CVSS vectors and calculate their scores. It consists of the following components:

Installation

This project implements the following versions of the CVSS standard by FIRST:

• CVSS:2.0 - https://www.first.org/cvss/v2/guide
• CVSS:3.0 - https://www.first.org/cvss/v3.0/specification-document
• CVSS:3.1 - https://www.first.org/cvss/v3.1/specification-document
• CVSS:4.0 - https://www.first.org/cvss/v4.0/specification-document

Available on NPM as ae-cvss-calculator and installable via:

npm install ae-cvss-calculator

Usage

The library exports classes for CVSS versions 2.0 (Cvss2), 3.0 (Cvss3P0), 3.1 (Cvss3P1), and 4.0 (Cvss4P0), along with utility functions for parsing.

Basic Usage (Specific Version)

If you know the specific CVSS version of your vector, you can instantiate the corresponding class directly.

// Initialize with a vector string
const cvss = new Cvss3P1('CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L');

// Calculate scores
const scores = cvss.calculateScores();
console.log(`Base Score: ${scores.base}`);
console.log(`Vector: ${scores.vector}`);

// Normalize scores to 0-10 scale (useful for visualization)
const normalized = cvss.calculateScores(true);
console.log(`Exploitability: ${normalized.exploitability}`);

Depending on the vector version, different scores are exposed via the returned object.

Generic Vector Parsing

Use fromVector to automatically detect the CVSS version and parse the string into the appropriate object instance.

const vectorString = 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L';
const cvss = fromVector(vectorString);

if (cvss) {
  console.log(`Detected: ${cvss.getVectorName()}`); // CVSS:3.1
  console.log(`Score: ${cvss.calculateScores().overall}`);
} else {
  console.error('Invalid or unsupported CVSS vector');
}

Modifying Components

You can modify vector components programmatically using applyComponentString.

const cvss = new Cvss4P0('CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N');

cvss.applyComponentString('AV', 'P');
cvss.applyComponent(Cvss4P0Components.AC, Cvss4P0Components.AC_VALUES.H);

Build

git clone https://github.com/org-metaeffekt/metaeffekt-universal-cvss-calculator
cd metaeffekt-universal-cvss-calculator/ae-cvss-calculator
npm install
npm run build

The minified ae-cvss-calculator.js can be found in the dist directory.

Otherwise, you can also build the packaged version by running

npm run pack

To publish a new version:

1. Make sure that you pushed all the code related to the release, including the version bump to git, as npm will fetch that state for the release.
2. Ensure that you removed all target folders (dist) and bundles (ae-cvss-calculator-1.0.9.tgz).
3. Run the following commands:

npm login
npm run pack
npm publish

4. Update the dependency in Artifact Analysis in the VAD.