Turn vulnerability texts into CVSS vectors

01 · Role in the system

What Jev does here

One request per description carries one Choice per CVSS metric - attack vector, complexity, privileges, impacts - plus safety Nouls for 4.0. The numeric score is never the model's: v3.0 and v3.1 use the closed-form spec equations including their quirks, and v4.0 ports FIRST's MacroVector algorithm with the embedded 270-entry lookup. NVD conventions are baked into the question criteria rather than left to the model's sense: arbitrary code execution implies high impacts, browsers count as network vector, severity labels in the text are ignored in favor of technical facts. Output shows every metric with its top-two probability spread, so a score that disagrees with an official one usually shows which metric diverged. The author reports exact NVD vector matches and zero cross-check mismatches against the official Python library (300 vectors) and FIRST's reference calculator (154 runs).

02 · Control boundary

Where Jev sits

Jev does metric selection only, one Choice per metric with calibration conventions written into the criteria; the score itself is closed-form spec code, and probability spreads surface near-misses.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• Scores only what the description says; missing impact details cannot be recovered, and the probability spread will show it.
• Agreement figures (exact NVD matches, the 0/300 and 0/154 cross-checks) are author-reported and were not independently rerun here.
• Environmental metrics are elicited only for v3.1; v4.0 asks only Exploit Maturity and safety.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• Red5d ↗Community · github · public · checked 2026-09-20