Turn vulnerability texts into CVSS vectors

01 · Role in the system

What Jev does here

One request per description carries one Choice per CVSS metric - attack vector, complexity, privileges, impacts - plus safety Nouls for 4.0. The numeric score is never the model's: v3.0 and v3.1 use the closed-form spec equations including their quirks, and v4.0 ports FIRST's MacroVector algorithm with the embedded 270-entry lookup. NVD conventions are baked into the question criteria rather than left to the model's sense: arbitrary code execution implies high impacts, browsers count as network vector, severity labels in the text are ignored in favor of technical facts. Output shows every metric with its top-two probability spread, so a score that disagrees with an official one usually shows which metric diverged. The author reports exact NVD vector matches and zero cross-check mismatches against the official Python library (300 vectors) and FIRST's reference calculator (154 runs).

The model selects metrics; the specification computes the score

CVSS scoring has two parts, and this tool assigns each to the right executor. Jev selects every metric from the vulnerability description — one Choice per metric, plus safety Nouls for 4.0 — with NVD conventions written into the question criteria: arbitrary code execution implies high impacts, browsers count as network vector, severity labels in the prose are ignored in favor of technical facts. The numeric score is never the model's: closed-form spec equations for 3.0 and 3.1, and FIRST's MacroVector algorithm with the embedded 270-entry lookup for 4.0.

Because the model only classifies, its calibration is visible where it matters: output shows every metric with its top-two probability spread, so a score that disagrees with an official one usually shows which metric diverged — disagreement becomes debuggable instead of mysterious.

Strong agreement figures, attributed honestly

The author reports exact NVD vector matches and zero cross-check mismatches against the official Python library across 300 vectors and FIRST's reference calculator across 154 runs — and the record attributes those figures to the author rather than claiming independent reproduction, which is the correct E2 posture for numbers this good.

The residual limits are inherent to the input: scores only reflect what the description says, missing impact details cannot be recovered — though the probability spread will show the uncertainty — and environmental metrics are elicited only for 3.1 while 4.0 asks only Exploit Maturity and safety. Within those limits, this is the security cluster's cleanest demonstration of judgment-and-specification split.

02 · Control boundary

Where Jev sits

Jev does metric selection only, one Choice per metric with calibration conventions written into the criteria; the score itself is closed-form spec code, and probability spreads surface near-misses.

Code owns the loop, permissions, thresholds, validation, and side effects. Jev owns only the bounded judgments described above.

03 · Known limits

What this evidence does not prove

• Scores only what the description says; missing impact details cannot be recovered, and the probability spread will show it.
• Agreement figures (exact NVD matches, the 0/300 and 0/154 cross-checks) are author-reported and were not independently rerun here.
• Environmental metrics are elicited only for v3.1; v4.0 asks only Exploit Maturity and safety.

04 · Attribution

Public sources

This is a Community record: the project was published by a third-party community author.

• Red5d ↗Community · github · public · checked 2026-09-20