nvdlib icon indicating copy to clipboard operation
nvdlib copied to clipboard

CVE.metrics attribute is not treated as dict

Open Towito opened this issue 9 months ago • 1 comments

The metrics attribute of the CVE class is treated as type nvdlib.classes.CVE instead of a dict, despite documentation stating otherwise. I'm not sure if this is intended behavior, or if it's a documentation issue. Though out of scope for this issue, a similar behavior comes up when accessing the individual items in the following attributes:

  • descriptions
  • cwe
  • cpe

The invidual items in the list are treated as type nvdlib.classes.CVE instead of dict

Documentation Image

Behavior in environment (using python 3.13.2 and nvdlib 0.8.0) Image

Expected Behavior: Metrics variable functions as type dict

Towito avatar Mar 21 '25 19:03 Towito

Looking at it further, classes.py also includes this discrepancy. Under Class CVE, metrics is described as both a dict and a class object

    :var metrics: Class attribute containing scoring lists (cvssMetricV31 / V30 / V2).
    :vartype metrics: class

    :var weaknesses: Contains relevant CWE information.
    :vartype weaknesses: list

    :var configurations: List containing usually a single element of CPE information.
    :vartype configuration: list

    :var references: CVE reference links
    :vartype references: list

    :var cwe: Common Weakness Enumeration Specification (CWE)
    :vartype cwe: list

    :var url: Link to additional details on nvd.nist.gov for that CVE.
    :vartype url: str

    :var cpe: Common Platform Enumeration (CPE) assigned to the CVE.
    :vartype cpe: list

    :var metrics: CVSS metrics. Some CVEs may not have v2/v3 scores or none at all.
    :vartype metrics: dict

Towito avatar Mar 21 '25 23:03 Towito