Hi @protozeit,
Thank you for your patience and your contribution, the CVE record has been updated to reflect the correct vulnerable and patch versions along with the CVSS score.

Hi @protozeit! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

Thank you @helixplant.
I think there's been a misunderstanding with the CVE record update for the CVSS. I made this PR in order to remove the CVSS 4.0 score because it was taking precedence over the CVSS 3.1 rating and making the severity go from HIGH to LOW on the advisory. This vulnerability should have HIGH severity in my opinion.

I'm not sure where the CVSS 4.0 score came from as my original vulnerability report only included the CVSS 3.1 score which evaluates the vulnerability as HIGH. Is it possible to delete the CVSS 4.0 score from the CVE record as well?

The CVSS 4.0 score is causing inconsistencies across different advisories:

• cve.org : LOW
• NIST : HIGH
• cadwyn advisory: HIGH
• github advisory: LOW