Trivy output in format cyclonedx does not include ghsa CVSS_V4 information

[TheCodear]

Description

Given a sample pom.xml file with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
         http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.example</groupId>
    <artifactId>vulnerable-jackson-demo</artifactId>
    <version>1.0-SNAPSHOT</version>

    <properties>
        <maven.compiler.source>11</maven.compiler.source>
        <maven.compiler.target>11</maven.compiler.target>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    </properties>

    <dependencies>
        <!-- Vulnerable version of jackson-core affected by GHSA-72hv-8253-57qq -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-core</artifactId>
            <version>2.18.5</version>
        </dependency>
    </dependencies>
</project>

According to the GHSA file, there is only a CVSSV4 score assigned to this vulnerability: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-72hv-8253-57qq/GHSA-72hv-8253-57qq.json#L9-L14

When running a trivy filesystem scan outputting the result in json format, the expected vulnerability is reported together with its score:

$ trivy filesystem . --scanners vuln --format json
...
{
  "SchemaVersion": 2,
  "Trivy": {
    "Version": "0.69.0"
  },
  "ReportID": "019cae72-05fa-7c1a-9598-5084f78e9349",
  "CreatedAt": "2026-03-02T13:07:14.170796936+01:00",
  "ArtifactName": ".",
  "ArtifactType": "filesystem",
  "Results": [
    {
      "Target": "pom.xml",
      "Class": "lang-pkgs",
      "Type": "pom",
      "Packages": ...
      "Vulnerabilities": [
        {
          "VulnerabilityID": "GHSA-72hv-8253-57qq",
          "PkgID": "com.fasterxml.jackson.core:jackson-core:2.18.5::afa9e7ce",
          "PkgName": "com.fasterxml.jackson.core:jackson-core",
          "PkgIdentifier": {
            "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5",
            "UID": "2f66c5fa62601168"
          },
          "InstalledVersion": "2.18.5",
          "FixedVersion": "2.18.6, 2.21.1, 3.1.0",
          "Status": "fixed",
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://github.com/advisories/GHSA-72hv-8253-57qq",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory Maven",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
          },
          "Fingerprint": "sha256:75dbe5102bb367f1f1951411d7bae3deca6b2337aaff93818fde6f05bc45095b",
          "Title": "jackson-core: Number Length Constraint Bypass in Async Parser Leads to Potential DoS Condition",
          "Description": "...",
          "Severity": "HIGH",
          "VendorSeverity": {
            "ghsa": 3
          },
          "CVSS": {
            "ghsa": {
              "V40Vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
              "V40Score": 8.7
            }
          },
          "References": [
            "https://github.com/FasterXML/jackson-core",
            "https://github.com/FasterXML/jackson-core/commit/a004e9789c2cc6b41b379d02d229d58474d9a738",
            "https://github.com/FasterXML/jackson-core/issues/1538",
            "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq"
          ],
          "PublishedDate": "2026-02-28T02:01:05Z",
          "LastModifiedDate": "2026-02-28T02:01:06Z"
        }
      ]
    }
  ]
}

When running the same command with output type cyclonedx, the ratings list is empty:

{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  ...
  "vulnerabilities": [
    {
      "id": "GHSA-72hv-8253-57qq",
      "source": {
        "name": "ghsa",
        "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
      },
      "ratings": [],
      "description": "...",
      "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-core to version 2.18.6, 2.21.1, 3.1.0",
      "advisories": [
        {
          "url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core/commit/a004e9789c2cc6b41b379d02d229d58474d9a738"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core/issues/1538"
        },
        {
          "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq"
        }
      ],
      "published": "2026-02-28T02:01:05+00:00",
      "updated": "2026-02-28T02:01:06+00:00",
      "affects": [
        {
          "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.18.5",
          "versions": [
            {
              "version": "2.18.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ]
}

I'd expect to see the same information than in the json output.

This might be related to aquasecurity/trivy-db#596 although the CVSSV4 information is available in the DB.

Desired Behavior

Running the command with --format cyclonedx should have the same CVSS score information as when running with --format json.

Actual Behavior

As shown above, the output does not contain the ratings as expected.

Reproduction Steps

1. copy the above example of a `pom.xml` file into an empty directory.
2. run `trivy filesystem . --scanners vuln --format json`
3. run `trivy filesystem . --scanners vuln --format cyclonedx`
4. compare the outputs regarding the GHSA vulnerability.

Target

Filesystem

Scanner

Vulnerability

Output Format

CycloneDX

Mode

Standalone

Debug Output

➜  trivy filesystem . --scanners vuln --format cyclonedx --debug
2026-03-02T13:18:20+01:00	DEBUG	No plugins loaded
2026-03-02T13:18:20+01:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2026-03-02T13:18:20+01:00	DEBUG	Cache dir	dir="/home/jan/.cache/trivy"
2026-03-02T13:18:20+01:00	DEBUG	Cache dir	dir="/home/jan/.cache/trivy"
2026-03-02T13:18:20+01:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-03-02T13:18:20+01:00	DEBUG	Ignore statuses	statuses=[]
2026-03-02T13:18:20+01:00	DEBUG	DB update was skipped because the local DB is the latest
2026-03-02T13:18:20+01:00	DEBUG	DB info	schema=2 updated_at=2026-03-02T06:45:54.494736289Z next_update=2026-03-03T06:45:54.494736159Z downloaded_at=2026-03-02T10:35:20.408734907Z
2026-03-02T13:18:20+01:00	DEBUG	[pkg] Package types	types=[os library]
2026-03-02T13:18:20+01:00	DEBUG	[pkg] Package relationships	relationships=[unknown root workspace direct indirect]
2026-03-02T13:18:20+01:00	INFO	[vuln] Vulnerability scanning is enabled
2026-03-02T13:18:20+01:00	DEBUG	Initializing scan cache...	type="memory"
2026-03-02T13:18:20+01:00	DEBUG	[notification] Running version check
2026-03-02T13:18:20+01:00	DEBUG	[fs] Analyzing...	root="."
2026-03-02T13:18:20+01:00	DEBUG	Created process-specific temp directory	path="/tmp/trivy-109130"
2026-03-02T13:18:20+01:00	DEBUG	[pom] Resolving...	group_id="com.fasterxml.jackson.core" artifact_id="jackson-core" version="2.18.5"
2026-03-02T13:18:20+01:00	DEBUG	[notification] Version check completed	latest_version="0.69.2"
2026-03-02T13:18:20+01:00	DEBUG	[pom] Adding repository	id="central-snapshots" url="https://central.sonatype.com/repository/maven-snapshots"
2026-03-02T13:18:20+01:00	DEBUG	[pom] Start parent	artifact="com.fasterxml.jackson:jackson-base:2.18.5"
2026-03-02T13:18:20+01:00	DEBUG	[pom] Start parent	artifact="com.fasterxml.jackson:jackson-bom:2.18.5"
2026-03-02T13:18:20+01:00	DEBUG	[pom] Start parent	artifact="com.fasterxml.jackson:jackson-parent:2.18.4"
2026-03-02T13:18:21+01:00	DEBUG	[pom] Start parent	artifact="com.fasterxml:oss-parent:69"
2026-03-02T13:18:21+01:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml:oss-parent:69"
2026-03-02T13:18:21+01:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson:jackson-parent:2.18.4"
2026-03-02T13:18:21+01:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson:jackson-bom:2.18.5"
2026-03-02T13:18:21+01:00	DEBUG	[pom] Exit parent	artifact="com.fasterxml.jackson:jackson-base:2.18.5"
2026-03-02T13:18:21+01:00	DEBUG	OS is not detected.
2026-03-02T13:18:21+01:00	DEBUG	Detected OS: unknown
2026-03-02T13:18:21+01:00	INFO	Number of language-specific files	num=1
2026-03-02T13:18:21+01:00	INFO	[pom] Detecting vulnerabilities...
2026-03-02T13:18:21+01:00	DEBUG	[pom] Scanning packages for vulnerabilities	file_path="pom.xml"
2026-03-02T13:18:21+01:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2026-03-02T13:18:21+01:00	DEBUG	[vex] VEX filtering is disabled
{ ... }
2026-03-02T13:18:21+01:00	DEBUG	[notification] Printing notices

📣 Notices:
  - Version 0.69.2 of Trivy is now available, current version is 0.69.0

To suppress version checks, run Trivy scans with the --skip-version-check flag

2026-03-02T13:18:21+01:00	DEBUG	Cleaning up temp directory	path="/tmp/trivy-109130"

Operating System

Linux x86_64

Version

$ trivy --version
Version: 0.69.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2026-03-02 06:45:54.494736289 +0000 UTC
  NextUpdate: 2026-03-03 06:45:54.494736159 +0000 UTC
  DownloadedAt: 2026-03-02 10:35:20.408734907 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2026-03-02 01:22:43.345831959 +0000 UTC
  NextUpdate: 2026-03-05 01:22:43.345831839 +0000 UTC
  DownloadedAt: 2026-03-02 09:34:17.56748554 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @TheCodear
Thanks for your report!

Created #10292

Regards, Dmitriy