Missing severity when using shodan search with the faraday-cli

[lostmatrix-prim]

Hi,
after running "shodan search net:a.b.c.d" in faraday-cli I get all data including ip,hostname,CVE, description,etc in my faraday database.
But why is the severity and CVSS (don't need it) missing? All vulnerabilties have a CVE number but severity is always "info" and no CVSS.
I am using shodan search with "--fields vuln" but it doesnt make a difference.
I know from using search with shodan-cli directly that the xyz.json.gz file contains severity and CVSS.
faraday-cli version 2.2.1
faraday-plugins version 1.27.2

Thanks for any help.
Regards
Sven

[ignaciosoto93]

Thanks for reporting this. We reviewed the current plugin behavior and it does look like a bug/regression on our side: the Shodan parser is not preserving the CVSS/severity information from the source data as expected.

We’re going to review the plugin logic and evaluate the proper fix to restore that information during import. Thanks for the detailed report and version info.