Gina Häußge on Nostr: And once more a security issue with a blown up CVSS score attached. Not only that, ...

And once more a security issue with a blown up CVSS score attached. Not only that, but then also a "oh, but I didn't know how CVSS works".

Well, thankfully how CVSS scoring works is not a secret, and I can only recommend investing the time to read through the (actually not that long) spec & guide to anyone involved in security issue reporting, esp. reporters & maintainers.

CVSS3.1 spec: https://www.first.org/cvss/v3.1/specification-document
Guide: https://www.first.org/cvss/v3.1/user-guide

(yes, CVSS4 is out, but AFAIK not yet widely used)