bug(cyclonedx): CVSS v4 ratings missing from CycloneDX vulnerability output

[DmitriyLewen]

Description

CVSS v4 ratings missing from CycloneDX vulnerability output

Steps to Reproduce

1. Create a pom.xml with a dependency on com.fasterxml.jackson.core:jackson-core:2.18.5
2. Run trivy filesystem . --scanners vuln --format json — CVSS v4 score is present
3. Run trivy filesystem . --scanners vuln --format cyclonedx — ratings is empty

Actual Behavior

"vulnerabilities": [
  {
    "id": "GHSA-72hv-8253-57qq",
    "ratings": [],
    ...
  }
]

Expected Behavior

"vulnerabilities": [
  {
    "id": "GHSA-72hv-8253-57qq",
    "ratings": [
      {
        "source": { "name": "ghsa" },
        "score": 8.7,
        "method": "CVSSv4",
        "severity": "high",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
      }
    ],
    ...
  }
]

Root Cause

The ratings() method in pkg/sbom/cyclonedx/marshal.go handles CVSS v2 and v3, but does not handle CVSS v4:

if cvss, ok := vuln.CVSS[sourceID]; ok {
    if cvss.V2Score != 0 || cvss.V2Vector != "" {
        rates = append(rates, m.ratingV2(sourceID, severity, cvss))
    }
    if cvss.V3Score != 0 || cvss.V3Vector != "" {
        rates = append(rates, m.ratingV3(sourceID, severity, cvss))
    }
    // V40Score / V40Vector are never checked → ratings stays empty
}

When a vulnerability has only V40Score/V40Vector, the if cvss, ok branch is entered (CVSS entry exists), but neither the v2 nor the v3 condition is satisfied, and the else fallback (severity-only rating) is never reached. Result:
ratings: [].

Both prerequisites for a fix are already in place:

• trivy-db CVSS struct already has V40Score and V40Vector fields
• cyclonedx-go v0.10.0 already defines ScoringMethodCVSSv4 = "CVSSv4", which is supported in CycloneDX spec 1.5+ (Trivy defaults to 1.6)

Related discussion:

• Trivy output in format cyclonedx does not include ghsa CVSS_V4 information #10281

[drawliin]

i've implemented a fix !!
opened a pr

[mahichachra]

Added a fix and linked the PR. Please review!