What is a CVSS score, and how does Dependabot use it to prioritize security updates?

CVSS (Common Vulnerability Scoring System) is a standardized, numeric scale (0-10) rating a vulnerability's severity, factoring in how easily it can be exploited and how significant the impact would be if exploited. Dependabot alerts display this score (and its associated severity label — low, medium, high, critical) alongside each vulnerability, giving maintainers a consistent way to triage which alerts genuinely need urgent attention.

Security > Dependabot alerts
  - express 4.16.0 (Critical, CVSS 9.8) - Remote Code Execution
  - lodash 4.17.15 (Medium, CVSS 5.3) - Prototype Pollution

While Dependabot itself doesn't automatically make merge decisions based on CVSS score alone, the score is central to how teams typically prioritize their own response — a critical, high-CVSS remote code execution vulnerability in a production dependency generally warrants immediate action, while a low-severity issue in a rarely-invoked development-only dependency might reasonably wait for routine review.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.