AI / Dependabot Interview questions
What is a CVSS score, and how does Dependabot use it to prioritize security updates?
CVSS (Common Vulnerability Scoring System) is a standardized, numeric scale (0-10) rating a vulnerability's severity, factoring in how easily it can be exploited and how significant the impact would be if exploited. Dependabot alerts display this score (and its associated severity label — low, medium, high, critical) alongside each vulnerability, giving maintainers a consistent way to triage which alerts genuinely need urgent attention.
Security > Dependabot alerts - express 4.16.0 (Critical, CVSS 9.8) - Remote Code Execution - lodash 4.17.15 (Medium, CVSS 5.3) - Prototype Pollution
While Dependabot itself doesn't automatically make merge decisions based on CVSS score alone, the score is central to how teams typically prioritize their own response — a critical, high-CVSS remote code execution vulnerability in a production dependency generally warrants immediate action, while a low-severity issue in a rarely-invoked development-only dependency might reasonably wait for routine review.
More Related questions...
