CVE Severity Scores Are Inflated: JFrog's 96% Finding

When a CVE lands at Critical severity, most security teams treat it as a fire drill. The problem: 96% of critical CVEs warranted a lower rating after contextual analysis, according to JFrog’s security research team.

Why Everyone Believes CVE Scores

CVSS (Common Vulnerability Scoring System) scores are designed to standardize severity communication across the industry. A 9.8 Critical is supposed to mean something reliably dangerous — and that assumption is deeply embedded in how security work gets done. SCA tools surface these scores in pull requests. Compliance frameworks key off them. Breach notification checklists use them as triggers. The institutional authority of a high score is real, and treating it as a reliable signal is a reasonable operating assumption.

What the Evidence Shows

JFrog’s research identified a systematic flaw: CVSS scores evaluate maximum theoretical impact, not practical exploitability. Their analysis of critical vulnerabilities from 2025 found 96% warranted a lower severity rating, and 65% of NVD high-severity vulnerabilities were downgraded after contextual review.

The prototype pollution case study illustrates how this works in practice. Prototype pollution is a JavaScript vulnerability that allows modification of Object.prototype, causing attacker-controlled values to propagate throughout an application. JFrog documented that Axios received 10 CVEs since April 2026 — some rated Critical — despite every one requiring a pre-existing prototype pollution vulnerability elsewhere in the application to be exploitable.

Axios functions as a gadget: it consumes polluted properties but doesn’t introduce the pollution itself. JFrog’s proof-of-concept required chaining a seven-year-old Lodash vulnerability with Axios to demonstrate exploitability. Neither component alone creates the attack path. The Critical rating describes what happens after exploitation succeeds, not how realistic exploitation is in the first place.

The same pattern appeared in DOMPurify (CVE-2024-48910) and React Router, confirming this scoring inflation is systemic across the JavaScript ecosystem.

The Correction

CVSS scores describe worst-case impact, not worst-case probability. A Critical score on a gadget vulnerability doesn’t mean an application is critically vulnerable — it means the vulnerability could be critical if chained with another specific condition in a specific environment. The useful question isn’t “what is the CVSS score?” but “what prerequisites does exploitation require, and do those prerequisites exist in our stack?”

Source: JFrog Blog

Content created with AI assistance and reviewed for accuracy.