--- title: How to Read a Security Advisory: CVE, GHSA, CWE, and... description: Security advisory scoring systems like CVSS represent eight assumptions about how an attack could unfold, not objective facts about your specific project. The... canonical: https://daily.dev/posts/how-to-read-a-security-advisory-cve-ghsa-cwe-and-cvss-in-plain-words-avnbzmp1y twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Read a Security Advisory: CVE, GHSA, CWE, and CVSS in Plain Words | daily.dev og:description: Security advisory scoring systems like CVSS represent eight assumptions about how an attack could unfold, not objective facts about your specific project. The... og:url: https://daily.dev/posts/how-to-read-a-security-advisory-cve-ghsa-cwe-and-cvss-in-plain-words-avnbzmp1y og:image: https://api.daily.dev/og/posts/aVnBzMp1Y.png og:image:alt: How to Read a Security Advisory: CVE, GHSA, CWE, and CVSS in Plain Words og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Read a Security Advisory: CVE, GHSA, CWE, and CVSS in Plain Words **[JS Development](https://daily.dev/sources/jsdevelopment)** · [@agustinbarrientos](https://daily.dev/agustinbarrientos) · 2 min read · 4 upvotes · 0 comments ## Summary Security advisory scoring systems like CVSS represent eight assumptions about how an attack could unfold, not objective facts about your specific project. The same vulnerability can be scored very differently (5.3 vs 7.5) by different databases depending on how those assumptions are judged. Rather than trusting a single number, developers should walk through their own setup: check the lockfile for the actual installed version, verify whether the vulnerable setting is enabled, confirm the vulnerable code path is reachable in deployment, and assess whether untrusted actors can reach it. The piece also distinguishes accidental bugs from deliberately malicious packages, and recommends using npm's min-release-age setting (suggesting seven days) to delay installing brand-new releases, which are more likely to be intentional attacks, giving time for review. ## Content [**Read the full article, with interactive demos**](https://agustinbarrientos.com/writing/senior-eye/security-advisories-dependency-updates?utm_source=dailydev&utm_medium=social&utm_campaign=security-advisories-dependency-updates&utm_content=post)** **or read the tl;dr; below: A severity score is a summary of _eight assumptions_ about how an attack would go. Two official databases scored the same bug **5.3 and 7.5** by judging two of those assumptions differently. Neither number knows anything about your project, so read the assumptions and ask which ones are true where you work. Now work through your own project, in order. Your lockfile tells you the version you actually got, and `package.json` only says what you’d accept. The advisory names a setting the bug depends on, so find out whether it’s switched on for you. Then ask whether that code runs where you deploy, and whether anyone you don’t trust can reach it. **The first no ends it**, and the reason belongs in writing, because setups drift. Before any of that, work out whether you’re looking at a mistake or an attack. Code published on purpose to hurt whoever installs it may **already have run**, and then you change every password and key it could reach. The newest release is also the likeliest to be an attack, so npm’s `min-release-age` holds installs back a few days and lets a reviewed fix through. I’d start at seven days. [**Read the full article**](https://agustinbarrientos.com/writing/senior-eye/security-advisories-dependency-updates?utm_source=dailydev&utm_medium=social&utm_campaign=security-advisories-dependency-updates&utm_content=post) ## Similar posts on daily.dev - [A year of open source vulnerability trends: CVEs, advisories, and malware](https://daily.dev/posts/a-year-of-open-source-vulnerability-trends-cves-advisories-and-malware-xirztt4ff) · GitHub Blog · 0 upvotes · 0 comments - [CVE, CVSS scores need overhauling, argues Codific CEO](https://daily.dev/posts/cve-cvss-scores-need-overhauling-argues-codific-ceo-wzbtvcl3f) · The Register · 0 upvotes · 0 comments - [CVSS v4.0: The Practical Field Guide for Vulnerability Management](https://daily.dev/posts/cvss-v4-0-the-practical-field-guide-for-vulnerability-management-nqv66s93a) · InfoSec Write-ups · 0 upvotes · 0 comments - [The CVE spike across major software companies is a remediation problem](https://daily.dev/posts/the-cve-spike-across-major-software-companies-is-a-remediation-problem-eirfbzfqc) · Aikido Security · 0 upvotes · 0 comments - [Linux CVE assignment process](https://daily.dev/posts/linux-cve-assignment-process-8whl1ct57) · Lobsters · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#npm](https://daily.dev/tags/npm) [View this post on daily.dev](https://daily.dev/posts/how-to-read-a-security-advisory-cve-ghsa-cwe-and-cvss-in-plain-words-avnbzmp1y) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/how-to-read-a-security-advisory-cve-ghsa-cwe-and-cvss-in-plain-words-avnbzmp1y","headline":"How to Read a Security Advisory: CVE, GHSA, CWE, and CVSS in Plain Words","text":"Security advisory scoring systems like CVSS represent eight assumptions about how an attack could unfold, not objective facts about your specific project. The same vulnerability can be scored very differently (5.3 vs 7.5) by different databases depending on how those assumptions are judged. Rather than trusting a single number, developers should walk through their own setup: check the lockfile for the actual installed version, verify whether the vulnerable setting is enabled, confirm the vulnerable code path is reachable in deployment, and assess whether untrusted actors can reach it. The piece also distinguishes accidental bugs from deliberately malicious packages, and recommends using npm's min-release-age setting (suggesting seven days) to delay installing brand-new releases, which are more likely to be intentional attacks, giving time for review.","url":"https://daily.dev/posts/how-to-read-a-security-advisory-cve-ghsa-cwe-and-cvss-in-plain-words-avnbzmp1y","datePublished":"2026-08-18T16:28:19.881Z","dateModified":"2026-09-13T20:55:38.201Z","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0","description":"Google Developer Expert in Web Technologies | Sr UI/UX Designer & Frontend Engineer","worksFor":{"@type":"Organization","name":"Uncanny Owl","logo":"https://www.google.com/s2/favicons?domain=uncannyowl.com&sz=128"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"EndorseAction"},"userInteractionCount":27370}},"image":"https://media.daily.dev/image/upload/s--O6scgUEo--/f_auto/v1786982080/posts/T96BMfWmF?_a=BAMAMicg0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/squads/jsdevelopment","name":"JS Development"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JS Development","item":"https://daily.dev/squads/jsdevelopment"},{"@type":"ListItem","position":3,"name":"How to Read a Security Advisory: CVE, GHSA, CWE, and CVSS in Plain Words"}]} ```