Recipe 10: CVSS with EPSS context

Policy as code also supports the Exploit Prediction Scoring System (EPSS), a data-driven metric designed to estimate the probability of a software vulnerability being exploited in the wild. Using CVSS alongside EPSS or even OSV (Open Source Vulnerabilities), we can make better informed decisions about whether to investigate, quarantine or promote a package based on multiple sources of risk data.

package cloudsmith
default match := false

max_epss := 0.0001
target_repository := "acme-corporation"
ignored_cves := {"CVE-2023-45853"}
match if count(reason) > 0

reason contains msg if {
    input.v0["repository"]["name"] == target_repository
    some vuln in input.v0["vulnerabilities"]

    vuln["patched_versions"]
    vuln["severity"] == "HIGH"
    not ignored_cve(vuln)

    # EPSS score exceeds threshold
    vuln["epss_score"]
    vuln["epss_score"] > max_epss

    msg := sprintf(
        "High severity vulnerability %s has EPSS score %.6f (threshold %.6f)",
        [vuln["VulnerabilityID"], vuln["epss_score"], max_epss]
    )
}

ignored_cve(vuln) if {
    vuln["VulnerabilityID"] in ignored_cves
}

Trigger Condition

max_epss := 0.0001  
val["score"] > max_epss

When and How It's Triggered

What's interesting about this specific Spotipy package example, is that it was picked up by EPSS but hasn't yet received a “vendor severity” scoring from NIST, emphasizing the need for EPSS as well as traditional vendor scoring sources within our policies.

pip download spotipy==2.25.0  
cloudsmith push python acme-corporation/acme-repo-one spotipy-2.25.0-py3-none-any.whl \-k "API_KEY"

Business value from this policy

EPSS is a metric that estimates the probability of a given vulnerability being exploited in the wild within the next 30 days. Unlike CVSS (Common Vulnerability Scoring System), which measures the inherent technical severity of a vulnerability, EPSS is focused on likelihood, using real-world data, threat intelligence feeds, and statistical models. CVSS might tell you that a vulnerability is “critical” because of the potential impact, but EPSS can indicate whether attackers are actually likely to exploit it soon. This makes EPSS a valuable complement to CVSS for prioritization because a high-severity vulnerability that is very unlikely to be exploited may not require immediate attention, while a lower-severity one with a high EPSS score might demand urgent mitigation.

This policy example blends CVSS and EPSS to improve vulnerability triage in Cloudsmith policy as code. It first filters for vulnerabilities specifically in the acme-corporation repository that are classified as “HIGH” severity under CVSS, ensuring that only technically significant issues are considered. It then applies an EPSS-based threshold (max_epss := 0.0001), flagging only those high-severity vulnerabilities whose exploitation probability exceeds this limit. By excluding vulnerabilities in the ignored_cves list, it allows for exceptions where risk is known to be acceptable or mitigated.
This dual-filter approach combines the impact assessment of CVSS with the real-world likelihood from EPSS, helping teams focus on vulnerabilities that are both severe and realistically exploitable.

Updated last week