From 19a45fc77c16865ad1ddffb2113f6b7abbbba731 Mon Sep 17 00:00:00 2001
From: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:53:56 +0800
Subject: [PATCH] fix(reports): render CVSSv4 baseScore = 0.0 in JSON+XML
 reports

Our own code defines `baseScore` as non-null (despite being a boxed Double) and most other reports assume it is, so should be safe. The current check is problematic as Velocity treats 0 as "false" in the check, which omits 0 scores (SeverityType = NONE) which is incorrect.

Seems safe and simplest to change things like this rather than contort Velocity to do a "is non-null" check. Note that there are many other places where the baseScore is taken directly within the `#if` emptiness check, so suspect this was just generated/propagated across all fields in the data naively. It's already assumed to be there in the HTML and SARIF reports, for example.

Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
---
 core/src/main/resources/templates/jsonReport.vsl | 4 ----
 core/src/main/resources/templates/xmlReport.vsl  | 4 ----
 2 files changed, 8 deletions(-)

diff --git a/core/src/main/resources/templates/jsonReport.vsl b/core/src/main/resources/templates/jsonReport.vsl
index a8c8716bf6f..b0ae9834517 100644
--- a/core/src/main/resources/templates/jsonReport.vsl
+++ b/core/src/main/resources/templates/jsonReport.vsl
@@ -351,9 +351,7 @@
 #if($vuln.cvssV4.cvssData.providerUrgency)
                         ,"providerUrgency": "$enc.json($vuln.cvssV4.cvssData.providerUrgency)"
 #end
-#if($vuln.cvssV4.cvssData.baseScore)
                         ,"baseScore": $vuln.cvssV4.cvssData.baseScore
-#end
 #if($vuln.cvssV4.cvssData.baseSeverity)
                         ,"baseSeverity": "$enc.json($vuln.cvssV4.cvssData.baseSeverity)"
 #end
@@ -558,9 +556,7 @@
 #if($vuln.cvssV4.cvssData.providerUrgency)
                         ,"providerUrgency": "$enc.json($vuln.cvssV4.cvssData.providerUrgency)"
 #end
-#if($vuln.cvssV4.cvssData.baseScore)
                         ,"baseScore": $vuln.cvssV4.cvssData.baseScore
-#end
 #if($vuln.cvssV4.cvssData.baseSeverity)
                         ,"baseSeverity": "$enc.json($vuln.cvssV4.cvssData.baseSeverity)"
 #end
diff --git a/core/src/main/resources/templates/xmlReport.vsl b/core/src/main/resources/templates/xmlReport.vsl
index 6c5f64c6917..721cace48cc 100644
--- a/core/src/main/resources/templates/xmlReport.vsl
+++ b/core/src/main/resources/templates/xmlReport.vsl
@@ -376,9 +376,7 @@ Copyright (c) 2018 Jeremy Long. All Rights Reserved.
 #if($vuln.cvssV4.cvssData.providerUrgency)
                             <providerUrgency>$enc.xml($vuln.cvssV4.cvssData.providerUrgency)</providerUrgency>
 #end
-#if($vuln.cvssV4.cvssData.baseScore)
                             <baseScore>$enc.xml($vuln.cvssV4.cvssData.baseScore)</baseScore>
-#end
 #if($vuln.cvssV4.cvssData.baseSeverity)
                             <baseSeverity>$enc.xml($vuln.cvssV4.cvssData.baseSeverity)</baseSeverity>
 #end
@@ -575,9 +573,7 @@ Copyright (c) 2018 Jeremy Long. All Rights Reserved.
 #if($vuln.cvssV4.cvssData.providerUrgency)
                             <providerUrgency>$enc.xml($vuln.cvssV4.cvssData.providerUrgency)</providerUrgency>
 #end
-#if($vuln.cvssV4.cvssData.baseScore)
                             <baseScore>$enc.xml($vuln.cvssV4.cvssData.baseScore)</baseScore>
-#end
 #if($vuln.cvssV4.cvssData.baseSeverity)
                             <baseSeverity>$enc.xml($vuln.cvssV4.cvssData.baseSeverity)</baseSeverity>
 #end