The SARIF output (--format sarif) always sets every result's level to "warning", no matter how severe the vulnerability is:
https://github.com/google/osv-scanner/blob/main/internal/output/sarif.go#L356
This is a bit odd because a CVSS score/rating is already computed a few lines above (for the security-severity rule property), so the data needed to pick a better level is right there in scope, just not used for level itself.
The practical effect: in GitHub code scanning (and any other SARIF consumer that cares about level), a critical RCE and a low-severity denial-of-service look identical — everything shows up as a plain warning, so you can't sort/filter by severity or have it show up as a blocking check for high-severity findings only.
Happy to send a small PR mapping the existing CVSS rating (Critical/High -> error, Medium/Low/unknown -> warning, matching current behavior when there's no score) if that sounds reasonable — wanted to check first per the contributing guide before opening one.
The SARIF output (
--format sarif) always sets every result'slevelto"warning", no matter how severe the vulnerability is:https://github.com/google/osv-scanner/blob/main/internal/output/sarif.go#L356
This is a bit odd because a CVSS score/rating is already computed a few lines above (for the
security-severityrule property), so the data needed to pick a better level is right there in scope, just not used forlevelitself.The practical effect: in GitHub code scanning (and any other SARIF consumer that cares about
level), a critical RCE and a low-severity denial-of-service look identical — everything shows up as a plain warning, so you can't sort/filter by severity or have it show up as a blocking check for high-severity findings only.Happy to send a small PR mapping the existing CVSS rating (Critical/High ->
error, Medium/Low/unknown ->warning, matching current behavior when there's no score) if that sounds reasonable — wanted to check first per the contributing guide before opening one.