Add CVSS 3.1 severity for GHSA-qjm7-55vv-3c5f

[sunnypatell]

adds CNA-sourced CVSS 3.1 severity score to this advisory which currently has no CVSS scoring.

• source: NVD (CNA-provided)
• score: 3.5 (LOW)
• vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[shelbyc]

Hi @sunnypatell, the only change I made was setting attack vector to network. I'm not sure how VulDB got an attack vector of adjacent for a ReDoS.

[advisory-database]

Hi @sunnypatell! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[sunnypatell]

good catch @shelbyc. NVD actually rescored this as AV:N in their primary assessment too, overriding VulDB's AV:A. looking at it more closely, both this one (mel-spintax, text parsing) and #6945 (sisimai, email parsing) had identical VulDB vectors despite being completely different packages, which suggests templated scoring rather than actual per-CVE analysis. both process input that arrives over the network so AV:A never made sense. will cross-reference CNA vectors against NVD's primary assessment on future vuldb-sourced submissions.