fix: check if 'type' is in severity for the OSV source (#5240)

* fix: check if 'type' is in severity for the OSV source

* fix: satisfy black linter requirement

---------

Co-authored-by: Sanskar Sharma <[email protected]>

Author: sbunwired

cve_bin_tool/data_sources/osv_source.py

@@ -263,7 +263,9 @@ def format_data(self, all_cve_entries):
 
             # getting score
             # OSV Schema currently only provides CVSS V3 scores, though more scores may be added in the future
-            if severity is not None and "CVSS_V3" in [x["type"] for x in severity]:
+            if severity is not None and "CVSS_V3" in [
+                x["type"] for x in severity if isinstance(x, dict) and "type" in x
+            ]:
                 try:
                     # Ensure CVSS vector is valid
                     if severity[0]["score"].endswith("/"):