the rating is nonsense anyway, which one actually applies to code you run varies wildly

9.x vulnerability might not matter if the function gets trusted data while 3.x one can screw you if it is in bad spot