Get a global security advisory

GET

/advisories/{ghsa_id}

Gets a global security advisory using its GitHub Security Advisory (GHSA) identifier.

API method documentation

Parameters

Path Parameters

ghsa_id

required

string

The GHSA (GitHub Security Advisory) identifier of the advisory.

Responses

200

Response

application/json

A GitHub Security Advisory.

object

ghsa_id

required

The GitHub Security Advisory ID.

string

cve_id

required

The Common Vulnerabilities and Exposures (CVE) ID.

string

nullable

url

required

The API URL for the advisory.

string

html_url

required

The URL for the advisory.

string format: uri

repository_advisory_url

required

The API URL for the repository advisory.

string format: uri

nullable

summary

required

A short summary of the advisory.

string

<= 1024 characters

description

required

A detailed description of what the advisory entails.

string

nullable <= 65535 characters

type

required

The type of advisory.

string

Allowed values: reviewed unreviewed malware

severity

required

The severity of the advisory.

string

Allowed values: critical high medium low unknown

source_code_location

required

The URL of the advisory’s source code.

string format: uri

nullable

identifiers

required

Array<object>

nullable

object

type

required

The type of identifier.

string

Allowed values: CVE GHSA

value

required

The identifier value.

string

references

required

Array<string>

nullable

published_at

required

The date and time of when the advisory was published, in ISO 8601 format.

string format: date-time

updated_at

required

The date and time of when the advisory was last updated, in ISO 8601 format.

string format: date-time

github_reviewed_at

required

The date and time of when the advisory was reviewed by GitHub, in ISO 8601 format.

string format: date-time

nullable

nvd_published_at

required

The date and time when the advisory was published in the National Vulnerability Database, in ISO 8601 format. This field is only populated when the advisory is imported from the National Vulnerability Database.

string format: date-time

nullable

withdrawn_at

required

The date and time of when the advisory was withdrawn, in ISO 8601 format.

string format: date-time

nullable

vulnerabilities

required

The products and respective version ranges affected by the advisory.

Array<object>

nullable

A vulnerability describing the product and its affected versions within a GitHub Security Advisory.

object

package

required

The name of the package affected by the vulnerability.

object

ecosystem

required

The package’s language or package management ecosystem.

string

Allowed values: rubygems npm pip maven nuget composer go rust erlang actions pub other swift

name

required

The unique package name within its ecosystem.

string

nullable

vulnerable_version_range

required

The range of the package versions affected by the vulnerability.

string

nullable

first_patched_version

required

The package version that resolves the vulnerability.

string

nullable

vulnerable_functions

required

The functions in the package that are affected by the vulnerability.

Array<string>

nullable

cvss

required

object

vector_string

required

The CVSS vector.

string

nullable

score

required

The CVSS score.

number

nullable <= 10

cvss_severities

object

cvss_v3

object

vector_string

required

The CVSS 3 vector string.

string

nullable

score

required

The CVSS 3 score.

number

nullable <= 10

cvss_v4

object

vector_string

required

The CVSS 4 vector string.

string

nullable

score

required

The CVSS 4 score.

number

nullable <= 10

epss

The EPSS scores as calculated by the Exploit Prediction Scoring System.

object

percentage

number

<= 100

percentile

number

<= 100

cwes

required

Array<object>

nullable

object

cwe_id

required

The Common Weakness Enumeration (CWE) identifier.

string

name

required

The name of the CWE.

string

credits

required

The users who contributed to the advisory.

Array<object>

nullable

object

user

required

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

type

required

The type of credit the user is receiving.

string

Allowed values: analyst finder reporter coordinator remediation_developer remediation_reviewer remediation_verifier tool sponsor other

Examples

default

{
  "ghsa_id": "GHSA-abcd-1234-efgh",
  "cve_id": "CVE-2050-00000",
  "url": "https://api.github.com/advisories/GHSA-abcd-1234-efgh",
  "html_url": "https://github.com/advisories/GHSA-abcd-1234-efgh",
  "repository_advisory_url": "https://api.github.com/repos/project/a-package/security-advisories/GHSA-abcd-1234-efgh",
  "summary": "A short summary of the advisory.",
  "description": "A detailed description of what the advisory entails.",
  "type": "reviewed",
  "severity": "high",
  "source_code_location": "https://github.com/project/a-package",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-abcd-1234-efgh"
    },
    {
      "type": "CVE",
      "value": "CVE-2050-00000"
    }
  ],
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2050-00000"
  ],
  "published_at": "2023-03-23T02:30:56Z",
  "updated_at": "2023-03-24T02:30:56Z",
  "github_reviewed_at": "2023-03-23T02:30:56Z",
  "nvd_published_at": "2023-03-25T02:30:56Z",
  "withdrawn_at": null,
  "vulnerabilities": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "a-package"
      },
      "first_patched_version": "1.0.3",
      "vulnerable_version_range": "<=1.0.2",
      "vulnerable_functions": [
        "a_function"
      ]
    }
  ],
  "cvss": {
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
    "score": 7.6
  },
  "cvss_severities": {
    "cvss_v3": {
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "score": 7.6
    },
    "cvss_v4": {
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "score": 9.3
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-400",
      "name": "Uncontrolled Resource Consumption"
    }
  ],
  "credits": [
    {
      "user": {
        "login": "octocat",
        "id": 1,
        "node_id": "MDQ6VXNlcjE=",
        "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        "gravatar_id": "",
        "url": "https://api.github.com/users/octocat",
        "html_url": "https://github.com/octocat",
        "followers_url": "https://api.github.com/users/octocat/followers",
        "following_url": "https://api.github.com/users/octocat/following{/other_user}",
        "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
        "organizations_url": "https://api.github.com/users/octocat/orgs",
        "repos_url": "https://api.github.com/users/octocat/repos",
        "events_url": "https://api.github.com/users/octocat/events{/privacy}",
        "received_events_url": "https://api.github.com/users/octocat/received_events",
        "type": "User",
        "site_admin": false
      },
      "type": "analyst"
    }
  ]
}

404

Resource not found

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

Get a global security advisory

Parameters

Path Parameters

Responses

200

Examples

404

Example generated

Example ^generated