List global security advisories

GET

/advisories

Lists all global security advisories that match the specified parameters. If no other parameters are defined, the request will return only GitHub-reviewed advisories that are not malware.

By default, all responses will exclude advisories for malware, because malware are not standard vulnerabilities. To list advisories for malware, you must include the type parameter in your request, with the value malware. For more information about the different types of security advisories, see “About the GitHub Advisory database.”

API method documentation

Parameters

Query Parameters

ghsa_id

string

If specified, only advisories with this GHSA (GitHub Security Advisory) identifier will be returned.

type

string

default: reviewed

Allowed values: reviewed malware unreviewed

If specified, only advisories of this type will be returned. By default, a request with no other parameters defined will only return reviewed advisories that are not malware.

cve_id

string

If specified, only advisories with this CVE (Common Vulnerabilities and Exposures) identifier will be returned.

ecosystem

The package’s language or package management ecosystem.

string

Allowed values: rubygems npm pip maven nuget composer go rust erlang actions pub other swift

If specified, only advisories for these ecosystems will be returned.

severity

string

Allowed values: unknown low medium high critical

If specified, only advisories with these severities will be returned.

cwes

One of:

string
Array<string>

string

If specified, only advisories with these Common Weakness Enumerations (CWEs) will be returned.

Example: cwes=79,284,22 or cwes[]=79&cwes[]=284&cwes[]=22

is_withdrawn

boolean

Whether to only return advisories that have been withdrawn.

affects

One of:

string
Array<string>

string

If specified, only return advisories that affect any of package or package@version. A maximum of 1000 packages can be specified. If the query parameter causes the URL to exceed the maximum URL length supported by your client, you must specify fewer packages.

Example: affects=package1,package2@1.0.0,package3@2.0.0 or affects[]=package1&affects[]=package2@1.0.0

published

string

If specified, only return advisories that were published on a date or date range.

For more information on the syntax of the date range, see “Understanding the search syntax.”

updated

string

If specified, only return advisories that were updated on a date or date range.

For more information on the syntax of the date range, see “Understanding the search syntax.”

modified

string

If specified, only show advisories that were updated or published on a date or date range.

For more information on the syntax of the date range, see “Understanding the search syntax.”

epss_percentage

string

If specified, only return advisories that have an EPSS percentage score that matches the provided value. The EPSS percentage represents the likelihood of a CVE being exploited.

epss_percentile

string

If specified, only return advisories that have an EPSS percentile score that matches the provided value. The EPSS percentile represents the relative rank of the CVE’s likelihood of being exploited compared to other CVEs.

before

string

A cursor, as given in the Link header. If specified, the query only searches for results before this cursor. For more information, see “Using pagination in the REST API.”

after

string

A cursor, as given in the Link header. If specified, the query only searches for results after this cursor. For more information, see “Using pagination in the REST API.”

direction

string

default: desc

Allowed values: asc desc

The direction to sort the results by.

per_page

integer

default: 30 >= 1 <= 100

The number of results per page (max 100). For more information, see “Using pagination in the REST API.”

sort

string

default: published

Allowed values: updated published epss_percentage epss_percentile

The property to sort the results by.

Responses

200

Response

application/json

Array<object>

A GitHub Security Advisory.

object

ghsa_id

required

The GitHub Security Advisory ID.

string

cve_id

required

The Common Vulnerabilities and Exposures (CVE) ID.

string

nullable

url

required

The API URL for the advisory.

string

html_url

required

The URL for the advisory.

string format: uri

repository_advisory_url

required

The API URL for the repository advisory.

string format: uri

nullable

summary

required

A short summary of the advisory.

string

<= 1024 characters

description

required

A detailed description of what the advisory entails.

string

nullable <= 65535 characters

type

required

The type of advisory.

string

Allowed values: reviewed unreviewed malware

severity

required

The severity of the advisory.

string

Allowed values: critical high medium low unknown

source_code_location

required

The URL of the advisory’s source code.

string format: uri

nullable

identifiers

required

Array<object>

nullable

object

type

required

The type of identifier.

string

Allowed values: CVE GHSA

value

required

The identifier value.

string

references

required

Array<string>

nullable

published_at

required

The date and time of when the advisory was published, in ISO 8601 format.

string format: date-time

updated_at

required

The date and time of when the advisory was last updated, in ISO 8601 format.

string format: date-time

github_reviewed_at

required

The date and time of when the advisory was reviewed by GitHub, in ISO 8601 format.

string format: date-time

nullable

nvd_published_at

required

The date and time when the advisory was published in the National Vulnerability Database, in ISO 8601 format. This field is only populated when the advisory is imported from the National Vulnerability Database.

string format: date-time

nullable

withdrawn_at

required

The date and time of when the advisory was withdrawn, in ISO 8601 format.

string format: date-time

nullable

vulnerabilities

required

The products and respective version ranges affected by the advisory.

Array<object>

nullable

A vulnerability describing the product and its affected versions within a GitHub Security Advisory.

object

package

required

The name of the package affected by the vulnerability.

object

ecosystem

required

The package’s language or package management ecosystem.

string

Allowed values: rubygems npm pip maven nuget composer go rust erlang actions pub other swift

name

required

The unique package name within its ecosystem.

string

nullable

vulnerable_version_range

required

The range of the package versions affected by the vulnerability.

string

nullable

first_patched_version

required

The package version that resolves the vulnerability.

string

nullable

vulnerable_functions

required

The functions in the package that are affected by the vulnerability.

Array<string>

nullable

cvss

required

object

vector_string

required

The CVSS vector.

string

nullable

score

required

The CVSS score.

number

nullable <= 10

cvss_severities

object

cvss_v3

object

vector_string

required

The CVSS 3 vector string.

string

nullable

score

required

The CVSS 3 score.

number

nullable <= 10

cvss_v4

object

vector_string

required

The CVSS 4 vector string.

string

nullable

score

required

The CVSS 4 score.

number

nullable <= 10

epss

The EPSS scores as calculated by the Exploit Prediction Scoring System.

object

percentage

number

<= 100

percentile

number

<= 100

cwes

required

Array<object>

nullable

object

cwe_id

required

The Common Weakness Enumeration (CWE) identifier.

string

name

required

The name of the CWE.

string

credits

required

The users who contributed to the advisory.

Array<object>

nullable

object

user

required

Simple User

A GitHub user.

object

name

string

nullable

email

string

nullable

login

required

string

required

integer format: int64

node_id

required

string

avatar_url

required

string format: uri

gravatar_id

required

string

nullable

url

required

string format: uri

html_url

required

string format: uri

followers_url

required

string format: uri

following_url

required

string

gists_url

required

string

starred_url

required

string

subscriptions_url

required

string format: uri

organizations_url

required

string format: uri

repos_url

required

string format: uri

events_url

required

string

received_events_url

required

string format: uri

type

required

string

site_admin

required

boolean

starred_at

string

user_view_type

string

type

required

The type of credit the user is receiving.

string

Allowed values: analyst finder reporter coordinator remediation_developer remediation_reviewer remediation_verifier tool sponsor other

Examples

default

[
  {
    "id": 1,
    "ghsa_id": "GHSA-abcd-1234-efgh",
    "cve_id": "CVE-2050-00000",
    "url": "https://api.github.com/advisories/GHSA-abcd-1234-efgh",
    "html_url": "https://github.com/advisories/GHSA-abcd-1234-efgh",
    "repository_advisory_url": "https://api.github.com/repos/project/a-package/security-advisories/GHSA-abcd-1234-efgh",
    "summary": "Heartbleed security advisory",
    "description": "This bug allows an attacker to read portions of the affected server’s memory, potentially disclosing sensitive information.",
    "type": "reviewed",
    "severity": "high",
    "source_code_location": "https://github.com/project/a-package",
    "identifiers": [
      {
        "type": "GHSA",
        "value": "GHSA-abcd-1234-efgh"
      },
      {
        "type": "CVE",
        "value": "CVE-2050-00000"
      }
    ],
    "references": [
      "https://nvd.nist.gov/vuln/detail/CVE-2050-00000"
    ],
    "published_at": "2023-03-23T02:30:56Z",
    "updated_at": "2023-03-24T02:30:56Z",
    "github_reviewed_at": "2023-03-23T02:30:56Z",
    "nvd_published_at": "2023-03-25T02:30:56Z",
    "withdrawn_at": null,
    "vulnerabilities": [
      {
        "package": {
          "ecosystem": "npm",
          "name": "a-package"
        },
        "first_patched_version": "1.0.3",
        "vulnerable_version_range": "<=1.0.2",
        "vulnerable_functions": [
          "a_function"
        ]
      }
    ],
    "cvss": {
      "vector_string": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
      "score": 7.6
    },
    "cvss_severities": {
      "cvss_v3": {
        "vector_string": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
        "score": 7.6
      },
      "cvss_v4": {
        "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "score": 9.3
      }
    },
    "cwes": [
      {
        "cwe_id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      }
    ],
    "epss": {
      "percentage": 0.00045,
      "percentile": "0.16001e0"
    },
    "credits": [
      {
        "user": {
          "login": "octocat",
          "id": 1,
          "node_id": "MDQ6VXNlcjE=",
          "avatar_url": "https://github.com/images/error/octocat_happy.gif",
          "gravatar_id": "",
          "url": "https://api.github.com/users/octocat",
          "html_url": "https://github.com/octocat",
          "followers_url": "https://api.github.com/users/octocat/followers",
          "following_url": "https://api.github.com/users/octocat/following{/other_user}",
          "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
          "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
          "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
          "organizations_url": "https://api.github.com/users/octocat/orgs",
          "repos_url": "https://api.github.com/users/octocat/repos",
          "events_url": "https://api.github.com/users/octocat/events{/privacy}",
          "received_events_url": "https://api.github.com/users/octocat/received_events",
          "type": "User",
          "site_admin": false
        },
        "type": "analyst"
      }
    ]
  }
]

422

Validation failed, or the endpoint has been spammed.

application/json

Validation Error Simple

Validation Error Simple

object

message

required

string

documentation_url

required

string

errors

Array<string>

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "errors": [
    "example"
  ]
}

429

Too many requests

application/json

Basic Error

Basic Error

object

message

string

documentation_url

string

url

string

status

string

Example ^generated

{
  "message": "example",
  "documentation_url": "example",
  "url": "example",
  "status": "example"
}

List global security advisories

Parameters

Query Parameters

Responses

200

Examples

422

Example generated

429

Example generated

Example ^generated

Example ^generated