GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Language support
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
4,037
Erlang
29
GitHub Actions
18
Go
1,851
Maven
5,000+
npm
3,586
NuGet
636
pip
3,169
Pub
10
RubyGems
850
Rust
803
Swift
34
Unreviewed advisories
All unreviewed
5,000+
18 advisories
Filter by severity
GitHub Actions Script Injection in `ultralytics/actions`
Critical
GHSA-7x29-qqmq-v6qc
was published
for
ultralytics/actions
(GitHub Actions)
Aug 14, 2024
fish-shop/syntax-check Improper Neutralization of Delimiters
Moderate
CVE-2024-42482
was published
for
fish-shop/syntax-check
(GitHub Actions)
Aug 12, 2024
github-slug-action use of `set-env` Runner commands which are processed via stdout
Moderate
GHSA-7f32-hm4h-w77q
was published
for
rlespinasse/github-slug-action
(GitHub Actions)
Feb 3, 2024
Potential Actions command injection in output filenames (GHSL-2023-275)
High
CVE-2023-52137
was published
for
tj-actions/verify-changed-files
(GitHub Actions)
Jan 2, 2024
tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271)
High
CVE-2023-51664
was published
for
tj-actions/changed-files
(GitHub Actions)
Jan 2, 2024
memory overflow vulnerability in OpenEXR-viewer
Critical
CVE-2023-50245
was published
for
afichet/openexr-viewer
(GitHub Actions)
Dec 12, 2023
tj-actions/branch-names's Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
Critical
CVE-2023-49291
was published
for
tj-actions/branch-names
(GitHub Actions)
Dec 5, 2023
Actions expression injection in `filter-test-configs` (`GHSL-2023-181`)
Moderate
GHSA-hw6r-g8gj-2987
was published
for
https://github.com/pytorch/pytorch/.github/actions/filter-test-configs
(GitHub Actions)
Aug 30, 2023
Data written to GitHub Actions Cache may expose secrets
High
CVE-2023-30853
was published
for
gradle/gradle-build-action
(GitHub Actions)
May 1, 2023
Arbitrary command injection in embano1/wip
High
CVE-2023-30623
was published
for
embano1/wip
(GitHub Actions)
Apr 24, 2023
github-slug-action vulnerable to arbitrary code execution
High
CVE-2023-27581
was published
for
rlespinasse/github-slug-action
(GitHub Actions)
Mar 13, 2023
Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower
Low
CVE-2023-23939
was published
for
Azure/setup-kubectl
(GitHub Actions)
Mar 7, 2023
Docker Command Escaping in the GitHub Actions Runner
High
CVE-2022-39321
was published
for
actions/runner
(GitHub Actions)
Oct 25, 2022
run-terraform allows for RCE via terraform plan
High
CVE-2022-39326
was published
for
kartverket/github-workflows
(GitHub Actions)
Oct 19, 2022
gajira-create GitHub action vulnerable to arbitrary code execution
Critical
CVE-2020-14188
was published
for
atlassian/gajira-create
(GitHub Actions)
Oct 7, 2022
ghas-to-csv vulnerable to Improper Neutralization of Formula Elements in a CSV File
Moderate
CVE-2022-39217
was published
for
some-natalie/ghas-to-csv
(GitHub Actions)
Sep 16, 2022
check-spelling workflow vulnerable to token leakage via symlink attack
Critical
CVE-2021-32724
was published
for
check-spelling/check-spelling
(GitHub Actions)
Jul 29, 2022
Vault GitHub Action did not correctly mask multi-line secrets in output
High
CVE-2021-32074
was published
for
hashicorp/vault-action
(GitHub Actions)
May 24, 2022
ProTip!
Advisories are also available from the
GraphQL API