GitHub Security Advisories Scraper (GHSA) — Vulnerable Package Version Ranges

Scrape the GitHub Advisory Database (GHSA) into a clean, flat dataset: every vulnerability with its affected packages, the exact vulnerable version range, the first patched version, CVSS, EPSS, CWE and references — as JSON, CSV or Excel.

No API key required. No login. No proxy needed.

The point of this actor: a CVE feed tells you that something is vulnerable. GHSA tells you which package, in which ecosystem, in which version range, and what to upgrade to. That is the data you actually need to fix things.

---

Why this actor exists (and how it differs from CVE feeds)

Generic CVE feeds (NVD, CIRCL, CPE dictionaries) describe vulnerabilities in CPE strings — vendor/product/version tuples designed for enterprise asset inventories. They are close to useless for a modern dependency file, because cpe:2.3:a:lodash:lodash:4.17.15 does not tell your resolver that < 4.17.21 is vulnerable and 4.17.21 is the fix.

The GitHub Advisory Database is package-manager native. Every advisory carries a machine-readable list of affected packages with:

• ecosystem — npm, pip, Maven, NuGet, Composer, Go, RubyGems, Rust, GitHub Actions, …
• package_name — the exact registry name (lodash, django, org.bouncycastle:bcprov-jdk18on)
• vulnerable_version_range — e.g. >= 1.59, <= 1.80.1 or < 2.0.2
• first_patched_version — e.g. 1.80.2 (null when no fix exists yet)
• vulnerable_functions — reachable-symbol data where GitHub has it

How this differs from the sibling actors:

Actor	What it gives you
github-advisories-scraper (this one)	GHSA advisories with ecosystem-specific vulnerable version ranges and patched versions, per package
circl-cve-scraper	Classic CVE records (CVSS, descriptions, references) from the CIRCL CVE database
nist-cpe-scraper	NIST CPE dictionary — vendor/product/version identifiers, not package ranges

Use the CVE actors for vulnerability identity and enterprise asset matching. Use this one when you need to know which dependency to bump.

---

One row per (advisory × affected package)

This is the key design decision, and the reason the output is immediately usable in a spreadsheet.

One GHSA advisory can affect many packages — a BouncyCastle advisory in our test run affected 24 Maven artifacts, each with its own range. If we emitted one row per advisory, all of that would be buried in a nested array that Excel and Google Sheets flatten into unusable JSON blobs.

So the actor flattens: an advisory affecting 3 packages produces 3 rows, each carrying the full advisory context (ghsa_id, severity, CVSS, CWE…) plus that package's own ecosystem, package_name, vulnerable_version_range and first_patched_version.

Every row also carries affected_package_count, the total number of packages the advisory affects, so you can always deduplicate back to advisory level (GROUP BY ghsa_id) or spot wide-blast-radius advisories.

An advisory with zero listed packages still produces exactly one row, with the package fields set to null — so you never silently lose an advisory.

A real example: filtering npm + critical returned 100 advisories → 225 rows, because 23 of them affected more than one package.

---

Use cases

• SCA tooling — feed vulnerable version ranges into your own software composition analysis or dependency scanner instead of paying for a commercial feed.
• Dependency triage — join the export against your package-lock.json, requirements.txt, pom.xml or go.sum and find out what is actually exploitable in your tree.
• Security dashboards — build a live view of new critical advisories per ecosystem, with CVSS and EPSS for risk scoring.
• Patch prioritisation — sort by cvss_score and epss_percentage, filter to rows where first_patched_version is not null, and you have a ranked, actionable upgrade list.

---

Input

Field	Type	Default	Description
mode	select	advisories	What to scrape. Currently the GHSA advisory database.
ecosystem	select	any	any, npm, pip, rubygems, maven, nuget, composer, go, rust, actions
severity	select	any	any, low, medium, high, critical
affectsPackage	string	—	Only advisories affecting this exact package, e.g. lodash
advisoryType	select	reviewed	reviewed (curated, best quality), malware, unreviewed, any
githubToken	string (secret)	—	Optional. Raises the rate limit from 60 to 5000 requests/hour
maxItems	integer	200	Max dataset rows (max 5000). Remember: rows ≠ advisories

{
  "mode": "advisories",
  "ecosystem": "npm",
  "severity": "critical",
  "advisoryType": "reviewed",
  "maxItems": 200
}

---

Rate limits — read this before a big run

The advisories endpoint is fully public; the actor works with no credentials at all. But GitHub applies its standard API rate limit:

Mode	Limit
Keyless (default)	60 requests/hour, per IP
With a githubToken	5000 requests/hour

Each request returns up to 100 advisories, so keyless you can pull roughly 6000 advisories per hour — plenty for most filtered runs. If you want to mirror the whole database or run on a tight schedule, create a GitHub personal access token (no scopes required — a bare classic token or fine-grained token with read-only public access is enough) and paste it into githubToken.

The actor reads the x-ratelimit-remaining and x-ratelimit-reset response headers on every page, paces itself accordingly, and if the quota runs out it stops with a descriptive error naming the 60/hour keyless cap and the reset time rather than looping forever. If some rows were already collected, they are kept and the run finishes with a warning instead of failing.

Pagination uses GitHub's opaque cursor exposed only through the Link: …; rel="next" header — there is no page or offset parameter. The actor parses that header and stops cleanly when it is absent (the last page).

---

Output

One row per (advisory × affected package). All fields are nullable.

Field	Description
ghsa_id	GitHub advisory ID, e.g. GHSA-6wcc-39rp-hh9p
cve_id	Linked CVE, if one was assigned
summary	Short title (capped at 500 chars)
description	Full advisory text (capped at 8000 chars)
severity	low / medium / high / critical
type	reviewed / malware / unreviewed
cvss_score, cvss_vector	Primary CVSS score and vector string
cvss_v3_score, cvss_v4_score	Version-specific CVSS scores
epss_percentage, epss_percentile	EPSS exploit-prediction values
cwe_ids, cwe_names	Weakness classifications
ecosystem	This row's package ecosystem
package_name	This row's package name
vulnerable_version_range	e.g. >= 1.59, <= 1.80.1
first_patched_version	e.g. 1.80.2, or null if unpatched
vulnerable_functions	Affected symbols, when known
affected_package_count	Total packages affected by the advisory
published_at, updated_at	ISO-8601 UTC timestamps
github_reviewed_at, nvd_published_at	Review / NVD publication timestamps
withdrawn_at, is_withdrawn	Withdrawal timestamp and boolean flag
reference_count, references	Reference URLs (up to 10 kept)
credit_logins	GitHub logins credited for the report
source_code_location	Upstream repository URL
url	Public advisory page on github.com
source	Always github-advisories
scraped_at	ISO-8601 UTC scrape timestamp

Sample row

{
  "ghsa_id": "GHSA-574f-3g2m-x479",
  "cve_id": "CVE-2026-1000",
  "summary": "BouncyCastle vulnerability",
  "severity": "critical",
  "type": "reviewed",
  "cvss_score": 9.8,
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "cwe_ids": ["CWE-89"],
  "ecosystem": "maven",
  "package_name": "org.bouncycastle:bcprov-jdk18on",
  "vulnerable_version_range": ">= 1.59, <= 1.80.1",
  "first_patched_version": "1.80.2",
  "vulnerable_functions": ["doFinal"],
  "affected_package_count": 24,
  "published_at": "2025-11-26T09:31:21Z",
  "is_withdrawn": false,
  "url": "https://github.com/advisories/GHSA-574f-3g2m-x479",
  "source": "github-advisories"
}

---

Pricing

Roughly $0.50 per 1,000 rows in Apify platform usage. The actor is a lightweight HTTP client on 512 MB — no browser, no proxy, no residential traffic. A typical 200-row triage run costs a fraction of a cent.

---

Notes

• Data comes from the public GitHub Advisory Database and is licensed CC-BY-4.0 by GitHub. Attribute accordingly if you republish it.
• advisoryType: reviewed is the default because unreviewed advisories are auto-imported and can contain noisy or incomplete package data.
• withdrawn advisories are still returned (flagged via is_withdrawn) so you can filter them out yourself rather than having them silently disappear.

Related actors

• CIRCL CVE Scraper — classic CVE records with CVSS and references
• NIST CPE Scraper — official CPE product dictionary
• OpenSSF Scorecard Scraper — supply-chain security scores for repositories
• Software EOL Scraper — end-of-life and support windows for software versions