GitHub Security Advisories Scraper

Here is one real result, with every field the actor returns (long arrays trimmed for readability):

{
  "ghsaId": "GHSA-m5w8-4gq2-6f8x",
  "cveId": null,
  "summary": "vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` - process-wide observability reads AND writes that hijack the host",
  "description": "# NodeVM `builtin: ['*']` exposes `os` and `dns` ...\n\n**CWE**: CWE-200 chained with CWE-732 ...",
  "severity": "critical",
  "type": "reviewed",
  "htmlUrl": "https://github.com/advisories/GHSA-m5w8-4gq2-6f8x",
  "sourceCodeLocation": "https://github.com/patriksimek/vm2",
  "repositoryAdvisoryUrl": "https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-m5w8-4gq2-6f8x",
  "cvssScore": 10,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
  "cvssV3Score": 10,
  "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
  "cvssV4Score": 0,
  "cvssV4Vector": null,
  "cwes": [
    { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" },
    { "id": "CWE-285", "name": "Improper Authorization" },
    { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }
  ],
  "cweIds": ["CWE-200", "CWE-285", "CWE-732"],
  "vulnerabilities": [
    {
      "ecosystem": "npm",
      "package": "vm2",
      "vulnerableVersionRange": "<= 3.11.5",
      "firstPatchedVersion": "3.11.6",
      "vulnerableFunctions": null
    }
  ],
  "affectedPackages": ["npm:vm2"],
  "ecosystems": ["npm"],
  "identifiers": [{ "type": "GHSA", "value": "GHSA-m5w8-4gq2-6f8x" }],
  "references": [
    "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x",
    "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
    "https://github.com/advisories/GHSA-m5w8-4gq2-6f8x"
  ],
  "credits": [{ "login": "offset", "profile": "https://github.com/offset", "type": "reporter" }],
  "epss": null,
  "withdrawn": false,
  "publishedAt": "2026-08-17T17:32:47Z",
  "updatedAt": "2026-08-17T17:32:48Z",
  "withdrawnAt": null,
  "githubReviewedAt": "2026-08-17T17:32:47Z",
  "nvdPublishedAt": null,
  "osv": {
    "source": "osv.dev",
    "queriedPackages": ["npm:vm2"],
    "matchCount": 48,
    "aliases": ["CVE-2023-37903", "GHSA-9g8x-92q2-p28f", "SNYK-JS-VM2-2309905"],
    "relatedAdvisories": [
      { "id": "GHSA-47x8-96vw-5wg6", "summary": "vm2 Access to Host Object Enables Sandbox Escape" },
      { "id": "GHSA-4w2j-2rg4-5mjw", "summary": "vm2 vulnerable to Arbitrary Code Execution" }
    ],
    "affectedRanges": [
      { "package": "vm2", "ecosystem": "npm", "type": "SEMVER", "events": "introduced:0 fixed:3.11.6" }
    ]
  },
  "aiPlainSummary": "A critical vulnerability in the vm2 package allows unauthorized access to sensitive host information and the ability to manipulate host processes. This can lead to severe security risks, including data exposure and system hijacking.",
  "aiAffectedWho": "Users of the vm2 package version 3.11.5 or earlier who have configured it to allow all built-in modules.",
  "aiRemediationSteps": [
    "Upgrade vm2 to version 3.11.6 or later.",
    "Avoid using the 'builtin: [\"*\"]' configuration; instead, explicitly exclude 'os' and 'dns' from the allowlist."
  ],
  "aiUrgency": "critical",
  "observedAt": "2026-08-19T21:26:40.629Z",
  "error": null
}

The most complete GitHub Security Advisory scraper available. It returns every field the GitHub Global Security Advisory database (GHSA) exposes for each advisory, including GHSA and CVE IDs, severity, CVSS score and vector (v3 and v4), CWE weaknesses, affected packages with vulnerable version ranges and first patched versions, references, credits and every timestamp, plus optional OSV.dev cross-reference enrichment and AI remediation guidance, and gives you 11 filters to target exactly the advisories you need.

📥 Input · 📤 Output · 💰 Pricing · ▶️ Examples

Table of contents

• What it does
• Quickstart
• Input reference
• Output reference
• Example output record
• Use cases
• Run via API and CLI
• Fetch results
• Billing
• FAQ and troubleshooting
• More scrapers at scrapers.lat

What it does

This actor pulls advisories from the GitHub Global Security Advisory database, the same data that powers Dependabot and GitHub's supply-chain alerts. For every advisory it captures the full record: the GHSA identifier, any linked CVE, a summary and full description, severity, CVSS score and vector (both v3 and v4 when present), the CWE weakness list, every affected package with its ecosystem, vulnerable version range and first patched version, all reference links, credited researchers and every published, updated, reviewed and withdrawn timestamp.

You can filter by ecosystem (npm, pip, RubyGems, Maven, NuGet, Composer, Go, Rust, and more), severity, advisory type (reviewed, unreviewed or malware), affected package name, CVE or GHSA ID, and published or updated date. Two optional paid add-ons enrich each advisory further: an OSV.dev cross-reference that pulls cross-source aliases, related advisories and affected version ranges for the affected packages, and AI remediation guidance that turns each advisory into a plain-language summary, an affected-audience note, concrete remediation steps and an urgency rating.

Quickstart

Pull the most recent critical npm advisories:

{
  "type": "reviewed",
  "ecosystem": "npm",
  "severity": "critical",
  "sort": "published",
  "direction": "desc",
  "maxResults": 100
}

Look up a single advisory by CVE:

{
  "cveId": "CVE-2024-3094",
  "maxResults": 1
}

Monitor everything affecting a package since a date, with both add-ons on:

{
  "affectsPackage": "lodash",
  "publishedSince": "2024-01-01",
  "crossReferenceOsv": true,
  "aiRemediation": true,
  "maxResults": 50
}

Input reference

Name	Type	Required	Description	Example
ecosystem	string (enum)	no	Only advisories affecting this package ecosystem. Leave empty for all. One of npm, pip, rubygems, maven, nuget, composer, go, rust, erlang, actions, pub, swift, other.	"npm"
severity	string (enum)	no	Filter by severity: low, medium, high, critical.	"critical"
type	string (enum)	no	reviewed, unreviewed or malware. Default reviewed.	"reviewed"
cveId	string	no	Look up one exact CVE identifier.	"CVE-2024-3094"
ghsaId	string	no	Look up one exact GHSA identifier.	"GHSA-rxjr-6c9q-h67x"
affectsPackage	string	no	One or more package names (comma-separated) to filter by.	"lodash,django"
publishedSince	string (date)	no	Only advisories published on or after this date (YYYY-MM-DD).	"2024-01-01"
updatedSince	string (date)	no	Only advisories updated on or after this date (YYYY-MM-DD).	"2024-06-01"
sort	string (enum)	no	Order by published or updated date. Default published.	"published"
direction	string (enum)	no	desc (newest first) or asc (oldest first). Default desc.	"desc"
maxResults	integer	no	Maximum advisories to collect. Default 100. Free plans capped at 10.	100
crossReferenceOsv	boolean	no	Paid add-on. Cross-reference each advisory against OSV.dev. Default false.	true
aiRemediation	boolean	no	Paid add-on. AI remediation guidance per advisory. Default false.	true
proxyConfiguration	object	no	Proxy used to reach GitHub. Residential US recommended.	{ "useApifyProxy": true }

Output reference

Name	Type	Description
ghsaId	string	GitHub Security Advisory identifier.
cveId	string | null	Associated CVE identifier, where one exists.
summary	string	Short one-line summary of the advisory.
description	string	Full Markdown description (summary, details, PoC, impact).
severity	string	GitHub severity: low, medium, high or critical.
type	string	Advisory type: reviewed, unreviewed or malware.
htmlUrl	string	Public GitHub advisory page URL.
sourceCodeLocation	string | null	Repository URL for the affected source code.
repositoryAdvisoryUrl	string | null	API URL of the originating repository advisory.
cvssScore	number | null	Best available CVSS base score (prefers v4, then v3).
cvssVector	string | null	Best available CVSS vector string.
cvssV3Score	number | null	CVSS v3 base score.
cvssV3Vector	string | null	CVSS v3 vector string.
cvssV4Score	number | null	CVSS v4 base score.
cvssV4Vector	string | null	CVSS v4 vector string.
cwes	array | null	CWE weaknesses: {id, name}.
cweIds	array | null	CWE IDs, for quick filtering.
vulnerabilities	array | null	Affected packages: {ecosystem, package, vulnerableVersionRange, firstPatchedVersion, vulnerableFunctions}.
affectedPackages	array | null	Affected packages as 'ecosystem:name' strings.
ecosystems	array | null	Unique ecosystems affected.
identifiers	array	All identifiers for the advisory: {type, value}.
references	array | null	Reference URLs (patches, commits, releases, writeups).
credits	array	Credited researchers: {login, profile, type}.
epss	object | null	EPSS exploit-probability data, when GitHub returns it.
withdrawn	boolean	True when the advisory has been withdrawn.
publishedAt	string	When the advisory was published (ISO 8601).
updatedAt	string	When the advisory was last updated (ISO 8601).
withdrawnAt	string | null	When the advisory was withdrawn, if applicable.
githubReviewedAt	string | null	When GitHub reviewed the advisory.
nvdPublishedAt	string | null	When the linked CVE was published on NVD.
osv	object | null	OSV.dev cross-reference add-on output (aliases, related advisories, affected ranges).
aiPlainSummary	string | null	AI remediation add-on: plain-language summary.
aiAffectedWho	string | null	AI remediation add-on: who or what is affected.
aiRemediationSteps	array | null	AI remediation add-on: concrete remediation steps.
aiUrgency	string | null	AI remediation add-on: urgency rating.
observedAt	string	When this record was scraped (ISO 8601).
error	string | null	Error message on a failed run row (never billed).

Example output record

See the hero record at the top of this page for a complete real advisory (vm2, GHSA-m5w8-4gq2-6f8x, CVSS 10 critical), including CWE list, affected package with patched version, OSV.dev cross-reference and AI remediation guidance.

Use cases

• Supply-chain security monitoring. Track new advisories affecting the ecosystems and packages your organization depends on, and route critical ones into alerts.
• Software composition analysis (SCA). Enrich your own dependency inventory with GHSA and CVE data, CVSS scores, CWE classes and exact vulnerable and patched version ranges.
• Vulnerability management and triage. Pull the full advisory record with CVSS v3 and v4, CWE weaknesses and remediation guidance to prioritize patching.
• Compliance and audit reporting. Build a defensible, timestamped record of known vulnerabilities affecting your stack for SOC 2, ISO 27001 or FedRAMP evidence.
• SBOM enrichment. Match packages in your software bill of materials against affected version ranges and first patched versions to flag exploitable components.
• Threat intelligence and OSINT. Feed structured GHSA, CVE, CWE and OSV alias data into a SIEM, data warehouse or research pipeline.

Run via API and CLI

Start a run with the Apify API:

curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~github-security-advisories-scraper/runs?token=YOUR_TOKEN" \
  -H "content-type: application/json" \
  -d '{"ecosystem":"npm","severity":"critical","maxResults":100}'

Run with the Apify CLI:

apify call scrapers_lat/github-security-advisories-scraper \
  --input '{"ecosystem":"npm","severity":"critical","maxResults":100}'

Fetch results

Download the dataset items in JSON, CSV or Excel:

curl "https://api.apify.com/v2/datasets/DATASET_ID/items?token=YOUR_TOKEN&format=json"
curl "https://api.apify.com/v2/datasets/DATASET_ID/items?token=YOUR_TOKEN&format=csv"

The run response includes the defaultDatasetId to use as DATASET_ID.

Billing

This actor is billed pay-per-result. You are charged only for records actually produced, never on failure.

Event	Price (USD)	When it is charged
result	$0.012	Once per advisory record returned in the dataset.
osv_cross_reference	$0.008	Once per advisory, only when the OSV.dev add-on is enabled and OSV returns a usable match.
ai_remediation	$0.012	Once per advisory, only when the AI add-on is enabled and the model returns usable output.

Notes:

• Free Apify plans are capped at 10 results per run. Both paid add-ons are disabled entirely for free plans.
• The two add-ons are opt-in and off by default. They are charged only when they genuinely produce data.
• Set a maxTotalChargeUsd spend limit on the run and the actor stops emitting billable results once the limit is reached.

FAQ and troubleshooting

Do I need a GitHub token? No. The GitHub advisories database is a public API and this actor reads it without authentication.

Why use a residential proxy? GitHub rate-limits unauthenticated traffic per IP. The default residential US proxy avoids shared-IP throttling so large pulls complete reliably. The actor also backs off and retries on rate-limit responses.

How current is the data? It is live. Each run reads the advisories database at request time, sorted by published or updated date as you choose.

What is the difference between reviewed, unreviewed and malware? Reviewed advisories are curated by GitHub's security team. Unreviewed are auto-imported (mostly from NVD). Malware advisories flag malicious packages.

Some fields are null. Not every advisory has a CVE, a CVSS v4 vector, an NVD date or EPSS data. Genuinely absent values are returned as null rather than fabricated.

More scrapers at scrapers.lat

Browse the full catalog of company registry, compliance, finance, government and developer data scrapers at scrapers.lat.