# GitHub Security Advisories Scraper (GHSA, CVE, CVSS) (`scrapers_lat/github-security-advisories-scraper`) Actor

Scrape the GitHub Global Security Advisory database. Extract GHSA & CVE IDs, severity, CVSS score+vector, CWEs, affected packages, patched versions and references. Optional OSV.dev cross-reference and AI remediation. JSON, CSV, Excel.

- **URL**: https://apify.com/scrapers\_lat/github-security-advisories-scraper.md
- **Developed by:** [Scrapers Lat](https://apify.com/scrapers_lat) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $12.48 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![GitHub Security Advisories Scraper](https://scrapers.lat/banners/github-security-advisories-scraper.png)](https://console.apify.com/actors/KxH2XRm95bbyR4d7W/input)

## GitHub Security Advisories Scraper

Here is one real result, with every field the actor returns (long arrays trimmed for readability):

```json
{
  "ghsaId": "GHSA-m5w8-4gq2-6f8x",
  "cveId": null,
  "summary": "vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` - process-wide observability reads AND writes that hijack the host",
  "description": "# NodeVM `builtin: ['*']` exposes `os` and `dns` ...\n\n**CWE**: CWE-200 chained with CWE-732 ...",
  "severity": "critical",
  "type": "reviewed",
  "htmlUrl": "https://github.com/advisories/GHSA-m5w8-4gq2-6f8x",
  "sourceCodeLocation": "https://github.com/patriksimek/vm2",
  "repositoryAdvisoryUrl": "https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-m5w8-4gq2-6f8x",
  "cvssScore": 10,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
  "cvssV3Score": 10,
  "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
  "cvssV4Score": 0,
  "cvssV4Vector": null,
  "cwes": [
    { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" },
    { "id": "CWE-285", "name": "Improper Authorization" },
    { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }
  ],
  "cweIds": ["CWE-200", "CWE-285", "CWE-732"],
  "vulnerabilities": [
    {
      "ecosystem": "npm",
      "package": "vm2",
      "vulnerableVersionRange": "<= 3.11.5",
      "firstPatchedVersion": "3.11.6",
      "vulnerableFunctions": null
    }
  ],
  "affectedPackages": ["npm:vm2"],
  "ecosystems": ["npm"],
  "identifiers": [{ "type": "GHSA", "value": "GHSA-m5w8-4gq2-6f8x" }],
  "references": [
    "https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x",
    "https://github.com/patriksimek/vm2/releases/tag/3.11.6",
    "https://github.com/advisories/GHSA-m5w8-4gq2-6f8x"
  ],
  "credits": [{ "login": "offset", "profile": "https://github.com/offset", "type": "reporter" }],
  "epss": null,
  "withdrawn": false,
  "publishedAt": "2026-08-17T17:32:47Z",
  "updatedAt": "2026-08-17T17:32:48Z",
  "withdrawnAt": null,
  "githubReviewedAt": "2026-08-17T17:32:47Z",
  "nvdPublishedAt": null,
  "osv": {
    "source": "osv.dev",
    "queriedPackages": ["npm:vm2"],
    "matchCount": 48,
    "aliases": ["CVE-2023-37903", "GHSA-9g8x-92q2-p28f", "SNYK-JS-VM2-2309905"],
    "relatedAdvisories": [
      { "id": "GHSA-47x8-96vw-5wg6", "summary": "vm2 Access to Host Object Enables Sandbox Escape" },
      { "id": "GHSA-4w2j-2rg4-5mjw", "summary": "vm2 vulnerable to Arbitrary Code Execution" }
    ],
    "affectedRanges": [
      { "package": "vm2", "ecosystem": "npm", "type": "SEMVER", "events": "introduced:0 fixed:3.11.6" }
    ]
  },
  "aiPlainSummary": "A critical vulnerability in the vm2 package allows unauthorized access to sensitive host information and the ability to manipulate host processes. This can lead to severe security risks, including data exposure and system hijacking.",
  "aiAffectedWho": "Users of the vm2 package version 3.11.5 or earlier who have configured it to allow all built-in modules.",
  "aiRemediationSteps": [
    "Upgrade vm2 to version 3.11.6 or later.",
    "Avoid using the 'builtin: [\"*\"]' configuration; instead, explicitly exclude 'os' and 'dns' from the allowlist."
  ],
  "aiUrgency": "critical",
  "observedAt": "2026-08-19T21:26:40.629Z",
  "error": null
}
```

The most complete GitHub Security Advisory scraper available. It returns every field the GitHub Global Security Advisory database (GHSA) exposes for each advisory, including GHSA and CVE IDs, severity, CVSS score and vector (v3 and v4), CWE weaknesses, affected packages with vulnerable version ranges and first patched versions, references, credits and every timestamp, plus optional OSV.dev cross-reference enrichment and AI remediation guidance, and gives you 11 filters to target exactly the advisories you need.

**📥 [Input](https://console.apify.com/actors/KxH2XRm95bbyR4d7W/input) · 📤 [Output](https://console.apify.com/actors/KxH2XRm95bbyR4d7W/runs) · 💰 [Pricing](https://console.apify.com/actors/KxH2XRm95bbyR4d7W/information/latest/pricing) · ▶️ [Examples](#quickstart)**

![Platform](https://img.shields.io/badge/platform-Apify-blue) ![Coverage](https://img.shields.io/badge/coverage-GHSA%20global%20database-brightgreen) ![Output](https://img.shields.io/badge/output-JSON%20%7C%20CSV%20%7C%20Excel-orange) ![Billing](https://img.shields.io/badge/billing-pay%20per%20result-purple)

### Table of contents

- [What it does](#what-it-does)
- [Quickstart](#quickstart)
- [Input reference](#input-reference)
- [Output reference](#output-reference)
- [Example output record](#example-output-record)
- [Use cases](#use-cases)
- [Run via API and CLI](#run-via-api-and-cli)
- [Fetch results](#fetch-results)
- [Billing](#billing)
- [FAQ and troubleshooting](#faq-and-troubleshooting)
- [More scrapers at scrapers.lat](#more-scrapers-at-scraperslat)

### What it does

This actor pulls advisories from the GitHub Global Security Advisory database, the same data that powers Dependabot and GitHub's supply-chain alerts. For every advisory it captures the full record: the GHSA identifier, any linked CVE, a summary and full description, severity, CVSS score and vector (both v3 and v4 when present), the CWE weakness list, every affected package with its ecosystem, vulnerable version range and first patched version, all reference links, credited researchers and every published, updated, reviewed and withdrawn timestamp.

You can filter by ecosystem (npm, pip, RubyGems, Maven, NuGet, Composer, Go, Rust, and more), severity, advisory type (reviewed, unreviewed or malware), affected package name, CVE or GHSA ID, and published or updated date. Two optional paid add-ons enrich each advisory further: an OSV.dev cross-reference that pulls cross-source aliases, related advisories and affected version ranges for the affected packages, and AI remediation guidance that turns each advisory into a plain-language summary, an affected-audience note, concrete remediation steps and an urgency rating.

### Quickstart

Pull the most recent critical npm advisories:

```json
{
  "type": "reviewed",
  "ecosystem": "npm",
  "severity": "critical",
  "sort": "published",
  "direction": "desc",
  "maxResults": 100
}
```

Look up a single advisory by CVE:

```json
{
  "cveId": "CVE-2024-3094",
  "maxResults": 1
}
```

Monitor everything affecting a package since a date, with both add-ons on:

```json
{
  "affectsPackage": "lodash",
  "publishedSince": "2024-01-01",
  "crossReferenceOsv": true,
  "aiRemediation": true,
  "maxResults": 50
}
```

### Input reference

| Name | Type | Required | Description | Example |
|------|------|----------|-------------|---------|
| `ecosystem` | string (enum) | no | Only advisories affecting this package ecosystem. Leave empty for all. One of npm, pip, rubygems, maven, nuget, composer, go, rust, erlang, actions, pub, swift, other. | `"npm"` |
| `severity` | string (enum) | no | Filter by severity: low, medium, high, critical. | `"critical"` |
| `type` | string (enum) | no | reviewed, unreviewed or malware. Default reviewed. | `"reviewed"` |
| `cveId` | string | no | Look up one exact CVE identifier. | `"CVE-2024-3094"` |
| `ghsaId` | string | no | Look up one exact GHSA identifier. | `"GHSA-rxjr-6c9q-h67x"` |
| `affectsPackage` | string | no | One or more package names (comma-separated) to filter by. | `"lodash,django"` |
| `publishedSince` | string (date) | no | Only advisories published on or after this date (YYYY-MM-DD). | `"2024-01-01"` |
| `updatedSince` | string (date) | no | Only advisories updated on or after this date (YYYY-MM-DD). | `"2024-06-01"` |
| `sort` | string (enum) | no | Order by published or updated date. Default published. | `"published"` |
| `direction` | string (enum) | no | desc (newest first) or asc (oldest first). Default desc. | `"desc"` |
| `maxResults` | integer | no | Maximum advisories to collect. Default 100. Free plans capped at 10. | `100` |
| `crossReferenceOsv` | boolean | no | Paid add-on. Cross-reference each advisory against OSV.dev. Default false. | `true` |
| `aiRemediation` | boolean | no | Paid add-on. AI remediation guidance per advisory. Default false. | `true` |
| `proxyConfiguration` | object | no | Proxy used to reach GitHub. Residential US recommended. | `{ "useApifyProxy": true }` |

### Output reference

| Name | Type | Description |
|------|------|-------------|
| `ghsaId` | string | GitHub Security Advisory identifier. |
| `cveId` | string | null | Associated CVE identifier, where one exists. |
| `summary` | string | Short one-line summary of the advisory. |
| `description` | string | Full Markdown description (summary, details, PoC, impact). |
| `severity` | string | GitHub severity: low, medium, high or critical. |
| `type` | string | Advisory type: reviewed, unreviewed or malware. |
| `htmlUrl` | string | Public GitHub advisory page URL. |
| `sourceCodeLocation` | string | null | Repository URL for the affected source code. |
| `repositoryAdvisoryUrl` | string | null | API URL of the originating repository advisory. |
| `cvssScore` | number | null | Best available CVSS base score (prefers v4, then v3). |
| `cvssVector` | string | null | Best available CVSS vector string. |
| `cvssV3Score` | number | null | CVSS v3 base score. |
| `cvssV3Vector` | string | null | CVSS v3 vector string. |
| `cvssV4Score` | number | null | CVSS v4 base score. |
| `cvssV4Vector` | string | null | CVSS v4 vector string. |
| `cwes` | array | null | CWE weaknesses: {id, name}. |
| `cweIds` | array | null | CWE IDs, for quick filtering. |
| `vulnerabilities` | array | null | Affected packages: {ecosystem, package, vulnerableVersionRange, firstPatchedVersion, vulnerableFunctions}. |
| `affectedPackages` | array | null | Affected packages as 'ecosystem:name' strings. |
| `ecosystems` | array | null | Unique ecosystems affected. |
| `identifiers` | array | All identifiers for the advisory: {type, value}. |
| `references` | array | null | Reference URLs (patches, commits, releases, writeups). |
| `credits` | array | Credited researchers: {login, profile, type}. |
| `epss` | object | null | EPSS exploit-probability data, when GitHub returns it. |
| `withdrawn` | boolean | True when the advisory has been withdrawn. |
| `publishedAt` | string | When the advisory was published (ISO 8601). |
| `updatedAt` | string | When the advisory was last updated (ISO 8601). |
| `withdrawnAt` | string | null | When the advisory was withdrawn, if applicable. |
| `githubReviewedAt` | string | null | When GitHub reviewed the advisory. |
| `nvdPublishedAt` | string | null | When the linked CVE was published on NVD. |
| `osv` | object | null | OSV.dev cross-reference add-on output (aliases, related advisories, affected ranges). |
| `aiPlainSummary` | string | null | AI remediation add-on: plain-language summary. |
| `aiAffectedWho` | string | null | AI remediation add-on: who or what is affected. |
| `aiRemediationSteps` | array | null | AI remediation add-on: concrete remediation steps. |
| `aiUrgency` | string | null | AI remediation add-on: urgency rating. |
| `observedAt` | string | When this record was scraped (ISO 8601). |
| `error` | string | null | Error message on a failed run row (never billed). |

### Example output record

See the hero record at the top of this page for a complete real advisory (vm2, GHSA-m5w8-4gq2-6f8x, CVSS 10 critical), including CWE list, affected package with patched version, OSV.dev cross-reference and AI remediation guidance.

### Use cases

- **Supply-chain security monitoring.** Track new advisories affecting the ecosystems and packages your organization depends on, and route critical ones into alerts.
- **Software composition analysis (SCA).** Enrich your own dependency inventory with GHSA and CVE data, CVSS scores, CWE classes and exact vulnerable and patched version ranges.
- **Vulnerability management and triage.** Pull the full advisory record with CVSS v3 and v4, CWE weaknesses and remediation guidance to prioritize patching.
- **Compliance and audit reporting.** Build a defensible, timestamped record of known vulnerabilities affecting your stack for SOC 2, ISO 27001 or FedRAMP evidence.
- **SBOM enrichment.** Match packages in your software bill of materials against affected version ranges and first patched versions to flag exploitable components.
- **Threat intelligence and OSINT.** Feed structured GHSA, CVE, CWE and OSV alias data into a SIEM, data warehouse or research pipeline.

### Run via API and CLI

Start a run with the Apify API:

```bash
curl -X POST "https://api.apify.com/v2/acts/scrapers_lat~github-security-advisories-scraper/runs?token=YOUR_TOKEN" \
  -H "content-type: application/json" \
  -d '{"ecosystem":"npm","severity":"critical","maxResults":100}'
```

Run with the Apify CLI:

```bash
apify call scrapers_lat/github-security-advisories-scraper \
  --input '{"ecosystem":"npm","severity":"critical","maxResults":100}'
```

### Fetch results

Download the dataset items in JSON, CSV or Excel:

```bash
curl "https://api.apify.com/v2/datasets/DATASET_ID/items?token=YOUR_TOKEN&format=json"
curl "https://api.apify.com/v2/datasets/DATASET_ID/items?token=YOUR_TOKEN&format=csv"
```

The run response includes the `defaultDatasetId` to use as `DATASET_ID`.

### Billing

This actor is billed pay-per-result. You are charged only for records actually produced, never on failure.

| Event | Price (USD) | When it is charged |
|-------|-------------|--------------------|
| `result` | $0.012 | Once per advisory record returned in the dataset. |
| `osv_cross_reference` | $0.008 | Once per advisory, only when the OSV.dev add-on is enabled and OSV returns a usable match. |
| `ai_remediation` | $0.012 | Once per advisory, only when the AI add-on is enabled and the model returns usable output. |

Notes:

- Free Apify plans are capped at 10 results per run. Both paid add-ons are disabled entirely for free plans.
- The two add-ons are opt-in and off by default. They are charged only when they genuinely produce data.
- Set a `maxTotalChargeUsd` spend limit on the run and the actor stops emitting billable results once the limit is reached.

### FAQ and troubleshooting

**Do I need a GitHub token?** No. The GitHub advisories database is a public API and this actor reads it without authentication.

**Why use a residential proxy?** GitHub rate-limits unauthenticated traffic per IP. The default residential US proxy avoids shared-IP throttling so large pulls complete reliably. The actor also backs off and retries on rate-limit responses.

**How current is the data?** It is live. Each run reads the advisories database at request time, sorted by published or updated date as you choose.

**What is the difference between reviewed, unreviewed and malware?** Reviewed advisories are curated by GitHub's security team. Unreviewed are auto-imported (mostly from NVD). Malware advisories flag malicious packages.

**Some fields are null.** Not every advisory has a CVE, a CVSS v4 vector, an NVD date or EPSS data. Genuinely absent values are returned as null rather than fabricated.

### More scrapers at scrapers.lat

Browse the full catalog of company registry, compliance, finance, government and developer data scrapers at [scrapers.lat](https://scrapers.lat).

# Actor input Schema

## `ecosystem` (type: `string`):

Only return advisories affecting this package ecosystem. Leave as Any for all ecosystems.

## `severity` (type: `string`):

Only return advisories with this severity level.

## `type` (type: `string`):

Reviewed = GitHub-reviewed advisories, unreviewed = auto-imported (mostly from NVD), malware = malicious package advisories.

## `cveId` (type: `string`):

Look up one exact CVE identifier, for example CVE-2024-3094.

## `ghsaId` (type: `string`):

Look up one exact GitHub advisory identifier, for example GHSA-rxjr-6c9q-h67x.

## `affectsPackage` (type: `string`):

Only return advisories affecting a specific package, for example lodash or django. Comma-separate for several packages.

## `publishedSince` (type: `string`):

Only include advisories published on or after this date (YYYY-MM-DD).

## `updatedSince` (type: `string`):

Only include advisories updated on or after this date (YYYY-MM-DD).

## `sort` (type: `string`):

Which timestamp to order results by.

## `direction` (type: `string`):

Sort direction.

## `maxResults` (type: `integer`):

Maximum number of advisories to collect. Free Apify plans are capped at 10 per run.

## `crossReferenceOsv` (type: `boolean`):

For each advisory, query OSV.dev for cross-source affected version ranges, aliases and related advisories for the same package(s). Charged only when OSV returns a usable match. Paid Apify plans only.

## `aiRemediation` (type: `boolean`):

Use AI to turn each advisory into a plain-language summary, who is affected, concrete remediation steps and an urgency rating. Charged only when the model returns usable output. Paid Apify plans only.

## `proxyConfiguration` (type: `object`):

Proxy used to reach GitHub. Residential US proxy is recommended to avoid shared-IP rate limits.

## Actor input object example

```json
{
  "ecosystem": "",
  "severity": "",
  "type": "reviewed",
  "sort": "published",
  "direction": "desc",
  "maxResults": 100,
  "crossReferenceOsv": false,
  "aiRemediation": false,
  "proxyConfiguration": {
    "useApifyProxy": true,
    "apifyProxyGroups": [
      "RESIDENTIAL"
    ],
    "apifyProxyCountry": "US"
  }
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxResults": 100
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrapers_lat/github-security-advisories-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxResults": 100 }

# Run the Actor and wait for it to finish
run = client.actor("scrapers_lat/github-security-advisories-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxResults": 100
}' |
apify call scrapers_lat/github-security-advisories-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scrapers_lat/github-security-advisories-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/KxH2XRm95bbyR4d7W/builds/9HM6bxQaAWhgXBdy6/openapi.json