GitHub Security Advisories (GHSA) by Ecosystem

Pull recent GitHub Security Advisories — the curated CVE-plus ecosystem mapping behind github.com/advisories — as a paginated, date-filtered dataset. One row per advisory, with affected packages and fix versions in structured form.

What you get

{
  "ghsaId":       "GHSA-rrqh-7r3p-mvf9",
  "summary":      "Cross-site scripting in react-markdown when using…",
  "description":  "react-markdown < 9.0.1 renders untrusted user…",
  "severity":     "HIGH",
  "classification": "GENERAL",
  "publishedAt":  "2026-05-30T20:14:00Z",
  "updatedAt":    "2026-05-31T11:02:00Z",
  "withdrawnAt":  null,
  "url":          "https://github.com/advisories/GHSA-rrqh-7r3p-mvf9",
  "cves":         ["CVE-2026-12345"],
  "references":   ["https://nvd.nist.gov/vuln/detail/CVE-2026-12345",
                   "https://github.com/remarkjs/react-markdown/security/…"],
  "cwes": [
    {"cweId": "CWE-79", "name": "Improper Neutralization of Input…"}
  ],
  "affected": [
    {
      "ecosystem":            "NPM",
      "package":              "react-markdown",
      "vulnerableRange":      "< 9.0.1",
      "firstPatchedVersion":  "9.0.1"
    }
  ],
  "queryEcosystem": "NPM"
}

How to use

Input.

{
  "ecosystems":       ["NPM", "PIP", "MAVEN"],
  "sinceDays":        7,
  "maxPerEcosystem":  500,
  "githubToken":      ""
}

ecosystems — one of NPM, PIP, MAVEN, COMPOSER, NUGET, RUBYGEMS, RUST, GO, PUB, ERLANG, ACTIONS, SWIFT, or ALL to skip the ecosystem filter.

githubToken — optional. Without it, GitHub limits anonymous GraphQL to 60 req/h (fine for one ecosystem with maxPerEcosystem ≤ 500). With a token: 5 000 req/h. A classic PAT with no scopes works — the securityAdvisories endpoint is public.

Why this matters

github.com/advisories is the canonical curated CVE→ecosystem mapping used by Dependabot, Renovate, Snyk's free tier, and most other supply- chain tools. The GraphQL endpoint exposes the same data behind a tidy schema; this actor packages it into a daily feed you can ship into JIRA, Slack, or a custom dashboard.

Pricing

PAY_PER_EVENT · $0.002 per advisory_extracted · 500 advisories = $1.

Buyer

• AppSec / Product Security teams.
• DevOps building custom dep-pin policies (Renovate / Dependabot consumers wanting their own categorization).
• Supply-chain auditors snapshotting weekly delta.
• Insurance / compliance dashboards.

Source

GitHub GraphQL securityAdvisories — same source as gh advisories CLI and the web UI. Filter: publishedSince for the date window; ecosystem enum for the ecosystem filter; per-advisory vulnerabilities filtered to the same ecosystem so the affected list is clean.