Repository navigation
Adding GHSA from non ecosystem software #7268
Description
Hello,
i currently started working with the Github Adivsory Database to track vulnerabilities for packages which are not part of any Ecosystem. For example when using https://github.com/mcu-tools/mcuboot they track their vulnerabilities using Github. But the recorded GHSA for example GHSA-m59c-q9gq-rh2j are not listed in the Database.
While i understand that per Readme this behavior is intended I do not really understand the reason.
For my understanding GHSA are already checked by the maintainer of the project before they are listed on the Security Page of the respective project. So i do not understand the benefit of not listing those vulnerabilities to the Database.
Is there any chance that such vulnerabilities could be added to this database?
Best regards
Activity
JonathanLEvans commentedon Mar 31, 2026
We greatly appreciate your interest in improving the database, and we agree with the sentiment of your question. Maintainer-verified advisories like the ones for mcuboot are valuable.
However, practical considerations have stopped us from automatically including all repository-level advisories in the global GitHub Advisory Database. These range from the annoying (e.g., broadcasting test advisories) to the dangerous (e.g., amplifying advisories that point to malware). Because repository advisories can be created by any GitHub user without additional review, we need a curation step before they appear in the global database.
We are looking into alternative solutions, and we appreciate your patience and feedback on this.
aj-arena commentedon May 28, 2026
Also interested in the alternative solutions, would love a way to search for GHSAs that have a CVE even if they are not in the public database
For example: GHSA-gh3x-4x42-fvq8
But there is no https://github.com/advisories/GHSA-gh3x-4x42-fvq8 or GHSA-gh3x-4x42-fvq8 in github/advisory-database
munimv2 commentedon Oct 30, 2026
A status check and a data point, in case either helps.
Status, checked 2026-10-30 with public APIs. All three published repository advisories for mcu-tools/mcuboot (GHSA-m59c-q9gq-rh2j, GHSA-8hrv-4cp5-4rg3, GHSA-gcxh-546h-phg4) still return 404 from
GET https://api.github.com/advisories/<GHSA-ID>, and none of their CVEs (CVE-2024-32883, CVE-2021-3890, CVE-2021-3399) has an OSV.dev record. The RabbitMQ one @aj-arena mentioned (GHSA-gh3x-4x42-fvq8) is also 404 there. OSV does have CVE-2025-50200 with that GHSA as an alias, but only as a git commit range with no package, so package-based scanners won't match it.For anyone who wants to list these gaps for a given project, two unauthenticated calls are enough:
GET /repos/{owner}/{repo}/security-advisories?state=publishedlists the repository advisories, thenGET /advisories/{ghsa_id}returns 404 for each one that is not in the global database.How big is the gap? We measured this for self-hosted applications that publish their own repository advisories. Code, data and the frozen pre-registrations are here: https://github.com/munimtechnologies/advisory-import-census/blob/main/study/README.md
That suggests a repository-level identifier (#10118 is related) would be usable by scanners where it exists.
So the remaining gap looks narrow in kind: repository advisories from software with no package in a supported ecosystem, which is mcuboot's case. It doesn't look like a general review backlog. This is observational and limited to a few dozen hand-picked projects.
Disclosure: the analysis and this comment were made with AI agents working for MV2 of Munim, Inc. The figures come from the public code and data linked above.
MV2, Munim, Inc. (mv2@munimtech.com)