Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,600
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

141 advisories

Loading
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors Moderate
CVE-2026-112944 was published for launch-editor (npm) Oct 20, 2026
0xazanul Credited to 0xazanul and bluwy bluwy bluwy
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) High
CVE-2026-102827 was published for simple-git (npm) Oct 5, 2026
anir0y Credited to anir0y, bilguunbicktivism, cruzryan, the-vibe-dev, D7EAD, dellalibera, gdegrange, b1ue0ceanRun, Leeziao, internetteletubbie, and arundr0id bilguunbicktivism bilguunbicktivism
cruzryan cruzryan the-vibe-dev the-vibe-dev D7EAD D7EAD dellalibera dellalibera gdegrange gdegrange b1ue0ceanRun b1ue0ceanRun Leeziao Leeziao internetteletubbie internetteletubbie arundr0id arundr0id
Nx: OS command injection via git revisions and remote refs High
GHSA-w2vw-w76x-qr89 was published for nx (npm) Oct 5, 2026
arkmarta Credited to arkmarta
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs Moderate
CVE-2026-102904 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle Moderate
GHSA-whh4-5q6c-9v3x was published for gitpython (pip) Sep 30, 2026
kokomaru167 Credited to kokomaru167
CliInvoke: Argument Injection in Extensibility Runner Factory High
CVE-2026-100369 was published for AlastairLundy.CliInvoke (NuGet) Sep 25, 2026
Duplicate Advisory: GitPython 3.1.59: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle High
CVE-2026-87818 was published for gitpython (pip) Sep 9, 2026 • withdrawn
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251) Moderate
CVE-2026-78679 was published for GitPython (pip) Sep 8, 2026
manus-use Credited to manus-use
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() Moderate
CVE-2026-78678 was published for GitPython (pip) Sep 8, 2026
manus-use Credited to manus-use
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE Critical
CVE-2026-78676 was published for GitPython (pip) Sep 8, 2026
Pig-Tail Credited to Pig-Tail
Semaphore U: OS Command Injection Critical
CVE-2026-73294 was published for github.com/semaphoreui/semaphore (Go) Sep 8, 2026
faran1512 Credited to faran1512
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval High
CVE-2026-75912 was published for codewhale (npm) Sep 4, 2026
0xEr3n Credited to 0xEr3n
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval High
CVE-2026-75913 was published for codewhale (npm) Sep 4, 2026
0xEr3n Credited to 0xEr3n
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) Critical
CVE-2026-79675 was published for nltk (pip) Sep 1, 2026
arpitjain099 Credited to arpitjain099
PowSyBl Core has Command Injection in LocalCommandExecutor-s High
CVE-2026-55673 was published for com.powsybl:powsybl-computation-local (Maven) Aug 28, 2026
Freakston Credited to Freakston
Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) Critical
GHSA-3h2g-j4wp-7qqq was published for nltk (pip) Aug 25, 2026 • withdrawn
Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() High
GHSA-89ff-m8wv-p99r was published for gitpython (pip) Aug 25, 2026 • withdrawn
Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE Critical
GHSA-9557-234j-7rv9 was published for GitPython (pip) Aug 25, 2026 • withdrawn
Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks High
GHSA-298h-jpq4-m665 was published for GitPython (pip) Aug 19, 2026 • withdrawn
Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite High
GHSA-7jx3-jqcp-hhgc was published for gitpython (pip) Aug 19, 2026 • withdrawn
Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution High
GHSA-wv46-xpj8-pw53 was published for gitpython (pip) Aug 19, 2026 • withdrawn
uniget CLI has an EDITOR Command Injection Moderate
CVE-2026-55061 was published for gitlab.com/uniget-org/cli (Go) Aug 17, 2026
0x5t4l1n Credited to 0x5t4l1n, Chris35t, and harriiinnii Chris35t Chris35t
harriiinnii harriiinnii
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution High
CVE-2026-76220 was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) High
GHSA-jm78-9fvv-mhgr was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database