Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,608
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

60 advisories

Loading
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection Low
CVE-2026-45803 was published for github.com/cli/cli (Go) May 19, 2026
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from... High Unreviewed
CVE-2026-49147 was published Jul 8, 2026
Shescape: Shell injection via unescaped parentheses on Windows with CMD Critical
CVE-2026-73414 was published for shescape (npm) Jul 24, 2026
oran-s Credited to oran-s and ericcornelissen ericcornelissen ericcornelissen
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data Moderate
CVE-2026-73506 was published for github.com/jandedobbeleer/oh-my-posh (Go) Jul 24, 2026
ihopenre-eng Credited to ihopenre-eng
npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence... Moderate Unreviewed
CVE-2026-73035 was published Aug 10, 2026
Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's... Moderate Unreviewed
CVE-2026-73036 was published Aug 11, 2026
powerlevel10k fails to neutralize control characters in the package.json version field when... Moderate Unreviewed
CVE-2026-75483 was published Aug 17, 2026
broot renders each file and directory name in its interactive tree view exactly as read from the... Low Unreviewed
CVE-2026-72847 was published Aug 20, 2026
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI Moderate
CVE-2026-54162 was published for github.com/alexandre-daubois/ember (Go) Aug 20, 2026
alexandre-daubois Credited to alexandre-daubois
pickem vulnerable to terminal escape-sequence injection via unsanitized item text High
GHSA-8qx3-8gm5-9cj2 was published for pickem (npm) Aug 25, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database