Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

70 advisories

Loading
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation High
CVE-2026-105801 was published for openapi-python-client (pip) Oct 6, 2026
Gal3m Credited to Gal3m, iabdullah215, and 0xsharz iabdullah215 iabdullah215
0xsharz 0xsharz
In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to be embedded in... High Unreviewed
CVE-2026-104026 was published Oct 2, 2026
colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data... High Unreviewed
CVE-2026-103431 was published Oct 1, 2026
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter Low
CVE-2026-102601 was published for league/flysystem (Composer) Sep 29, 2026
iaohkut Credited to iaohkut and Unifex Unifex Unifex
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest... Moderate Unreviewed
CVE-2026-100867 was published Sep 27, 2026
onefetch through 2.28.1 writes repository information field values to the terminal without... Moderate Unreviewed
CVE-2026-100866 was published Sep 27, 2026
Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint Moderate
CVE-2026-93421 was published for mesop (pip) Sep 23, 2026
5H4D0WBY73 Credited to 5H4D0WBY73
Affected versions of MISP’s interactive CLI shell implement access control independently from the... High Unreviewed
CVE-2026-90895 was published Sep 14, 2026
procs through 0.14.12 fails to sanitize escape sequences in process command lines before... Low Unreviewed
CVE-2026-90773 was published Sep 13, 2026
OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS... High Unreviewed
CVE-2026-19591 was published Sep 1, 2026
pickem vulnerable to terminal escape-sequence injection via unsanitized item text High
GHSA-8qx3-8gm5-9cj2 was published for pickem (npm) Aug 25, 2026
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI Moderate
CVE-2026-54162 was published for github.com/alexandre-daubois/ember (Go) Aug 20, 2026
alexandre-daubois Credited to alexandre-daubois
broot renders each file and directory name in its interactive tree view exactly as read from the... Low Unreviewed
CVE-2026-72847 was published Aug 20, 2026
powerlevel10k fails to neutralize control characters in the package.json version field when... Moderate Unreviewed
CVE-2026-75483 was published Aug 17, 2026
Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's... Moderate Unreviewed
CVE-2026-73036 was published Aug 11, 2026
npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence... Moderate Unreviewed
CVE-2026-73035 was published Aug 10, 2026
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data Moderate
CVE-2026-73506 was published for github.com/jandedobbeleer/oh-my-posh (Go) Jul 24, 2026
ihopenre-eng Credited to ihopenre-eng
Shescape: Shell injection via unescaped parentheses on Windows with CMD Critical
CVE-2026-73414 was published for shescape (npm) Jul 24, 2026
oran-s Credited to oran-s and ericcornelissen ericcornelissen ericcornelissen
App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from... High Unreviewed
CVE-2026-49147 was published Jul 8, 2026
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection Low
CVE-2026-45803 was published for github.com/cli/cli (Go) May 19, 2026
Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape... Low Unreviewed
CVE-2026-47090 was published May 18, 2026
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that... Moderate Unreviewed
CVE-2026-41526 was published Apr 28, 2026
http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for... Low Unreviewed
CVE-2026-6019 was published Apr 22, 2026
Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode Moderate
CVE-2026-25996 was published for github.com/inspektor-gadget/inspektor-gadget (Go) Apr 22, 2026
suidpit Credited to suidpit, ndaprela, eiffel-fl, and flyth ndaprela ndaprela
eiffel-fl eiffel-fl flyth flyth
MuPDF mutool does not sanitize PDF metadata fields before writing them to terminal output,... Moderate Unreviewed
CVE-2026-40505 was published Apr 16, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database