Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,455 advisories

Loading
Duplicate Advisory: vm2 contains a sandbox escape vulnerability Critical
GHSA-9hxx-m5g2-2q3h was published for vm2 (npm) Sep 18, 2026 • withdrawn
portyu9 Credited to portyu9
Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process Critical
GHSA-28q4-xrqh-9479 was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package Critical
GHSA-6fvh-fgmg-3x7v was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts Critical
GHSA-hc6q-4vvg-jf79 was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass Critical
GHSA-538q-xxpg-6h4r was published for vm2 (npm) Sep 17, 2026 • withdrawn
portyu9 Credited to portyu9
Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process Critical
GHSA-mgj2-jqjq-q8gg was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix Critical
GHSA-5v7w-95g5-pj6q was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: Sandbox Escape (NodeVM) Critical
GHSA-gg6f-mhqm-f7gp was published for vm2 (npm) Sep 17, 2026 • withdrawn
portyu9 Credited to portyu9
Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store Critical
GHSA-xq74-c7jx-8w5j was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape Critical
GHSA-wqg3-r97q-73xm was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool Critical
GHSA-x5qg-8pq6-39h6 was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE Critical
GHSA-29x6-9qh5-83gg was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection Critical
GHSA-3f84-vwv5-r42g was published for vm2 (npm) Sep 17, 2026 • withdrawn
portyu9 Credited to portyu9
Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite` Critical
GHSA-m7cq-7f2q-f9fh was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine Critical
GHSA-6jgm-4w45-vh8j was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector Critical
GHSA-hwr5-cm8v-c76q was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE Critical
GHSA-9fxx-mv6c-j5xp was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent Critical
GHSA-5843-9mh5-hhgw was published for vm2 (npm) Sep 17, 2026 • withdrawn
Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit Critical
GHSA-4xmw-hh9q-4q7c was published for vm2 (npm) Sep 17, 2026 • withdrawn
Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification Critical
CVE-2026-63472 was published for @vendure/core (npm) Sep 17, 2026
squinard1478 Credited to squinard1478
@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover Critical
CVE-2026-61560 was published for @zereight/mcp-gitlab (npm) Sep 16, 2026
gil-maman-p Credited to gil-maman-p and hodaya-prz hodaya-prz hodaya-prz
@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery Critical
CVE-2026-61559 was published for @zereight/mcp-gitlab (npm) Sep 15, 2026
avishaigonen-pluto Credited to avishaigonen-pluto and yotampe-pluto yotampe-pluto yotampe-pluto
@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport Critical
CVE-2026-61568 was published for @zereight/mcp-gitlab (npm) Sep 15, 2026
avishaigonen-pluto Credited to avishaigonen-pluto and yotampe-pluto yotampe-pluto yotampe-pluto
yayson: Prototype pollution in Store/LegacyStore deserialization Critical
CVE-2026-61534 was published for yayson (npm) Sep 11, 2026
hackchang Credited to hackchang and jede jede jede
OmniRoute ACP Custom-Agent Remote Code Execution (RCE) Critical
CVE-2026-88062 was published for omniroute (npm) Sep 10, 2026
c111mb3r Credited to c111mb3r
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database