What information is included in a GitHub Security Advisory?
Select an answer to reveal the explanation.
Short Explanation and Infographic
A GitHub Security Advisory is a complete vulnerability dossier — affected package, which versions are vulnerable, which version fixes it, the CVSS severity score, a description of the flaw, and credit to the researcher who found it. Everything you need to assess and remediate.
Full explanation below image
Full Explanation
GitHub Security Advisories (both from the GitHub Advisory Database and repository-level advisories) contain structured vulnerability information including: (1) Affected ecosystem and package name (npm, pip, Maven, etc.). (2) Vulnerable version range (e.g., >= 1.0.0, < 1.5.3). (3) Patched version (the version that fixes the issue). (4) Severity rating using CVSS (Common Vulnerability Scoring System) score and vector. (5) Description of the vulnerability, including type (XSS, SQL injection, etc.). (6) CVE identifier when assigned. (7) References (related issues, PRs, external resources). (8) Credits section acknowledging reporters. (9) CWE identifiers for vulnerability categorization. They do NOT include exploit code or internal GitHub analysis.