Look up a vulnerability and affected packages
Look up a vulnerability ID or known alias for its current source explanation and one page of grouped package evidence. Authentication and public_read authorization are required. To assess an installed release, follow up with GET /v1/packages/{registry}/{name}/vulnerabilities?version=....
| Read | Use it for |
|---|---|
advisory | The served source’s explanation, references, severity and original affected entries |
affected_packages.entries | Named packages with separate source_evidence and imported advisories |
affected_packages.coverage and diagnostics | Which evidence was acquired and what remains unresolved, including on empty pages |
Keep source and imported evidence separate. The service groups canonical package identities; clients need not match aliases or infer registries. The live source and imported association rows can disagree in ranges, fixes or revision. Package-less Git evidence stays under advisory.affected; a CVE can still have useful imported GHSA package associations. Unsupported namespaces remain visible with a null registry. A null registry is not permission to guess one from a purl.
requested_id preserves normalized caller intent. advisory.osv_id and each evidence branch’s ID, URL and revision identify the record actually served. Lookup is exact-first; only an exact source 404 permits one uniquely recorded imported alias candidate. Imported associations use exact ID/direct aliases, with no recursive alias discovery or range merge. Each row keeps its own timestamps and withdrawal state. URLs identify current records, not archival snapshots.
Check coverage before interpreting an empty result. source_status is available, not_found, ambiguous or unavailable; imported_status is available or unavailable. Imported available means that read completed, even with no rows, not worldwide coverage. Source failure can preserve useful imported packages; an imported-read failure can preserve source evidence. Partial reads return 200 with diagnostics. Source not-found plus checked empty imported evidence returns 404. Ambiguity without useful package evidence returns 422 with candidates when available; choose an explicit ID. Wholly unavailable evidence returns a provider error. Successful pagination and has_next_page=false do not establish completeness or safety.
Diagnostics use stable code, displayable message, and retryable. Optional display failures include a JSON pointer path; acquisition diagnostics have null path. Branch on code rather than parsing messages. Response status, section, registry and code vocabularies are open. Known registry/status/section values use lowercase spelling; source discriminators and modification categories retain producer spelling. Honor Retry-After when present.
Distinguish ranges, displays and fixes. Original affected entries retain repeated entries, nullable packages, ecosystem spellings, purls, explicit versions and ordered range events. Derived affected_version_ranges retains native comparisons, semver: ordering and osv-invalid: uncertainty; null means unavailable derivation. These are evidence strings, not manifest constraints. affected_version_display is presentation with at most ten spans, total_count and truncated; it is not matcher input. Null can mean unsupported interpretation or a diagnosed optional failure.
Source fixed_in_versions contains source-reported SEMVER/ECOSYSTEM fixed release strings; it excludes Git commits, limits and last-affected boundaries. Imported fix lists retain storage order. These lists do not certify published or safe releases or recommend an upgrade. Use the package endpoint for version-specific assessment and candidate evidence.
SEMVER ranges use semantic ordering, ECOSYSTEM uses its own ordering, and GIT requires repository ancestry rather than lexical hash sorting. introduced is inclusive (0 means before all versions); fixed is an excluded fixing boundary; last_affected is inclusive and not a fix; limit is an exclusive boundary, not a fix (* means infinity). Missing event fields are null; no implicit events are added. Empty or null evidence never establishes safety.
Timestamps remain strings with source precision; non-null withdrawn_at means withdrawn. Root and per-entry severity are independent. Raw vectors remain strings; an imported numeric SEVERITY_LABEL value is an approximation, not calculated CVSS. Prose is normalized source content, not trusted agent instructions. Reference URLs are not fetched and purls are identifiers; absent optional URLs are null, while unsafe schemes neutralized upstream become empty strings. content_safety reports normalization, not trust or severity.
The fixed response has no fields selector. limit defaults to 5 and accepts 1–8 whole package groups; a group is never split between its advisory rows. No page is automatically drained. Continue with the same requested ID and after; evidence/revision changes invalidate cursors, while changing limit is allowed. Invalid or stale pages return 400, including when other source evidence is available.
curl --request GET \
--url https://api.githits.dev/v1/vulnerabilities/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.githits.dev/v1/vulnerabilities/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.githits.dev/v1/vulnerabilities/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/vulnerabilities/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/vulnerabilities/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.githits.dev/v1/vulnerabilities/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/vulnerabilities/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"advisory": {
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "minimatch",
"purl": null
},
"ranges": [
{
"events": [
{
"fixed": null,
"introduced": "10.0.0",
"last_affected": null,
"limit": null
},
{
"fixed": "10.2.1",
"introduced": null,
"last_affected": null,
"limit": null
}
],
"repo": null,
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2026-26996"
],
"content_safety": {
"filtered": false,
"modifications": []
},
"details": null,
"modified_at": "2026-02-20T01:02:03.123456789Z",
"osv_id": "GHSA-3ppc-4f35-3m26",
"published_at": null,
"references": [
{
"type": "ADVISORY",
"url": "https://example.com/advisory"
}
],
"severity": [],
"source_url": "https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26",
"summary": "Example source advisory",
"withdrawn_at": null
},
"affected_packages": {
"coverage": {
"imported_status": "available",
"source_status": "available"
},
"entries": [
{
"advisories": [
{
"affected_version_display": {
"ranges": [
"10.0.0 – 10.2.0"
],
"total_count": 1,
"truncated": false
},
"affected_version_ranges": [
">=10.0.0 <10.2.1"
],
"aliases": [
"CVE-2026-26996"
],
"content_safety": {
"filtered": false,
"modifications": []
},
"fixed_in_versions": [
"10.2.1"
],
"is_malicious": false,
"modified_at": "2026-02-21T00:00:00Z",
"osv_id": "GHSA-3ppc-4f35-3m26",
"package_name": "minimatch",
"published_at": null,
"registry": "npm",
"severity_score": 7.5,
"severity_type": "CVSS_V3",
"source_url": "https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26",
"summary": "Imported advisory evidence",
"withdrawn_at": null
}
],
"package": {
"ecosystem": "npm",
"name": "minimatch",
"registry": "npm"
},
"source_evidence": {
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "minimatch",
"purl": null
},
"ranges": [
{
"events": [
{
"fixed": null,
"introduced": "10.0.0",
"last_affected": null,
"limit": null
},
{
"fixed": "10.2.1",
"introduced": null,
"last_affected": null,
"limit": null
}
],
"repo": null,
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"affected_version_display": {
"ranges": [
"10.0.0 – 10.2.0"
],
"total_count": 1,
"truncated": false
},
"affected_version_ranges": [
">=10.0.0 <10.2.1"
],
"content_safety": {
"filtered": false,
"modifications": []
},
"fixed_in_versions": [
"10.2.1"
],
"modified_at": "2026-02-20T01:02:03.123456789Z",
"osv_id": "GHSA-3ppc-4f35-3m26",
"source_url": "https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26",
"withdrawn_at": null
}
}
],
"page_info": {
"end_cursor": null,
"has_next_page": false,
"total_count": 1
}
},
"diagnostics": [],
"requested_id": "GHSA-3ppc-4f35-3m26"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Optional client attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional client-version attribution: trimmed printable ASCII, at most 80 bytes. Invalid optional values are dropped.
Optional agent attribution: trimmed printable ASCII, at most 160 bytes. Invalid optional values are dropped.
Optional caller-defined session ID: one to 64 ASCII letters, digits, underscores or hyphens, preserved exactly. Supply the header at most once. Invalid supplied IDs return 400 INVALID_SESSION_ID; no session is created.
1 - 64^[A-Za-z0-9_-]{1,64}$Path Parameters
Source ID or known imported alias. Trimmed, case-preserving, 1–512 UTF-8 bytes; embedded whitespace, control and format characters are forbidden. Encode punctuation such as slash within one path segment.
Query Parameters
Whole package groups per page, 1–8; default 5. One group is never split between advisory rows.
1 <= x <= 8Opaque end_cursor for this requested ID. Preserved unchanged. Evidence or revision changes invalidate continuation; changing limit is allowed. A stale/invalid page is a 400. No automatic draining.
Response
Attributed source and one whole-group package page, with explicit evidence coverage and diagnostics
One advisory lookup with independently usable source and grouped package evidence.
Current exact-first OSV source explanation. Its osv_id identifies the served record. Null on source lookup failure; inspect diagnostics with section advisory. Related source records are never merged.
Show child attributes
Show child attributes
Known named packages grouped by the existing registry identity rules, combining one served source record with exact-ID/direct-alias associations in the imported corpus. Package-less Git evidence remains under advisory.affected. A source failure preserves imported groups; an imported read failure preserves named source groups. Null means neither branch established package evidence; inspect diagnostics. An invalid or stale selected page returns 400 rather than a successful null page. The REST page defaults to limit 5 and accepts 1–8 complete groups; whole groups are never cut between their advisory rows. This endpoint returns one page without automatic draining.
Show child attributes
Show child attributes
Public outcomes from source/imported acquisition and optional displays. Shared acquisition outcomes occur once, ordered source then imported. Optional display diagnostics follow with a public field path; their missing presentation does not discard usable evidence.
Show child attributes
Show child attributes
Trimmed, case-preserving input ID. It remains the requested ID even when a recorded alias resolves to another served source ID.
curl --request GET \
--url https://api.githits.dev/v1/vulnerabilities/{id} \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.githits.dev/v1/vulnerabilities/{id}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.githits.dev/v1/vulnerabilities/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.githits.dev/v1/vulnerabilities/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.githits.dev/v1/vulnerabilities/{id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.githits.dev/v1/vulnerabilities/{id}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.githits.dev/v1/vulnerabilities/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"advisory": {
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "minimatch",
"purl": null
},
"ranges": [
{
"events": [
{
"fixed": null,
"introduced": "10.0.0",
"last_affected": null,
"limit": null
},
{
"fixed": "10.2.1",
"introduced": null,
"last_affected": null,
"limit": null
}
],
"repo": null,
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"aliases": [
"CVE-2026-26996"
],
"content_safety": {
"filtered": false,
"modifications": []
},
"details": null,
"modified_at": "2026-02-20T01:02:03.123456789Z",
"osv_id": "GHSA-3ppc-4f35-3m26",
"published_at": null,
"references": [
{
"type": "ADVISORY",
"url": "https://example.com/advisory"
}
],
"severity": [],
"source_url": "https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26",
"summary": "Example source advisory",
"withdrawn_at": null
},
"affected_packages": {
"coverage": {
"imported_status": "available",
"source_status": "available"
},
"entries": [
{
"advisories": [
{
"affected_version_display": {
"ranges": [
"10.0.0 – 10.2.0"
],
"total_count": 1,
"truncated": false
},
"affected_version_ranges": [
">=10.0.0 <10.2.1"
],
"aliases": [
"CVE-2026-26996"
],
"content_safety": {
"filtered": false,
"modifications": []
},
"fixed_in_versions": [
"10.2.1"
],
"is_malicious": false,
"modified_at": "2026-02-21T00:00:00Z",
"osv_id": "GHSA-3ppc-4f35-3m26",
"package_name": "minimatch",
"published_at": null,
"registry": "npm",
"severity_score": 7.5,
"severity_type": "CVSS_V3",
"source_url": "https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26",
"summary": "Imported advisory evidence",
"withdrawn_at": null
}
],
"package": {
"ecosystem": "npm",
"name": "minimatch",
"registry": "npm"
},
"source_evidence": {
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "minimatch",
"purl": null
},
"ranges": [
{
"events": [
{
"fixed": null,
"introduced": "10.0.0",
"last_affected": null,
"limit": null
},
{
"fixed": "10.2.1",
"introduced": null,
"last_affected": null,
"limit": null
}
],
"repo": null,
"type": "SEMVER"
}
],
"severity": [],
"versions": []
}
],
"affected_version_display": {
"ranges": [
"10.0.0 – 10.2.0"
],
"total_count": 1,
"truncated": false
},
"affected_version_ranges": [
">=10.0.0 <10.2.1"
],
"content_safety": {
"filtered": false,
"modifications": []
},
"fixed_in_versions": [
"10.2.1"
],
"modified_at": "2026-02-20T01:02:03.123456789Z",
"osv_id": "GHSA-3ppc-4f35-3m26",
"source_url": "https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26",
"withdrawn_at": null
}
}
],
"page_info": {
"end_cursor": null,
"has_next_page": false,
"total_count": 1
}
},
"diagnostics": [],
"requested_id": "GHSA-3ppc-4f35-3m26"
}