Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
4,893
Erlang
38
GitHub Actions
38
Go
2,552
Maven
5,000+
npm
4,224
NuGet
746
pip
3,999
Pub
12
RubyGems
953
Rust
1,041
Swift
45
Unreviewed advisories
All unreviewed
5,000+

212 advisories

Loading
Prototype Pollution in pez High
GHSA-g64q-3vg8-8f93 was published for pez (npm) Sep 3, 2020
amita-seal
Credited to amita-seal
messageformat prototype pollution vulnerability High
CVE-2025-57353 was published for @messageformat/runtime (npm) Sep 24, 2025
Prototype Pollution in @hapi/subtext High
GHSA-g9cg-h3jm-cwrc was published for @hapi/pez (npm) Sep 3, 2020
amita-seal
Credited to amita-seal
dref is vulnerable to prototype pollution High
CVE-2025-26278 was published for dref (npm) Sep 25, 2025
csvjson vulnerable to prototype injection High
CVE-2025-57318 was published for csvjson (npm) Sep 24, 2025
mpregular vulnerable to prototype pollution High
CVE-2025-57323 was published for mpregular (npm) Sep 24, 2025
Prototype Pollution in sheetJS High
CVE-2023-30533 was published for xlsx (npm) Apr 24, 2023
pmartinat stof
kb-med
Credited to pmartinat, stof, and kb-med
Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful... High Unreviewed
CVE-2025-58280 was published Sep 5, 2025
devalue prototype pollution vulnerability High
CVE-2025-57820 was published for devalue (npm) Aug 26, 2025
apyatko Rich-Harris
dominikg
Credited to apyatko, Rich-Harris, and dominikg
Prototype Pollution in jquery-deparam High
CVE-2021-20087 was published for jquery-deparam (npm) May 24, 2021
Prototype Pollution in lodash High
CVE-2020-8203 was published for lodash (RubyGems) Jul 15, 2020
mitchell-codecov jkmartindale
bengry greengeko tompazourek G-Rath
Credited to mitchell-codecov, jkmartindale, bengry, greengeko, tompazourek, and G-Rath
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE High
CVE-2025-55164 was published for content-security-policy-parser (npm) Aug 12, 2025
pnappa EvanHahn
Credited to pnappa and EvanHahn
js-toml Prototype Pollution Vulnerability High
CVE-2025-54803 was published for js-toml (npm) Aug 4, 2025
siunam321
Credited to siunam321
@stryker-mutator/util vulnerable to Prototype Pollution High
CVE-2024-57085 was published for @stryker-mutator/util (npm) Feb 6, 2025
saip-loginsoft saip007
Credited to saip-loginsoft and saip007
@nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE High
CVE-2025-34146 was published for @nyariv/sandboxjs (npm) Jul 31, 2025
JLLeitschuh
Credited to JLLeitschuh
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) High
CVE-2025-8101 was published for linkifyjs (npm) Jul 26, 2025
saip007
Credited to saip007
Synchrony deobfuscator prototype pollution vulnerability leading to arbitrary code execution High
CVE-2023-45811 was published for deobfuscator (npm) Oct 18, 2023
SteakEnthusiast
Credited to SteakEnthusiast
Prototype pollution in min-dash High
CVE-2021-23460 was published for min-dash (Maven) Feb 1, 2022
cristianstaicu
Credited to cristianstaicu
Duplicate Advisory: Prototype Pollution in min-dash High
GHSA-fm93-fhh2-cg2c was published for min-dash (npm) Jan 27, 2022 • withdrawn
Duplicate Advisory: Prototype Pollution in klona High
GHSA-4r97-78gf-q24v was published for klona (npm) Sep 4, 2020 • withdrawn
Prototype Pollution in hoek High
CVE-2018-3728 was published for hoek (npm) Apr 26, 2018
decsecre583
Credited to decsecre583
hoek subject to prototype pollution via the clone function. High
CVE-2020-36604 was published for @hapi/hoek (npm) Sep 25, 2022
levpachmanov
Credited to levpachmanov
qs vulnerable to Prototype Pollution High
CVE-2022-24999 was published for qs (npm) Nov 27, 2022
dougwilson
Credited to dougwilson
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype... High Unreviewed
CVE-2022-1802 was published Dec 22, 2022
An attacker could have sent a message to the parent process where the contents were used to... High Unreviewed
CVE-2022-1529 was published Dec 22, 2022
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database