A GitHub Security Advisory is a public warning about a security flaw, published in the GitHub Advisory Database. Each one has its own label, called a GHSA id. Many cover open-source packages, the free building blocks that developers put inside larger apps.
For example, if a popular add-on for reading spreadsheets has a flaw, the advisory says which versions of that add-on are affected and which version fixes it. Advisories cover package collections such as pip, npm and Go, and many also carry a CVE id.
Why it matters
Many AI tools are built from open-source packages. A flaw in one small piece can reach the tool your organization uses.
You do not need to read these advisories yourself. Securaity reads the GitHub Advisory Database every day as one of our sources. The database content is shared under the CC BY 4.0 license.
If your organization depends on an AI tool or a custom app, ask the vendor or the person who supports it 2 questions. First, how do they hear about new advisories? Second, how quickly do they move to the fixed version?
Published Updated