# GitHub Security Advisories Scraper (`maximedupre/github-security-advisories-scraper`) Actor

GitHub Security Advisories Scraper for GHSA feeds, CVE lookup, package lookup, severity filters, CVSS, EPSS, CWE, fixed versions, references, credits, and advisory timestamps.

- **URL**: https://apify.com/maximedupre/github-security-advisories-scraper.md
- **Developed by:** [Maxime Dupré](https://apify.com/maximedupre) (community)
- **Categories:** Developer tools, Automation
- **Stats:** 3 total users, 1 monthly users, 93.1% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.02 / 1,000 advisories

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

### 🔎 GitHub Security Advisories scraper for GHSA and CVE exports

GitHub Security Advisories Scraper collects public GitHub Security Advisory records and saves one clean dataset row per advisory. Use it for AppSec, DevSecOps, SBOM enrichment, vulnerability monitoring, dashboards, and scheduled advisory exports with source-backed GHSA, CVE, severity, CVSS, EPSS, CWE, affected package, fixed version, reference, credit, and timestamp data.

- Run a [GitHub Security Advisories scraper](https://apify.com/maximedupre/github-security-advisories-scraper/examples/github-security-advisories-scraper) to export recent public advisory records for vulnerability review.
- Use [GitHub advisory CVE lookup](https://apify.com/maximedupre/github-security-advisories-scraper/examples/github-advisory-cve-lookup) when you need normalized rows for known CVE identifiers.
- Use [GHSA advisory lookup](https://apify.com/maximedupre/github-security-advisories-scraper/examples/ghsa-advisory-lookup) to collect exact GitHub Security Advisory records for automation.
- Build a [GitHub vulnerability feed](https://apify.com/maximedupre/github-security-advisories-scraper/examples/github-vulnerability-feed) for scheduled monitoring of newly published or updated advisories.
- Create [package vulnerability exports](https://apify.com/maximedupre/github-security-advisories-scraper/examples/package-vulnerability-exports) for affected ecosystems, packages, vulnerable ranges, and patched versions.
- Prepare [SBOM vulnerability enrichment](https://apify.com/maximedupre/github-security-advisories-scraper/examples/sbom-vulnerability-enrichment) data with CWE, CVSS, EPSS, references, and affected package details.
- [Download GitHub Security Advisories data](https://apify.com/maximedupre/github-security-advisories-scraper/examples/download-github-security-advisories-data) from Apify datasets for spreadsheets, BI tools, or internal APIs.

#### 📦 Data you can extract

Each dataset row is one successfully scraped GitHub Security Advisory. Fields can include:

- `ghsaId`, `cveIds`, `title`, `classification`, and `severity`
- `description`, public advisory `url`, and source `apiUrl`
- `publishedAt`, `updatedAt`, `reviewedAt`, `nvdPublishedAt`, `withdrawnAt`, and `scrapedAt`
- `cvss` score and vector
- `epss` percentage and percentile when GitHub provides them
- `cwes` with CWE IDs and names
- `affectedPackages` with ecosystem, package name, vulnerable version range, patched versions, vulnerable functions, repository URL, and source-code locations
- `references`, `credits`, and `repositoryAdvisoryUrls`

Missing source values are returned as `null` or empty arrays. The Actor does not invent CVE, CVSS, EPSS, CWE, package, patch, credit, or timestamp facts.

#### 🚀 How to run it

1. Open the Actor input.
2. Choose **Advisory feed** for recent or filtered GHSA exports, or choose **Exact advisory lookup** for known GHSA or CVE identifiers.
3. Add optional filters for classification, severity, package ecosystem, affected package, CWE, publication dates, update dates, withdrawn status, ordering, or maximum advisory results.
4. Add a GitHub token only when you want higher limits for larger public GitHub API pulls.
5. Run the Actor and open the dataset.

Normal public runs do not require a GitHub account or token.

#### ⚙️ Input options

| Field | What it does |
| --- | --- |
| `target` | Chooses whether to collect a filtered advisory feed or look up exact GHSA or CVE identifiers. |
| `advisoryIds` | Looks up one or more exact GHSA or CVE identifiers when Target is Exact advisory lookup. |
| `classification` | Filters feed results by GitHub advisory classification: any, general, or malware. |
| `severity` | Filters feed results by source-native severity. |
| `ecosystem` | Filters feed results by package ecosystem when GitHub exposes the ecosystem filter. |
| `packageName` | Filters feed results to advisories for one affected package name. |
| `cwe` | Filters feed results by a CWE identifier such as `CWE-79`. |
| `publishedFrom`, `publishedTo` | Filters by advisory publication date. |
| `updatedFrom`, `updatedTo` | Filters by advisory update date. |
| `includeWithdrawn` | Includes advisories GitHub marks as withdrawn in feed results. |
| `orderBy` | Orders feed results before the result limit is applied. |
| `maxResults` | Caps the number of advisory records returned. |
| `githubToken` | Optional token for larger public GitHub API pulls. |

Example feed input:

```json
{
  "target": "advisoryFeed",
  "severity": "high",
  "ecosystem": "npm",
  "publishedFrom": "2026-01-01",
  "orderBy": "publishedDesc",
  "maxResults": 25
}
```

Exact advisory lookup:

```json
{
  "target": "exactAdvisoryLookup",
  "advisoryIds": ["GHSA-jfh8-c2jp-5v3q", "CVE-2021-44228"],
  "maxResults": 5
}
```

#### 📄 Output example

```json
{
  "ghsaId": "GHSA-jfh8-c2jp-5v3q",
  "cveIds": ["CVE-2021-44228"],
  "title": "Remote code injection in Log4j",
  "classification": "general",
  "severity": "critical",
  "description": "Apache Log4j2 versions 2.0-beta9 through 2.15.0 are vulnerable to remote code execution.",
  "url": "https://github.com/advisories/GHSA-jfh8-c2jp-5v3q",
  "apiUrl": "https://api.github.com/advisories/GHSA-jfh8-c2jp-5v3q",
  "publishedAt": "2021-12-10T00:00:35Z",
  "updatedAt": "2025-01-14T08:36:01Z",
  "reviewedAt": "2021-12-10T00:00:00Z",
  "nvdPublishedAt": "2021-12-10T10:15:09Z",
  "withdrawnAt": null,
  "cvss": {
    "score": 10,
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
  },
  "epss": {
    "percentage": 0.94321,
    "percentile": 0.99874
  },
  "cwes": [
    {
      "id": "CWE-20",
      "name": "Improper Input Validation"
    }
  ],
  "affectedPackages": [
    {
      "ecosystem": "maven",
      "name": "org.apache.logging.log4j:log4j-core",
      "vulnerableVersionRange": ">= 2.0-beta9, < 2.3.2",
      "patchedVersions": ["2.3.2"],
      "vulnerableFunctions": [],
      "repositoryUrl": "https://github.com/apache/logging-log4j2",
      "sourceCodeLocations": []
    }
  ],
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
    }
  ],
  "credits": [
    {
      "name": "chenzhaojun",
      "type": "reporter"
    }
  ],
  "repositoryAdvisoryUrls": [
    "https://github.com/apache/logging-log4j2/security/advisories/GHSA-jfh8-c2jp-5v3q"
  ],
  "scrapedAt": "2026-07-07T12:00:00.000Z"
}
```

#### 💳 Pricing

This actor uses pay-per-event pricing. You are charged only when the actor saves an accepted advisory to the dataset. Empty runs and setup checks should not be described as charged unless the pricing handoff says otherwise.

#### 🔌 Integrations

https://www.youtube.com/watch?v=bNACk1\_S\_6w\&list=PLObrtcm1Kw6MUrlLNDbK9QRg8VDJg0gOW\&index=4

Use this actor with Apify integrations, API clients, webhooks, scheduled runs, and dataset exports. Send results to spreadsheets, BI tools, databases, or your own app after each run.

#### ❓ FAQ

##### 🔎 Can this work as a GitHub Security Advisories scraper with the GitHub API?

Yes. It collects public GitHub Security Advisory records and saves structured Apify dataset rows, including source API URLs when available.

##### 🧩 Does it support both CVE and GHSA lookup?

Yes. Enter exact GHSA or CVE IDs in `advisoryIds` to look up known advisories, or collect a feed with filters when you need broader discovery.

##### 📦 Can I filter by package or ecosystem?

Yes. Feed runs can filter by package ecosystem and affected package name when GitHub exposes matching controls for those advisories.

##### 🔑 Do I need a GitHub token?

No for normal public runs. A GitHub token is optional and is useful when you need larger public API pulls.

##### 🛑 What happens when no advisory matches my input?

The run can finish without saving advisory rows. Pricing is based on successfully saved advisory results, not empty searches or no-result setup checks.

##### 📥 Can I download the GitHub advisory database?

You can export the rows collected by each run from the Apify dataset in standard Apify export formats and use filters plus `maxResults` to control each run.

##### ⚙️ Why not use the GitHub API directly?

Use the GitHub API directly when you want to build and maintain your own integration. Use this Actor when you want Apify inputs, datasets, exports, schedules, webhooks, and repeatable runs around the same public advisory source.

##### 🧭 Does this include NVD, OSV, CISA KEV, or other vulnerability sources?

No. This Actor stays focused on GitHub Security Advisories and does not merge other vulnerability databases into the output.

### 📝 Changelog

- 0.0.1: Initial release.

### 🆘 Support

For issues, questions, or feature requests, [file a ticket](https://console.apify.com/actors/maximedupre~github-security-advisories-scraper/issues) and I'll fix or implement it in less than 24h 🫡

### 🔗 Other actors

- [OpenSSF Scorecard Projects Scraper ↗](https://apify.com/maximedupre/openssf-scorecard-projects-scraper) - Use it for related github and security workflows.
- [CISA KEV Scraper ↗](https://apify.com/maximedupre/cisa-kev-scraper) - Use it for related cve and affected workflows.
- [Semver Parser & Version Range Checker ↗](https://apify.com/maximedupre/semver-parser-version-range-checker) - Use it for related versions and package workflows.
- [ORCID Researcher Profile Search ↗](https://apify.com/maximedupre/orcid-researcher-profile-search) - Use it for related lookup workflows.
- [Apple App Store Scraper ↗](https://apify.com/maximedupre/apple-app-store-scraper) - Use it for related lookup and versions workflows.
  **Made with ❤️ by Maxime Dupré**

# Actor input Schema

## `target` (type: `string`):

Choose whether to collect a filtered advisory feed or look up specific GHSA or CVE identifiers.

## `classification` (type: `string`):

Filter the advisory feed by GitHub advisory classification. Used only when Target is Advisory feed.

## `severity` (type: `string`):

Filter the advisory feed by GitHub severity rating.

## `ecosystem` (type: `string`):

Limit feed results to a package ecosystem such as npm, pip, maven, rubygems, go, rust, composer, nuget, or actions.

## `packageName` (type: `string`):

Limit feed results to advisories for one affected package name.

## `cwe` (type: `string`):

Limit feed results to a CWE identifier such as CWE-79 or CWE-89.

## `publishedFrom` (type: `string`):

Collect feed advisories published on or after this date.

## `publishedTo` (type: `string`):

Collect feed advisories published on or before this date.

## `updatedFrom` (type: `string`):

Collect feed advisories updated on or after this date.

## `updatedTo` (type: `string`):

Collect feed advisories updated on or before this date.

## `includeWithdrawn` (type: `boolean`):

Include advisories GitHub marks as withdrawn in feed results.

## `orderBy` (type: `string`):

Choose the GitHub feed ordering used before the result limit is applied.

## `advisoryIds` (type: `array`):

Enter one or more GHSA IDs or CVE IDs to look up. Used only when Target is Exact advisory lookup.

## `maxResults` (type: `integer`):

Limit how many feed advisories are returned. Exact lookups are limited by the identifiers you enter.

## `githubToken` (type: `string`):

Optional token for larger public GitHub API pulls. Leave empty for normal public runs.

## Actor input object example

```json
{
  "target": "advisoryFeed",
  "classification": "any",
  "severity": "any",
  "ecosystem": "npm",
  "packageName": "lodash",
  "cwe": "CWE-79",
  "includeWithdrawn": false,
  "orderBy": "publishedDesc",
  "advisoryIds": [
    "GHSA-xxxx-xxxx-xxxx",
    "CVE-2024-12345"
  ],
  "maxResults": 100
}
```

# Actor output Schema

## `results` (type: `string`):

View scraped GitHub Security Advisory rows in the default dataset.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "ecosystem": "npm",
    "packageName": "lodash",
    "cwe": "CWE-79",
    "advisoryIds": [
        "GHSA-xxxx-xxxx-xxxx",
        "CVE-2024-12345"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("maximedupre/github-security-advisories-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "ecosystem": "npm",
    "packageName": "lodash",
    "cwe": "CWE-79",
    "advisoryIds": [
        "GHSA-xxxx-xxxx-xxxx",
        "CVE-2024-12345",
    ],
}

# Run the Actor and wait for it to finish
run = client.actor("maximedupre/github-security-advisories-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "ecosystem": "npm",
  "packageName": "lodash",
  "cwe": "CWE-79",
  "advisoryIds": [
    "GHSA-xxxx-xxxx-xxxx",
    "CVE-2024-12345"
  ]
}' |
apify call maximedupre/github-security-advisories-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=maximedupre/github-security-advisories-scraper",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/iBG3tgCRyQpaFEtmT/builds/TQDX8cUqfEargAB8t/openapi.json