Docs
Open Lodol
DocumentationIntegrationsAPI

OSV

App · Compliance & Security · 8 actions

Find out whether the software you depend on has known security vulnerabilities, using OSV, the open vulnerability database run by Google's Open Source Security Team. One query reaches every source at once: GitHub advisories, the CVE catalogue, PyPI, Go, Rust and npm's own feeds, and the security trackers of Debian, Ubuntu, Alpine, Red Hat, SUSE, Android and the Linux kernel. Check a single package, a Package URL from a bill of materials, a source repository at a tag, or a Git commit for code with no release at all; audit a whole lockfile or SBOM in one step; and read any advisory in full by its CVE or GHSA number. Every answer says how bad the worst finding is and which release fixes it, so a scheduled workflow can raise a ticket or post to a channel the day something lands. No account or API key is required.

Actions

ActionWhat it does
Check a commitCheck one Git commit, for code pinned to a hash rather than a release: a submodule, a vendored tree, or a build that records the commit it shipped.
Check a packageCheck one package against every vulnerability OSV knows about, and get back how bad the worst one is and which release fixes each.
Check a Package URLCheck one Package URL (purl), the identifier a CycloneDX or SPDX bill of materials writes every component as.
Check a source repositoryCheck a release of a project that has no package registry entry, by its repository and tag.
Check many Package URLsAudit a whole bill of materials in one step: hand it up to 100 Package URLs, straight out of a CycloneDX or SPDX file, and get back which components are affected, how bad the worst finding is and what to upgrade each to.
Check many packagesAudit a whole lockfile in one step: hand it up to 100 'name@version' entries and get back which ones are affected, how bad the worst finding is and what to upgrade each to.
Get details for many vulnerabilitiesRead up to 50 vulnerabilities in full at once, worst first.
Get vulnerability detailsRead one vulnerability in full: what it is and how it works, its CVSS score and vector, its CWE classes, every package and version range it covers, the commits that fixed it, and every advisory, patch and discussion linked to it.

Check a commit

Check one Git commit, for code pinned to a hash rather than a release: a submodule, a vendored tree, or a build that records the commit it shipped. OSV knows which commits each vulnerability spans, so this answers the question no version number can.

Inputs

Commit hashcommittextRequired
The full 40-character commit hash, as 'git rev-parse HEAD' prints it. A shortened hash is not enough for OSV to match.
Maximum vulnerabilitieslimitnumber
How many vulnerabilities to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

committext
fixed_versionslist
highest_cvss_scorenumber
highest_severitytext
is_affectedtrue/false
total_vulnerability_countnumber
truncatedtrue/false
urltext
vulnerabilitieslist
vulnerability_countnumber
worst_vulnerability_idtext
Example output
{
  "commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f",
  "fixed_versions": [],
  "highest_cvss_score": 7.5,
  "highest_severity": "HIGH",
  "is_affected": true,
  "total_vulnerability_count": 3,
  "truncated": true,
  "url": "https://osv.dev/list?q=6879efc2c1596d11a6a6ad296f80063b558d5e0f",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "BIT-java-2023-25193"
      ],
      "cve_ids": [],
      "cvss_score": 7.5,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "ecosystems": [],
      "fixed_versions": [],
      "id": "CVE-2023-25193",
      "is_withdrawn": false,
      "modified": "2026-08-12T13:32:34.504811Z",
      "published": "2023-02-04T00:00:00Z",
      "severity": "HIGH",
      "summary": "hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks.",
      "url": "https://osv.dev/vulnerability/CVE-2023-25193",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "CVE-2023-25193"
}

Check a package

Check one package against every vulnerability OSV knows about, and get back how bad the worst one is and which release fixes each. Covers every ecosystem OSV tracks, from npm and PyPI to Debian and Alpine. Leave the version empty to see everything ever recorded against the package rather than only what affects the release you have.

Inputs

EcosystemecosystemtextRequired
Where the package comes from.One of: npm (npm (JavaScript / TypeScript)), PyPI (PyPI (Python)), Maven (Maven (Java / Kotlin)), Go (Go modules), crates.io (crates.io (Rust)), NuGet (NuGet (.NET)), RubyGems (RubyGems (Ruby)), Packagist (Packagist (PHP / Composer)), Hex (Hex (Elixir / Erlang)), Pub (Pub (Dart / Flutter)), and 34 more.
Package namenametextRequired
The package's name exactly as its ecosystem spells it, capitals included. Maven uses 'group:artifact' and Go uses the full module path. A name OSV does not recognise comes back with nothing found rather than an error, so a typo here reads as a clean result.
Versionversiontext
The version you have. Leave it empty to list everything ever recorded against the package instead of only what affects one release.
Maximum vulnerabilitieslimitnumber
How many vulnerabilities to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

checked_all_versionstrue/false
ecosystemtext
fixed_versionslist
highest_cvss_scorenumber
highest_severitytext
is_affectedtrue/false
nametext
total_vulnerability_countnumber
truncatedtrue/false
urltext
versiontext
vulnerabilitieslist
vulnerability_countnumber
worst_vulnerability_idtext
Example output
{
  "checked_all_versions": false,
  "ecosystem": "npm",
  "fixed_versions": [
    "4.17.21"
  ],
  "highest_cvss_score": 7.2,
  "highest_severity": "HIGH",
  "is_affected": true,
  "name": "lodash",
  "total_vulnerability_count": 1,
  "truncated": false,
  "url": "https://osv.dev/list?q=lodash&ecosystem=npm",
  "version": "4.17.20",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "GHSA-35jh-r3h4-6jhm"
}

Check a Package URL

Check one Package URL (purl), the identifier a CycloneDX or SPDX bill of materials writes every component as. The way in for a workflow that starts from a generated SBOM rather than a name someone typed: the purl already names the ecosystem, the package and the version, so nothing has to be taken apart first.

Inputs

Package URLpurltextRequired
The purl to check, version included. Without a version it lists everything ever recorded against the package. A purl OSV cannot resolve comes back with nothing found rather than an error.
Maximum vulnerabilitieslimitnumber
How many vulnerabilities to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

checked_all_versionstrue/false
fixed_versionslist
highest_cvss_scorenumber
highest_severitytext
is_affectedtrue/false
purltext
total_vulnerability_countnumber
truncatedtrue/false
urltext
versiontext
vulnerabilitieslist
vulnerability_countnumber
worst_vulnerability_idtext
Example output
{
  "checked_all_versions": false,
  "fixed_versions": [
    "4.17.21"
  ],
  "highest_cvss_score": 7.2,
  "highest_severity": "HIGH",
  "is_affected": true,
  "purl": "pkg:npm/lodash@4.17.20",
  "total_vulnerability_count": 1,
  "truncated": false,
  "url": "https://osv.dev/list?q=pkg%3Anpm%2Flodash%404.17.20",
  "version": "4.17.20",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "GHSA-35jh-r3h4-6jhm"
}

Check a source repository

Check a release of a project that has no package registry entry, by its repository and tag. This is how C and C++ libraries, firmware and anything else vendored straight from source get checked: give it the repository you cloned and the tag you are on.

Inputs

Repositoryrepository_urltextRequired
The repository the code came from. Pasting the URL out of the browser is fine, as is an SSH remote. A repository OSV has no records for comes back with nothing found rather than an error.
Tag or versionversiontext
The release tag you are on. Leave it empty to list everything ever recorded against the repository.
Maximum vulnerabilitieslimitnumber
How many vulnerabilities to return. Defaults to 50.From 1 to 1000. Default: 50.

Outputs

checked_all_versionstrue/false
fixed_versionslist
highest_cvss_scorenumber
highest_severitytext
is_affectedtrue/false
repository_urltext
total_vulnerability_countnumber
truncatedtrue/false
urltext
versiontext
vulnerabilitieslist
vulnerability_countnumber
worst_vulnerability_idtext
Example output
{
  "checked_all_versions": false,
  "fixed_versions": [],
  "highest_cvss_score": 9.8,
  "highest_severity": "CRITICAL",
  "is_affected": true,
  "repository_url": "https://github.com/curl/curl.git",
  "total_vulnerability_count": 12,
  "truncated": true,
  "url": "https://osv.dev/list?q=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl.git",
  "version": "8.5.0",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CURL-CVE-2026-10536"
      ],
      "cve_ids": [],
      "cvss_score": 9.8,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [],
      "fixed_versions": [],
      "id": "CVE-2026-10536",
      "is_withdrawn": false,
      "modified": "2026-08-31T18:26:03.006218Z",
      "published": "2026-07-03T06:11:15.378Z",
      "severity": "CRITICAL",
      "summary": "HTTP/2 stream-dependency tree UAF",
      "url": "https://osv.dev/vulnerability/CVE-2026-10536",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "CVE-2026-10536"
}

Check many Package URLs

Audit a whole bill of materials in one step: hand it up to 100 Package URLs, straight out of a CycloneDX or SPDX file, and get back which components are affected, how bad the worst finding is and what to upgrade each to. The purls may mix ecosystems freely.

Inputs

Package URLspurlslistRequired
One Package URL per entry, up to 100. They may mix ecosystems freely, so a whole bill of materials can go in as it is.

Outputs

affected_countnumber
clean_countnumber
details_truncatedtrue/false
entrieslist
entry_countnumber
highest_severitytext
unavailable_idslist
vulnerabilitieslist
vulnerability_countnumber
Example output
{
  "affected_count": 1,
  "clean_count": 1,
  "details_truncated": false,
  "entries": [
    {
      "details_loaded": true,
      "fixed_versions": [
        "4.17.21"
      ],
      "highest_severity": "HIGH",
      "is_affected": true,
      "purl": "pkg:npm/lodash@4.17.20",
      "requested": "pkg:npm/lodash@4.17.20",
      "version": "4.17.20",
      "vulnerability_count": 1,
      "vulnerability_ids": [
        "GHSA-35jh-r3h4-6jhm"
      ]
    },
    {
      "details_loaded": true,
      "fixed_versions": [],
      "highest_severity": null,
      "is_affected": false,
      "purl": "pkg:pypi/requests@2.32.3",
      "requested": "pkg:pypi/requests@2.32.3",
      "version": "2.32.3",
      "vulnerability_count": 0,
      "vulnerability_ids": []
    }
  ],
  "entry_count": 2,
  "highest_severity": "HIGH",
  "unavailable_ids": [],
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1
}

Check many packages

Audit a whole lockfile in one step: hand it up to 100 'name@version' entries and get back which ones are affected, how bad the worst finding is and what to upgrade each to. Every package has to be from the ecosystem chosen above; use 'Check many Package URLs' for a list that mixes several.

Inputs

EcosystemecosystemtextRequired
Where the package comes from.One of: npm (npm (JavaScript / TypeScript)), PyPI (PyPI (Python)), Maven (Maven (Java / Kotlin)), Go (Go modules), crates.io (crates.io (Rust)), NuGet (NuGet (.NET)), RubyGems (RubyGems (Ruby)), Packagist (Packagist (PHP / Composer)), Hex (Hex (Elixir / Erlang)), Pub (Pub (Dart / Flutter)), and 34 more.
PackagespackageslistRequired
One 'name@version' entry per package, up to 100. An entry with no version is checked across every version of that package.

Outputs

affected_countnumber
clean_countnumber
details_truncatedtrue/false
ecosystemtext
entrieslist
entry_countnumber
highest_severitytext
unavailable_idslist
vulnerabilitieslist
vulnerability_countnumber
Example output
{
  "affected_count": 1,
  "clean_count": 1,
  "details_truncated": false,
  "ecosystem": "npm",
  "entries": [
    {
      "details_loaded": true,
      "fixed_versions": [
        "4.17.21"
      ],
      "highest_severity": "HIGH",
      "is_affected": true,
      "name": "lodash",
      "requested": "lodash@4.17.20",
      "version": "4.17.20",
      "vulnerability_count": 1,
      "vulnerability_ids": [
        "GHSA-35jh-r3h4-6jhm"
      ]
    },
    {
      "details_loaded": true,
      "fixed_versions": [],
      "highest_severity": null,
      "is_affected": false,
      "name": "left-pad",
      "requested": "left-pad@1.3.0",
      "version": "1.3.0",
      "vulnerability_count": 0,
      "vulnerability_ids": []
    }
  ],
  "entry_count": 2,
  "highest_severity": "HIGH",
  "unavailable_ids": [],
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1
}

Get details for many vulnerabilities

Read up to 50 vulnerabilities in full at once, worst first. Made to be fed the ids an audit step turned up, so a report can quote each finding's description, references and fix without a step per identifier. An id OSV no longer serves is named rather than failing the step.

Inputs

Vulnerability idsvulnerability_idslistRequired
One identifier per entry, up to 50. Usually chained from an earlier check rather than typed.

Outputs

found_countnumber
highest_severitytext
requested_countnumber
unavailable_idslist
vulnerabilitieslist
Example output
{
  "found_count": 1,
  "highest_severity": "HIGH",
  "requested_count": 1,
  "unavailable_ids": [],
  "vulnerabilities": [
    {
      "affected": [
        {
          "ecosystem": "npm",
          "fixed_commits": [],
          "fixed_versions": [
            "4.17.21"
          ],
          "introduced_versions": [],
          "last_affected_versions": [],
          "name": "lodash",
          "purl": "pkg:npm/lodash",
          "repository_url": null,
          "version_count": 1,
          "versions": [
            "4.17.20"
          ]
        }
      ],
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "cvss_version": "3.1",
      "cwe_ids": [
        "CWE-77",
        "CWE-94"
      ],
      "details": "lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "reference_count": 2,
      "references": [
        {
          "type": "ADVISORY",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
        },
        {
          "type": "PACKAGE",
          "url": "https://github.com/lodash/lodash"
        }
      ],
      "related_ids": [],
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "upstream_ids": [],
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ]
}

Get vulnerability details

Read one vulnerability in full: what it is and how it works, its CVSS score and vector, its CWE classes, every package and version range it covers, the commits that fixed it, and every advisory, patch and discussion linked to it. Takes any identifier OSV files a record under, so a CVE number from a customer email works as well as the GHSA an earlier step found.

Inputs

Vulnerability idvulnerability_idtextRequired
The identifier to read, capitals included. Any of OSV's own ids work, as do CVE numbers.

Outputs

vulnerabilityobject
Example output
{
  "vulnerability": {
    "affected": [
      {
        "ecosystem": "npm",
        "fixed_commits": [],
        "fixed_versions": [
          "4.17.21"
        ],
        "introduced_versions": [],
        "last_affected_versions": [],
        "name": "lodash",
        "purl": "pkg:npm/lodash",
        "repository_url": null,
        "version_count": 1,
        "versions": [
          "4.17.20"
        ]
      }
    ],
    "affected_count": 1,
    "aliases": [
      "CVE-2021-23337"
    ],
    "cve_ids": [
      "CVE-2021-23337"
    ],
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "cvss_version": "3.1",
    "cwe_ids": [
      "CWE-77",
      "CWE-94"
    ],
    "details": "lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
    "ecosystems": [
      "npm"
    ],
    "fixed_versions": [
      "4.17.21"
    ],
    "id": "GHSA-35jh-r3h4-6jhm",
    "is_withdrawn": false,
    "modified": "2025-01-14T09:16:59.230762Z",
    "published": "2021-05-06T16:05:51Z",
    "reference_count": 2,
    "references": [
      {
        "type": "ADVISORY",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
      },
      {
        "type": "PACKAGE",
        "url": "https://github.com/lodash/lodash"
      }
    ],
    "related_ids": [],
    "severity": "HIGH",
    "summary": "Command Injection in lodash",
    "upstream_ids": [],
    "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
    "withdrawn": null
  }
}

Openwhyd

Previous Page

Our World in Data

Next Page

On this page

ActionsCheck a commitCheck a packageCheck a Package URLCheck a source repositoryCheck many Package URLsCheck many packagesGet details for many vulnerabilitiesGet vulnerability details