# OSV

> Find out whether the software you depend on has known security vulnerabilities, using OSV, the open vulnerability database run by Google's Open Source Security Team. One query reaches every source at once: GitHub advisories, the CVE catalogue, PyPI, Go, Rust and npm's own feeds, and the security trackers of Debian, Ubuntu, Alpine, Red Hat, SUSE, Android and the Linux kernel. Check a single package, a Package URL from a bill of materials, a source repository at a tag, or a Git commit for code with no release at all; audit a whole lockfile or SBOM in one step; and read any advisory in full by its CVE or GHSA number. Every answer says how bad the worst finding is and which release fixes it, so a scheduled workflow can raise a ticket or post to a channel the day something lands. No account or API key is required.

App · Compliance & Security · 8 actions. Web page: https://docs.lodol.com/docs/integrations/osv

## Actions

### Check a commit

Check one Git commit, for code pinned to a hash rather than a release: a submodule, a vendored tree, or a build that records the commit it shipped. OSV knows which commits each vulnerability spans, so this answers the question no version number can.

**Inputs**

- Commit hash (`commit`, text, required): The full 40-character commit hash, as 'git rev-parse HEAD' prints it. A shortened hash is not enough for OSV to match.
- Maximum vulnerabilities (`limit`, number): How many vulnerabilities to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `commit` (text)
- `fixed_versions` (list)
- `highest_cvss_score` (number)
- `highest_severity` (text)
- `is_affected` (true/false)
- `total_vulnerability_count` (number)
- `truncated` (true/false)
- `url` (text)
- `vulnerabilities` (list)
- `vulnerability_count` (number)
- `worst_vulnerability_id` (text)

**Example output**

```json
{
  "commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f",
  "fixed_versions": [],
  "highest_cvss_score": 7.5,
  "highest_severity": "HIGH",
  "is_affected": true,
  "total_vulnerability_count": 3,
  "truncated": true,
  "url": "https://osv.dev/list?q=6879efc2c1596d11a6a6ad296f80063b558d5e0f",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "BIT-java-2023-25193"
      ],
      "cve_ids": [],
      "cvss_score": 7.5,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "ecosystems": [],
      "fixed_versions": [],
      "id": "CVE-2023-25193",
      "is_withdrawn": false,
      "modified": "2026-08-12T13:32:34.504811Z",
      "published": "2023-02-04T00:00:00Z",
      "severity": "HIGH",
      "summary": "hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks.",
      "url": "https://osv.dev/vulnerability/CVE-2023-25193",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "CVE-2023-25193"
}
```

### Check a package

Check one package against every vulnerability OSV knows about, and get back how bad the worst one is and which release fixes each. Covers every ecosystem OSV tracks, from npm and PyPI to Debian and Alpine. Leave the version empty to see everything ever recorded against the package rather than only what affects the release you have.

**Inputs**

- Ecosystem (`ecosystem`, text, required): Where the package comes from. One of: `npm` (npm (JavaScript / TypeScript)), `PyPI` (PyPI (Python)), `Maven` (Maven (Java / Kotlin)), `Go` (Go modules), `crates.io` (crates.io (Rust)), `NuGet` (NuGet (.NET)), `RubyGems` (RubyGems (Ruby)), `Packagist` (Packagist (PHP / Composer)), `Hex` (Hex (Elixir / Erlang)), `Pub` (Pub (Dart / Flutter)), and 34 more.
- Package name (`name`, text, required): The package's name exactly as its ecosystem spells it, capitals included. Maven uses 'group:artifact' and Go uses the full module path. A name OSV does not recognise comes back with nothing found rather than an error, so a typo here reads as a clean result.
- Version (`version`, text): The version you have. Leave it empty to list everything ever recorded against the package instead of only what affects one release.
- Maximum vulnerabilities (`limit`, number): How many vulnerabilities to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `checked_all_versions` (true/false)
- `ecosystem` (text)
- `fixed_versions` (list)
- `highest_cvss_score` (number)
- `highest_severity` (text)
- `is_affected` (true/false)
- `name` (text)
- `total_vulnerability_count` (number)
- `truncated` (true/false)
- `url` (text)
- `version` (text)
- `vulnerabilities` (list)
- `vulnerability_count` (number)
- `worst_vulnerability_id` (text)

**Example output**

```json
{
  "checked_all_versions": false,
  "ecosystem": "npm",
  "fixed_versions": [
    "4.17.21"
  ],
  "highest_cvss_score": 7.2,
  "highest_severity": "HIGH",
  "is_affected": true,
  "name": "lodash",
  "total_vulnerability_count": 1,
  "truncated": false,
  "url": "https://osv.dev/list?q=lodash&ecosystem=npm",
  "version": "4.17.20",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "GHSA-35jh-r3h4-6jhm"
}
```

### Check a Package URL

Check one Package URL (purl), the identifier a CycloneDX or SPDX bill of materials writes every component as. The way in for a workflow that starts from a generated SBOM rather than a name someone typed: the purl already names the ecosystem, the package and the version, so nothing has to be taken apart first.

**Inputs**

- Package URL (`purl`, text, required): The purl to check, version included. Without a version it lists everything ever recorded against the package. A purl OSV cannot resolve comes back with nothing found rather than an error.
- Maximum vulnerabilities (`limit`, number): How many vulnerabilities to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `checked_all_versions` (true/false)
- `fixed_versions` (list)
- `highest_cvss_score` (number)
- `highest_severity` (text)
- `is_affected` (true/false)
- `purl` (text)
- `total_vulnerability_count` (number)
- `truncated` (true/false)
- `url` (text)
- `version` (text)
- `vulnerabilities` (list)
- `vulnerability_count` (number)
- `worst_vulnerability_id` (text)

**Example output**

```json
{
  "checked_all_versions": false,
  "fixed_versions": [
    "4.17.21"
  ],
  "highest_cvss_score": 7.2,
  "highest_severity": "HIGH",
  "is_affected": true,
  "purl": "pkg:npm/lodash@4.17.20",
  "total_vulnerability_count": 1,
  "truncated": false,
  "url": "https://osv.dev/list?q=pkg%3Anpm%2Flodash%404.17.20",
  "version": "4.17.20",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "GHSA-35jh-r3h4-6jhm"
}
```

### Check a source repository

Check a release of a project that has no package registry entry, by its repository and tag. This is how C and C++ libraries, firmware and anything else vendored straight from source get checked: give it the repository you cloned and the tag you are on.

**Inputs**

- Repository (`repository_url`, text, required): The repository the code came from. Pasting the URL out of the browser is fine, as is an SSH remote. A repository OSV has no records for comes back with nothing found rather than an error.
- Tag or version (`version`, text): The release tag you are on. Leave it empty to list everything ever recorded against the repository.
- Maximum vulnerabilities (`limit`, number): How many vulnerabilities to return. Defaults to 50. From 1 to 1000. Default: `50`.

**Outputs**

- `checked_all_versions` (true/false)
- `fixed_versions` (list)
- `highest_cvss_score` (number)
- `highest_severity` (text)
- `is_affected` (true/false)
- `repository_url` (text)
- `total_vulnerability_count` (number)
- `truncated` (true/false)
- `url` (text)
- `version` (text)
- `vulnerabilities` (list)
- `vulnerability_count` (number)
- `worst_vulnerability_id` (text)

**Example output**

```json
{
  "checked_all_versions": false,
  "fixed_versions": [],
  "highest_cvss_score": 9.8,
  "highest_severity": "CRITICAL",
  "is_affected": true,
  "repository_url": "https://github.com/curl/curl.git",
  "total_vulnerability_count": 12,
  "truncated": true,
  "url": "https://osv.dev/list?q=https%3A%2F%2Fgithub.com%2Fcurl%2Fcurl.git",
  "version": "8.5.0",
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CURL-CVE-2026-10536"
      ],
      "cve_ids": [],
      "cvss_score": 9.8,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [],
      "fixed_versions": [],
      "id": "CVE-2026-10536",
      "is_withdrawn": false,
      "modified": "2026-08-31T18:26:03.006218Z",
      "published": "2026-07-03T06:11:15.378Z",
      "severity": "CRITICAL",
      "summary": "HTTP/2 stream-dependency tree UAF",
      "url": "https://osv.dev/vulnerability/CVE-2026-10536",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1,
  "worst_vulnerability_id": "CVE-2026-10536"
}
```

### Check many Package URLs

Audit a whole bill of materials in one step: hand it up to 100 Package URLs, straight out of a CycloneDX or SPDX file, and get back which components are affected, how bad the worst finding is and what to upgrade each to. The purls may mix ecosystems freely.

**Inputs**

- Package URLs (`purls`, list, required): One Package URL per entry, up to 100. They may mix ecosystems freely, so a whole bill of materials can go in as it is.

**Outputs**

- `affected_count` (number)
- `clean_count` (number)
- `details_truncated` (true/false)
- `entries` (list)
- `entry_count` (number)
- `highest_severity` (text)
- `unavailable_ids` (list)
- `vulnerabilities` (list)
- `vulnerability_count` (number)

**Example output**

```json
{
  "affected_count": 1,
  "clean_count": 1,
  "details_truncated": false,
  "entries": [
    {
      "details_loaded": true,
      "fixed_versions": [
        "4.17.21"
      ],
      "highest_severity": "HIGH",
      "is_affected": true,
      "purl": "pkg:npm/lodash@4.17.20",
      "requested": "pkg:npm/lodash@4.17.20",
      "version": "4.17.20",
      "vulnerability_count": 1,
      "vulnerability_ids": [
        "GHSA-35jh-r3h4-6jhm"
      ]
    },
    {
      "details_loaded": true,
      "fixed_versions": [],
      "highest_severity": null,
      "is_affected": false,
      "purl": "pkg:pypi/requests@2.32.3",
      "requested": "pkg:pypi/requests@2.32.3",
      "version": "2.32.3",
      "vulnerability_count": 0,
      "vulnerability_ids": []
    }
  ],
  "entry_count": 2,
  "highest_severity": "HIGH",
  "unavailable_ids": [],
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1
}
```

### Check many packages

Audit a whole lockfile in one step: hand it up to 100 'name@version' entries and get back which ones are affected, how bad the worst finding is and what to upgrade each to. Every package has to be from the ecosystem chosen above; use 'Check many Package URLs' for a list that mixes several.

**Inputs**

- Ecosystem (`ecosystem`, text, required): Where the package comes from. One of: `npm` (npm (JavaScript / TypeScript)), `PyPI` (PyPI (Python)), `Maven` (Maven (Java / Kotlin)), `Go` (Go modules), `crates.io` (crates.io (Rust)), `NuGet` (NuGet (.NET)), `RubyGems` (RubyGems (Ruby)), `Packagist` (Packagist (PHP / Composer)), `Hex` (Hex (Elixir / Erlang)), `Pub` (Pub (Dart / Flutter)), and 34 more.
- Packages (`packages`, list, required): One 'name@version' entry per package, up to 100. An entry with no version is checked across every version of that package.

**Outputs**

- `affected_count` (number)
- `clean_count` (number)
- `details_truncated` (true/false)
- `ecosystem` (text)
- `entries` (list)
- `entry_count` (number)
- `highest_severity` (text)
- `unavailable_ids` (list)
- `vulnerabilities` (list)
- `vulnerability_count` (number)

**Example output**

```json
{
  "affected_count": 1,
  "clean_count": 1,
  "details_truncated": false,
  "ecosystem": "npm",
  "entries": [
    {
      "details_loaded": true,
      "fixed_versions": [
        "4.17.21"
      ],
      "highest_severity": "HIGH",
      "is_affected": true,
      "name": "lodash",
      "requested": "lodash@4.17.20",
      "version": "4.17.20",
      "vulnerability_count": 1,
      "vulnerability_ids": [
        "GHSA-35jh-r3h4-6jhm"
      ]
    },
    {
      "details_loaded": true,
      "fixed_versions": [],
      "highest_severity": null,
      "is_affected": false,
      "name": "left-pad",
      "requested": "left-pad@1.3.0",
      "version": "1.3.0",
      "vulnerability_count": 0,
      "vulnerability_ids": []
    }
  ],
  "entry_count": 2,
  "highest_severity": "HIGH",
  "unavailable_ids": [],
  "vulnerabilities": [
    {
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ],
  "vulnerability_count": 1
}
```

### Get details for many vulnerabilities

Read up to 50 vulnerabilities in full at once, worst first. Made to be fed the ids an audit step turned up, so a report can quote each finding's description, references and fix without a step per identifier. An id OSV no longer serves is named rather than failing the step.

**Inputs**

- Vulnerability ids (`vulnerability_ids`, list, required): One identifier per entry, up to 50. Usually chained from an earlier check rather than typed.

**Outputs**

- `found_count` (number)
- `highest_severity` (text)
- `requested_count` (number)
- `unavailable_ids` (list)
- `vulnerabilities` (list)

**Example output**

```json
{
  "found_count": 1,
  "highest_severity": "HIGH",
  "requested_count": 1,
  "unavailable_ids": [],
  "vulnerabilities": [
    {
      "affected": [
        {
          "ecosystem": "npm",
          "fixed_commits": [],
          "fixed_versions": [
            "4.17.21"
          ],
          "introduced_versions": [],
          "last_affected_versions": [],
          "name": "lodash",
          "purl": "pkg:npm/lodash",
          "repository_url": null,
          "version_count": 1,
          "versions": [
            "4.17.20"
          ]
        }
      ],
      "affected_count": 1,
      "aliases": [
        "CVE-2021-23337"
      ],
      "cve_ids": [
        "CVE-2021-23337"
      ],
      "cvss_score": 7.2,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "cvss_version": "3.1",
      "cwe_ids": [
        "CWE-77",
        "CWE-94"
      ],
      "details": "lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
      "ecosystems": [
        "npm"
      ],
      "fixed_versions": [
        "4.17.21"
      ],
      "id": "GHSA-35jh-r3h4-6jhm",
      "is_withdrawn": false,
      "modified": "2025-01-14T09:16:59.230762Z",
      "published": "2021-05-06T16:05:51Z",
      "reference_count": 2,
      "references": [
        {
          "type": "ADVISORY",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
        },
        {
          "type": "PACKAGE",
          "url": "https://github.com/lodash/lodash"
        }
      ],
      "related_ids": [],
      "severity": "HIGH",
      "summary": "Command Injection in lodash",
      "upstream_ids": [],
      "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "withdrawn": null
    }
  ]
}
```

### Get vulnerability details

Read one vulnerability in full: what it is and how it works, its CVSS score and vector, its CWE classes, every package and version range it covers, the commits that fixed it, and every advisory, patch and discussion linked to it. Takes any identifier OSV files a record under, so a CVE number from a customer email works as well as the GHSA an earlier step found.

**Inputs**

- Vulnerability id (`vulnerability_id`, text, required): The identifier to read, capitals included. Any of OSV's own ids work, as do CVE numbers.

**Outputs**

- `vulnerability` (object)

**Example output**

```json
{
  "vulnerability": {
    "affected": [
      {
        "ecosystem": "npm",
        "fixed_commits": [],
        "fixed_versions": [
          "4.17.21"
        ],
        "introduced_versions": [],
        "last_affected_versions": [],
        "name": "lodash",
        "purl": "pkg:npm/lodash",
        "repository_url": null,
        "version_count": 1,
        "versions": [
          "4.17.20"
        ]
      }
    ],
    "affected_count": 1,
    "aliases": [
      "CVE-2021-23337"
    ],
    "cve_ids": [
      "CVE-2021-23337"
    ],
    "cvss_score": 7.2,
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "cvss_version": "3.1",
    "cwe_ids": [
      "CWE-77",
      "CWE-94"
    ],
    "details": "lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.",
    "ecosystems": [
      "npm"
    ],
    "fixed_versions": [
      "4.17.21"
    ],
    "id": "GHSA-35jh-r3h4-6jhm",
    "is_withdrawn": false,
    "modified": "2025-01-14T09:16:59.230762Z",
    "published": "2021-05-06T16:05:51Z",
    "reference_count": 2,
    "references": [
      {
        "type": "ADVISORY",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337"
      },
      {
        "type": "PACKAGE",
        "url": "https://github.com/lodash/lodash"
      }
    ],
    "related_ids": [],
    "severity": "HIGH",
    "summary": "Command Injection in lodash",
    "upstream_ids": [],
    "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
    "withdrawn": null
  }
}
```