GitHub: List global security advisories

GitHub securityAdvisories.securityAdvisoriesListGlobalAdvisories: arguments, response, policy and SDK examples.

← Security advisories operations · Get started

Operation github.security_advisories_list_global_advisories

Provider route: GET /advisories. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["securityAdvisories"]["securityAdvisoriesListGlobalAdvisories"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.securityAdvisories.securityAdvisoriesListGlobalAdvisories(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.security_advisories.security_advisories_list_global_advisories(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`query`	object	Optional	Additional keys: not allowed
`query.ghsa_id`	string	Optional
`query.type`	string	Optional	Default: reviewed One of: reviewed, malware, unreviewed
`query.cve_id`	string	Optional
`query.ecosystem`	string	Optional	The package’s language or package management ecosystem. One of: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift
`query.severity`	string	Optional	One of: unknown, low, medium, high, critical
`query.cwes`	JSON	Optional
`query.cwes (oneOf 1)`	string	Alternative
`query.cwes (oneOf 2)`	array	Alternative
`query.cwes (oneOf 2)[]`	string	Each item
`query.is_withdrawn`	boolean	Optional
`query.affects`	JSON	Optional
`query.affects (oneOf 1)`	string	Alternative
`query.affects (oneOf 2)`	array	Alternative	Maximum items: 1000
`query.affects (oneOf 2)[]`	string	Each item
`query.published`	string	Optional
`query.updated`	string	Optional
`query.modified`	string	Optional
`query.epss_percentage`	string	Optional
`query.epss_percentile`	string	Optional
`query.before`	string	Optional
`query.after`	string	Optional
`query.direction`	string	Optional	Default: desc One of: asc, desc
`query.per_page`	integer	Optional	Default: 30 Maximum: 100 Minimum: 1
`query.sort`	string	Optional	Default: published One of: updated, published, epss_percentage, epss_percentile

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
`$`	array	Root
`$[]`	Model	Each item	Expand Get a global security advisory — response body

Referenced models: Get a global security advisory — response body

Schemas

2 more schemas are linked from the tables above, on the schema pages.

Get a global security advisory — response body

Field	Type	Presence	Description and constraints
`$`	object	Root	A GitHub Security Advisory. Additional keys: not allowed
`credits`	JSON	Required within parent
`credits (anyOf 1)`	array	Alternative	The users who contributed to the advisory. Read only: true
`credits (anyOf 1)[]`	object	Each item
`credits (anyOf 1)[].type`	string	Required within parent	The type of credit the user is receiving. Known values: analyst, finder, reporter, coordinator, remediation_developer, remediation_reviewer, remediation_verifier, tool, sponsor, other
`credits (anyOf 1)[].user`	Model	Required within parent	Expand List users — response body — item
`credits (anyOf 2)`	null	Alternative
`cve_id`	JSON	Required within parent
`cve_id (anyOf 1)`	string	Alternative	The Common Vulnerabilities and Exposures (CVE) ID. Read only: true
`cve_id (anyOf 2)`	null	Alternative
`cvss_severities`	Model	Optional	Expand Get a global security advisory — response body — cvss severities
`cwes`	JSON	Required within parent
`cwes (anyOf 1)`	array	Alternative
`cwes (anyOf 1)[]`	object	Each item
`cwes (anyOf 1)[].cwe_id`	string	Required within parent	The Common Weakness Enumeration (CWE) identifier.
`cwes (anyOf 1)[].name`	string	Required within parent	The name of the CWE. Read only: true
`cwes (anyOf 2)`	null	Alternative
`description`	JSON	Required within parent
`description (anyOf 1)`	string	Alternative	A detailed description of what the advisory entails. Maximum length: 65535
`description (anyOf 2)`	null	Alternative
`epss`	Model	Optional	Expand Get a global security advisory — response body — epss
`ghsa_id`	string	Required within parent	The GitHub Security Advisory ID. Read only: true
`github_reviewed_at`	JSON	Required within parent
`github_reviewed_at (anyOf 1)`	string	Alternative	The date and time of when the advisory was reviewed by GitHub, in ISO 8601 format. Format: date-time Read only: true
`github_reviewed_at (anyOf 2)`	null	Alternative
`html_url`	string	Required within parent	The URL for the advisory. Format: uri Read only: true
`identifiers`	JSON	Required within parent
`identifiers (anyOf 1)`	array	Alternative	Read only: true
`identifiers (anyOf 1)[]`	object	Each item
`identifiers (anyOf 1)[].type`	string	Required within parent	The type of identifier. Known values: CVE, GHSA
`identifiers (anyOf 1)[].value`	string	Required within parent	The identifier value.
`identifiers (anyOf 2)`	null	Alternative
`nvd_published_at`	JSON	Required within parent
`nvd_published_at (anyOf 1)`	string	Alternative	The date and time when the advisory was published in the National Vulnerability Database, in ISO 8601 format. This field is only populated when the advisory is imported from the National Vulnerability Database. Format: date-time Read only: true
`nvd_published_at (anyOf 2)`	null	Alternative
`published_at`	string	Required within parent	The date and time of when the advisory was published, in ISO 8601 format. Format: date-time Read only: true
`references`	JSON	Required within parent
`references (anyOf 1)`	array	Alternative
`references (anyOf 1)[]`	string	Each item	URLs with more information regarding the advisory.
`references (anyOf 2)`	null	Alternative
`repository_advisory_url`	JSON	Required within parent
`repository_advisory_url (anyOf 1)`	string	Alternative	The API URL for the repository advisory. Format: uri Read only: true
`repository_advisory_url (anyOf 2)`	null	Alternative
`severity`	string	Required within parent	The severity of the advisory. Known values: critical, high, medium, low, unknown
`source_code_location`	JSON	Required within parent
`source_code_location (anyOf 1)`	string	Alternative	The URL of the advisory's source code. Format: uri
`source_code_location (anyOf 2)`	null	Alternative
`summary`	string	Required within parent	A short summary of the advisory. Maximum length: 1024
`type`	string	Required within parent	The type of advisory. Known values: reviewed, unreviewed, malware Read only: true
`updated_at`	string	Required within parent	The date and time of when the advisory was last updated, in ISO 8601 format. Format: date-time Read only: true
`url`	string	Required within parent	The API URL for the advisory. Read only: true
`vulnerabilities`	JSON	Required within parent
`vulnerabilities (anyOf 1)`	array	Alternative	The products and respective version ranges affected by the advisory.
`vulnerabilities (anyOf 1)[]`	Model	Each item	Expand Get a global security advisory — response body — vulnerabilities array item
`vulnerabilities (anyOf 2)`	null	Alternative
`withdrawn_at`	JSON	Required within parent
`withdrawn_at (anyOf 1)`	string	Alternative	The date and time of when the advisory was withdrawn, in ISO 8601 format. Format: date-time Read only: true
`withdrawn_at (anyOf 2)`	null	Alternative

Referenced models: Get a global security advisory — response body — cvss severities, Get a global security advisory — response body — epss, List users — response body — item, Get a global security advisory — response body — vulnerabilities array item

Get a global security advisory — response body — cvss severities

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	object	Alternative
`$ (anyOf 1).cvss_v3`	JSON	Optional
`$ (anyOf 1).cvss_v3 (anyOf 1)`	object	Alternative
`$ (anyOf 1).cvss_v3 (anyOf 1).score`	JSON	Required within parent
`$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 1)`	JSON	Alternative
`$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 1) (anyOf 1)`	number	Alternative	The CVSS 3 score. Maximum: 10 Minimum: 0 Read only: true
`$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 1) (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`$ (anyOf 1).cvss_v3 (anyOf 1).score (anyOf 2)`	null	Alternative
`$ (anyOf 1).cvss_v3 (anyOf 1).vector_string`	JSON	Required within parent
`$ (anyOf 1).cvss_v3 (anyOf 1).vector_string (anyOf 1)`	string	Alternative	The CVSS 3 vector string.
`$ (anyOf 1).cvss_v3 (anyOf 1).vector_string (anyOf 2)`	null	Alternative
`$ (anyOf 1).cvss_v3 (anyOf 2)`	null	Alternative
`$ (anyOf 1).cvss_v4`	JSON	Optional
`$ (anyOf 1).cvss_v4 (anyOf 1)`	object	Alternative
`$ (anyOf 1).cvss_v4 (anyOf 1).score`	JSON	Required within parent
`$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 1)`	JSON	Alternative
`$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 1) (anyOf 1)`	number	Alternative	The CVSS 4 score. Maximum: 10 Minimum: 0 Read only: true
`$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 1) (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`$ (anyOf 1).cvss_v4 (anyOf 1).score (anyOf 2)`	null	Alternative
`$ (anyOf 1).cvss_v4 (anyOf 1).vector_string`	JSON	Required within parent
`$ (anyOf 1).cvss_v4 (anyOf 1).vector_string (anyOf 1)`	string	Alternative	The CVSS 4 vector string.
`$ (anyOf 1).cvss_v4 (anyOf 1).vector_string (anyOf 2)`	null	Alternative
`$ (anyOf 1).cvss_v4 (anyOf 2)`	null	Alternative
`$ (anyOf 2)`	null	Alternative

Get a global security advisory — response body — epss

Field	Type	Presence	Description and constraints
`$`	JSON	Root
`$ (anyOf 1)`	object	Alternative	The EPSS scores as calculated by the [Exploit Prediction Scoring System](https://www.first.org/epss). Read only: true
`$ (anyOf 1).percentage`	JSON	Optional
`$ (anyOf 1).percentage (anyOf 1)`	number	Alternative	Maximum: 100 Minimum: 0
`$ (anyOf 1).percentage (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`$ (anyOf 1).percentile`	JSON	Optional
`$ (anyOf 1).percentile (anyOf 1)`	number	Alternative	Maximum: 100 Minimum: 0
`$ (anyOf 1).percentile (anyOf 2)`	string	Alternative	Pattern: ^-?[0-9]+(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?$
`$ (anyOf 2)`	null	Alternative

Get a global security advisory — response body — vulnerabilities array item package ecosystem, name

Field	Type	Presence	Description and constraints
`$`	object	Root	The name of the package affected by the vulnerability.
`ecosystem`	string	Required within parent	The package's language or package management ecosystem. Known values: rubygems, npm, pip, maven, nuget, composer, go, rust, erlang, actions, pub, other, swift
`name`	JSON	Required within parent
`name (anyOf 1)`	string	Alternative	The unique package name within its ecosystem.
`name (anyOf 2)`	null	Alternative

Policy, approvals and errors

SDK function policy ID: github.security_advisories_list_global_advisories. Catalog operation: security-advisories/list-global-advisories. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source

Report an issue with this page