GitHub advisory
The linked GitHub Security Advisory record.
GET/api/v1/cves/{cveId}/ghsa
The GitHub Security Advisory (GHSA) mapped to the CVE, verbatim from GitHub: summary and description, CVSS v3/v4 vectors, CWEs, affected npm/PyPI/etc. package ranges with first-patched versions, references, and credited researchers.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
cveId | path | string | CVE identifier. |
Example request
curl "https://radicalnotion.ai/api/v1/cves/CVE-2025-55182/ghsa" \
-H "Authorization: Bearer $RN_TOKEN"Example response(description, references, affected_packages, and credits trimmed)
{
"ghsa_id": "GHSA-fv66-9v8q-g76r",
"cve_id": "CVE-2025-55182",
"html_url": "https://github.com/advisories/GHSA-fv66-9v8q-g76r",
"summary": "React Server Components are Vulnerable to RCE",
"description": "### Impact\n\nThere is an unauthenticated remote code execution vulnerability in React Server Components.\n\nWe recommend upgrading immediately.\n\nThe vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:\n* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-we…",
"severity": "critical",
"cvss_v3": {
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"score": 10
},
"cvss_v4": {
"vector": null,
"score": null
},
"cwe_ids": [
"CWE-502"
],
"cwe_names": {
"CWE-502": "Deserialization of Untrusted Data"
},
"source_repo_url": "https://github.com/facebook/react",
"published_at": "2025-12-03T19:07:39.000Z",
"updated_at": "2025-12-09T16:53:25.000Z",
"github_reviewed_at": "2025-12-03T19:07:39.000Z",
"withdrawn_at": null,
"references": [
"https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r",
"https://nvd.nist.gov/vuln/detail/CVE-2025-55182",
"https://github.com/facebook/react/pull/35277"
],
"affected_packages": [
{
"ecosystem": "npm",
"name": "react-server-dom-webpack",
"vulnerable_version_range": ">= 19.1.0, < 19.1.2",
"first_patched_version": "19.1.2"
},
{
"ecosystem": "npm",
"name": "react-server-dom-webpack",
"vulnerable_version_range": "= 19.2.0",
"first_patched_version": "19.2.1"
},
{
"ecosystem": "npm",
"name": "react-server-dom-turbopack",
"vulnerable_version_range": ">= 19.1.0, < 19.1.2",
"first_patched_version": "19.1.2"
}
],
"credits": [
{
"type": "finder",
"login": "lachlan2k",
"html_url": "https://github.com/lachlan2k"
},
{
"type": "analyst",
"login": "PiotrBorowski",
"html_url": "https://github.com/PiotrBorowski"
},
{
"type": "analyst",
"login": "nozo-moto",
"html_url": "https://github.com/nozo-moto"
}
],
"epss": {
"percentage": 0.99562,
"percentile": 0.99941
}
}Response schema
| Field | Type | Description |
|---|---|---|
ghsa_id | string | GitHub advisory id (GHSA-xxxx-xxxx-xxxx). |
html_url | string | Advisory page on github.com. |
summary / description | string | Advisory title and full Markdown body. |
severity | string | GitHub severity rating. |
cvss_v3 / cvss_v4 | object | GitHub CVSS vector and score per version (null score when not assessed). |
cwe_ids / cwe_names | string[] / object | CWE ids and their names. |
published_at / updated_at / github_reviewed_at / withdrawn_at | string | null | Advisory lifecycle timestamps. |
references[] | string[] | Advisory reference URLs. |
affected_packages[] | object[] | Per-package ecosystem, vulnerable_version_range, and first_patched_version. |
credits[] | object[] | Credited researchers: type, login, html_url. |
epss | object | EPSS percentage and percentile at capture time. |
Responses
| Status | Meaning |
|---|---|
200 | Success. |
400 | A path or query parameter failed validation. |
401 | Missing or invalid access token. |
403 | The CVE is outside your access tier. |
404 | No record exists for the CVE. |
429 | Rate limit exceeded. |
A CVE with no GHSA mapping returns not_found (404).
{
"error": "not_found",
"message": "No GitHub Security Advisory is linked to CVE-2025-55182."
}