Read a GitHub advisory in this order: the affected package and ecosystem, the affected and patched versions, the impact description, then severity and exploitation scores. Compare the affected range with the version you actually run, and check for workarounds if no patched version exists.
The fields you will see
GitHub's documentation lists what an advisory shows.
| Field | What it tells you |
|---|---|
| Description and severity | What is wrong and how serious it is rated |
| Package and ecosystem | Where the flaw lives, for example npm or PyPI |
| Affected and patched versions | Which versions are vulnerable and which fix it |
| Impact | What an attacker can do |
| References, workarounds, credits | Optional links, mitigations and who found it |
| CVE link | Present when the advisory comes from NVD data |
| CVSS | Scores in versions 3.1 and 4.0 |
| EPSS | Exploitation probability and percentile, when data exists |
Severity levels are Low, Medium, High and Critical.
The GHSA identifier
Every advisory gets a GHSA ID in the format GHSA followed by three groups of four characters. The characters come from a restricted set of lowercase letters and digits, which GitHub documents with a validation pattern. A GHSA ID is assigned whether the advisory was created on GitHub or imported, so the same flaw can carry a GHSA ID and a CVE ID.
Reviewed, unreviewed and malware
GitHub-reviewed advisories are checked for validity and completeness and map to supported ecosystems, and Dependabot alerts are generated for them. Unreviewed advisories come straight from the NVD feed without those checks and do not generate Dependabot alerts. Malware advisories come from the npm security team and the OpenSSF Malicious Packages repository. They have no fix version, so the safe option is to stop using the package.
A five step reading routine
- Confirm the ecosystem and package name match what you use.
- Find your installed version and compare it to the affected range.
- Read the impact sentence and decide if your usage fits it.
- Look at CVSS and EPSS together. Severity says how bad, EPSS says how likely exploitation is.
- Find the patched version or a workaround, and plan the upgrade.
Things that trip up beginners
- A package you do not call directly can still be affected through a transitive dependency.
- A patched version can still be a major upgrade that needs testing.
- No fix listed does not mean ignore it. Look for workarounds, or remove the package.
Where Safeguard fits
Safeguard's dependency scanning links findings to advisories and applies reachability analysis, and a free scan shows it on a real project.
Try it yourself
Open the demo and follow a finding from alert to decision.
Click through it at your own pace, or open it full screen.
Quick check
Is a GHSA ID the same as a CVE ID?
No. They are separate identifiers and one flaw can have both.
Why did I get no alert for an advisory I can see?
It may be unreviewed, and Dependabot does not create alerts for unreviewed advisories.
Sources
Last reviewed: 19 October 2026.
