How a maintainer requests a CVE through GitHub security advisories

Create a draft security advisory in your repository, choose the option to request a CVE ID from GitHub, fill in the affected and patched versions, and submit. GitHub is a CVE Numbering Authority and says it usually reviews requests within 72 hours. It cannot assign an ID if another CNA already covers your project.

Before you start

You need admin permissions on the advisory. Requesting a CVE does not make the advisory public, according to GitHub's documentation. The advisory stays a private draft until you publish it.

If another CNA covers your project, for example a vendor or foundation that runs its own, GitHub cannot assign one. You can still add an existing ID from that CNA to the advisory.

Steps

1. Open the repository, then the Security and quality tab.
2. Under Reporting, click Advisories, then New draft security advisory.
3. Enter a title.
4. In the CVE identifier dropdown, pick whether you already have an ID or want to request one from GitHub later.
5. Describe the vulnerability: impact, patches or workarounds, and references.
6. Under Affected products, enter the ecosystem, package name, affected versions, patched versions and any vulnerable functions.
7. Set severity, or choose to assess it using CVSS.
8. Add weaknesses as CWEs if they apply.
9. Optionally credit contributors. Each credited person can accept or decline.
10. Create the draft, then request the CVE.

Write the record for the reader

The advisory becomes the public description, so write it for the people who must act on it.

• State the impact in plain terms: who is affected and what an attacker can do.
• Give exact version ranges, and add the fix version before publishing. GitHub's page warns that without one, users get alerts with no safe version to upgrade to.
• Say what to do if no fix is available yet, such as a mitigation.
• Keep the proof of concept out unless disclosure timing allows it.

Timing

GitHub says it usually reviews requests within 72 hours. Do not plan a release date around that. Request early, and treat the review as a dependency, not a guarantee.

When GitHub is not the right route

If another CNA covers you, go to that CNA. If nobody does and you are not on GitHub, the CVE researcher guidance lists a path from vendor, to third party coordinator, to the MITRE CVE request form as a last resort. See who to ask for a CVE ID.

Quick check

Sources

• GitHub: about repository security advisories
• GitHub: creating a repository security advisory

Last reviewed: 19 October 2026.