31.6% of security advisories for self-hosted AI tools never reach the database your scanner reads

Описание и применение

31,6 % опубликованных уязвимостей в самодостаточных ИИ‑проектов не попадают в глобальную базу GitHub, из‑за чего сканеры зависимостей их не обнаруживают.

Задача

Dependency scanners miss real, maintainer‑published vulnerabilities in self‑hosted AI tools because the advisories are not imported into GitHub’s global advisory database.

Результат

In a snapshot of 30 self‑hosted AI/ML repos, 195 of 618 (31.6%) published advisories were not present in the global database under their own GHSA ID, with a median missing time of 91.1 days versus 3.2 days for imported advisories.

Рабочий процесс

• 1. List each repo’s published advisories via the GitHub REST API.
• 2. Build the set of GHSA IDs from the github/advisory‑database repository using a blobless clone.
• 3. Mark an advisory as imported only if its GHSA ID appears in that set.
• 4. For missing advisories with a CVE, query the GitHub advisories API by CVE to determine if it has a thin record under a different ID or no global presence at all.

Доказательства

195 of 618 published security advisories (31.6%) are not in the global GitHub Advisory Database under their own ID

Источник

A GRA only protects downstream users once it is imported into the global database under its own GHSA ID

Источник

Median time missing: 91.1 days. Max: 999.7 days.

Источник

When GitHub does import a reviewed GRA, the median time to do so is 3.2 days

Источник