The critical advisory your scanner can't see — find it in one CI step

说明与用途

blindspot.py 检测仅在仓库中发布、尚未进入 GitHub Advisory Database 的关键漏洞，允许通过 GitHub Action 在 CI 中阻止 PR。

问题

Security scanners that rely on the global GitHub Advisory Database miss critical advisories published directly by repository maintainers.

结果

Blindspot.py and its GitHub Action integration expose critical, unpublished advisories that would otherwise be invisible to standard scanners, enabling teams to block vulnerable PRs and keep security posture up to date.

工作流

• 1. Run blindspot.py against a lock file or package spec to map dependencies to GitHub repos.
• 2. For each dependency, list the repo’s published advisories and filter those whose affected range covers the dependency’s version.
• 3. Query OSV with the same package and version to see if the advisory is in the global feed.
• 4. If OSV returns 404, record the advisory as a blind spot.
• 5. In CI, use the GitHub Action "munimtechnologies/[email protected]" with the lock file and "fail-on-blind: true" to block PRs when blind spots exist.
• 6. Optionally set "sarif:" to upload blind spots as code‑scanning alerts.
• 7. Schedule the action weekly to catch long‑lived blind spots.
• 8. Review the Markdown table in the job summary for blind spots and OSV‑reported advisories.

证据

Dependabot, npm audit, pip-audit and osv-scanner all read the global feed: GitHub's Advisory Database and its mirror, OSV.dev.

来源

195 of 618 maintainer-published advisories (31.6%) are not in the global database under their own GHSA ID.

来源

GHSA-vcwp-f9rq-3887 — "Flowise Custom MCP npx package execution leads to authenticated server‑side command execution." Critical.

来源

Ask OSV the way a scanner would: https://api.osv.dev/v1/vulns/GHSA-vcwp-f9rq-3887 → 404 Not Found (checked 2026-10-15).

来源

blindspot.py checks this for your dependencies. For each one it maps the package to its GitHub repo, lists that repo's published advisories, keeps the ones whose affected range covers your version, and then asks OSV…

来源

The repo is also a composite GitHub Action, so you can gate pull requests without installing anything…

来源