Vulnerabilities affecting a package version

Fragmentos de código

curl "https://api.oanor.com/osv-api/v1/scan" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/osv-api/v1/scan", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/osv-api/v1/scan");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/osv-api/v1/scan",
    headers={"x-oanor-key": "oanor_test_..."}
)

Respuesta de ejemplo

Una respuesta real de este endpoint, capturada en la última comprobación de estado.

{
    "data": {
        "count": 14,
        "package": "jinja2",
        "version": "2.4.1",
        "ecosystem": "PyPI",
        "vulnerable": true,
        "vulnerabilities": [
            {
                "id": "GHSA-462w-v97r-4m45",
                "aliases": [
                    "CVE-2019-10906",
                    "PYSEC-2019-217"
                ],
                "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
                "cwe_ids": [
                    "CWE-693"
                ],
                "osv_url": "https://osv.dev/vulnerability/GHSA-462w-v97r-4m45",
                "summary": "Jinja2 sandbox escape via string formatting",
                "modified": "2024-09-24T21:03:59.802687Z",
                "severity": "HIGH",
                "published": "2019-04-10T14:30:24Z",
                "references_count": 23
            },
            {
                "id": "GHSA-8r7q-cvjq-x353",
                "aliases": [
                    "CVE-2014-1402",
                    "PYSEC-2014-8"
                ],
                "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "cwe_ids": [
                    "CWE-266"
                ],
                "osv_url": "https://osv.dev/vulnerability/GHSA-8r7q-cvjq-x353",
                "summary": "Incorrect Privilege Assignment in Jinja2",
                "modified": "2024-09-24T18:48:44.375484Z",
                "severity": "HIGH",
                "published": "2022-05-14T04:04:14Z",
                "references_count": 14
            },
            {
                "id": "GHSA-cpwx-vrp4-4pq7",
                "aliases": [
                    "CVE-2025-27516"
                ],
                "cvss_v3": null,
                "cwe_ids": [
                    "CWE-1336"
                ],
                "osv_url": "https://osv.dev/vulnerability/GHSA-cpwx-vrp4-4pq7",
                "summary": "Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",
                "modified": "2026-02-04T04:14:58.595738Z",
                "severity": "MODERATE",
                "published": "2025-03-05T20:40:14Z",
                "references_count": 6
            },
            {
                "id": "GHSA-fqh9-2qgg-h84h",
                "aliases": [
                    "CVE-2014-0012",
                    "PYSEC-2014-82"
                ],
                "cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                "cwe_ids": [
                    "CWE-377"
                ],
                "osv_url": "https://osv.dev/vulnerability/GHSA-fqh9-2qgg-h84h",
                "summary": "Insecure Temporary File in Jinja2",
                "modified": "2024-09-23T20:03:14.751414Z",
                "severity": "MODERATE",
                "published": "2022-05-17T04:01:00Z",
                "references_count": 13
            },
            {
                "id": "GHSA-g3rq-g295-4j3m",
                "aliases": [
                    
…