Search results

IsAffected panics on an advisory with an unrecognized ecosystem, crashing the whole scan

Status: Open.

#2867 In google/osv-scanner;

· Lougarou opened on Jun 5, 2026

internal/imodels: package-level *Package cache leaks across scans, drives OOM in long-running embeddings

Status: Open.

#2859 In google/osv-scanner;

· gpoulin opened on Jun 2, 2026

npm finding for git package on yarn.lock - false positive?

good first issueGood for newcomersGood for newcomers

Status: Open.

#2850 In google/osv-scanner;

· nirhaas opened on May 30, 2026

Interactive fix TUI: npm install --package-lock-only omits --ignore-scripts → RCE via malicious package.json lifecycle scripts on Write.

Status: Open.

#2841 In google/osv-scanner;

· er3b07 opened on May 27, 2026

Feature Request: Scan GitHub Actions Workflows

Status: Open.

#2821 In google/osv-scanner;

· rohitkumarankam opened on May 19, 2026

Tag osv-scanner Docker images with major version

Status: Open.

#2803 In google/osv-scanner;

· bestbeforetoday opened on May 14, 2026

Add ability to list plugins from CLI

Status: Open.

#2798 In google/osv-scanner;

· dosisod opened on May 13, 2026

experimental-mcp: SSE server exposes unauthenticated scan_vulnerable_dependencies tool with no path restrictions

Status: Open.

#2785 In google/osv-scanner;

· Tobsboy2 opened on May 7, 2026

Exclude MuleSoft API specifications

Status: Open.

#2776 In google/osv-scanner;

· meterglost opened on May 6, 2026

filterPackageVulns: orphan vulnerabilities silently dropped when all groups are ignored

Status: Open.

#2756 In google/osv-scanner;

· hyhmrright opened on Apr 30, 2026

Incomplete fix for #2669 / c2c9aae — raw \r in default/table/vertical output enables GitHub Actions workflow-command injection [via vrp team followup]

Status: Open.

#2749 In google/osv-scanner;

· hits313 opened on Apr 27, 2026

Failure to resolve local maven packages

Status: Open.

#2738 In google/osv-scanner;

· Sytten opened on Apr 24, 2026