---
id: "ghsa_id"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["software"]
langs: ["common"]
quality: 75
url: "http://registry.apicrafter.io/datatype/ghsa_id"
---

# GitHub Security Advisory ID (GHSA) (`ghsa_id`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Identifier of an advisory in the GitHub Advisory Database: GHSA- and three groups of four characters separated by hyphens. The characters are random and come from the set 23456789cfghjmpqrvwx, always in lower case. An advisory that has a CVE identifier keeps its GHSA ID as well; OSV.dev also uses GHSA IDs as entry ids.

- Personal data (PII): no
- Categories: Software development (software)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^GHSA(?:-[23456789cfghjmpqrvwx]{4}){3}$
```

## Examples

- `GHSA-jfh8-c2jp-5v3q` — Remote code injection in Log4j (CVE-2021-44228)
- `GHSA-vp9c-fpxx-744v` — Example in the OSV schema documentation
- `GHSA-JFH8-C2JP-5V3Q` (invalid example) — Upper case
- `GHSA-jfh8-c2jp-5v3a` (invalid example) — The letter a is not in the alphabet

## Sources

- doc: <https://docs.github.com/en/code-security/security-advisories/working-with-global-security-advisories-from-the-github-advisory-database/about-the-github-advisory-database>

## Quality

Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/ghsa_id.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/ghsa_id.yaml>