When a new Django security vulnerability is published, it sometimes takes a long time before downstream tools such as Grype or Trivy actually flag the CVE/GHSA.
For example these 2 vulnerabilities were published on 4th August:
https://github.com/advisories/GHSA-q238-5cxm-5c9h
https://github.com/advisories/GHSA-wvqv-fj8w-qmhm
but only started being flagged by Grype/Trivy late on 30th September, i.e. over 8 weeks later.
This seems to be because the initial GHSA record was missing the “affected” package details like ecosystem (PyPI) and package name + version ranges, which were only added on 30th Sep.
I’m aware that there are other more direct ways to find out such as ‘django-announce’ or the blog etc.
Nevertheless, I wondered if Django, as a CNA, had any influence over the initial GHSA record, to potentially make it more full from the start? This would benefit consumers who are relying on automated audit tools which consume that data, without them needing to subscribe to something Django specific.
P.S. sorry if I’ve chosen the wrong category, it seemed the least unrelated… but please feel free to move!
Publish GHSA-q238-5cxm-5c9h · github/advisory-database@147f52a · GitHub is the commit corresponding to the extra metadata was eventually added.
Hey @sparrowt, thanks for bringing this to our attention. I want our security advisories to be as usable as possible.
The delays before manual reviews at GitHub are getting worse:
Nevertheless, I wondered if Django, as a CNA, had any influence over the initial GHSA record, to potentially make it more full from the start?
The metadata we supply has been stable for all of 2026, and wouldn’t explain sudden delays over the summer. (We did fix the "versionType" value in April, but the May CVEs weren’t newly delayed.)
On a fresh look, I see we have a bug in the "collectionURL" value we provide. I’ll see that we fix that. Don’t know if it will help.
I suppose one thing we could do is start opening our own PRs against the GHSA database to supply the package & ecosystem values they want. Anecdotally, it seems like those might get merged quickly?
I notice several other issues are still unreviewed by GitHub and might need PRs as well, e.g.:
https://github.com/advisories/GHSA-8rmj-xgq5-w9qm
How about if we fill out a advisory (GHSA) for every confirmed vulnerability? i.e. the remediator(s) and/or coordinator(s) do that as part of the security release.
Thanks for looking into it - I’ve no idea of the machinery behind the scenes here, but it would seem strange if GitHub didn’t provide a way for Django to self-report it correctly under the PyPI ecosystem with django package version ranges - unless they are deliberately not adding that useful metadata until it’s been reviewed to stop unreviewed things getting consumed downstream?
