OSV schema 1.6 · rebuilt daily · CC BY 4.0

The limbo feed

Every advisory in limbo as an OSV record, 25,104 today: 10,059 waiting for GitHub’s review, and 15,045 in ecosystems GitHub doesn’t review. Same layout as OSV’s own bulk downloads. Use it to see what your scanner can’t yet.

Files

feed/all.zip

One GHSA-….json per advisory in limbo, OSV bulk layout. Byte-stable, so you can diff it.

Download

osv/limbo-db.zip

The feed split by ecosystem, laid out as OSV-Scanner’s offline database. Unzip it and scan.

Download

osv/<Ecosystem>/all.zip

One zip per OSV ecosystem, the way OSV serves its own, with the X-Goog-Hash checksum it sends.

feed/repos.txt

Every watched repo with a published advisory, one per line. Names only, for trackers that poll repos.

feed/index.json

Every ID in the feed, to fetch only what changed.

feed/<GHSA-ID>.json

A single record, linked from each advisory page.

metrics.json

Today’s counts by severity, CVE state and age, plus coverage.

Use it

Download and unpack the feed

curl -O https://limbo.watch/feed/all.zip
unzip -q all.zip -d limbo

Look for your packages

jq -r 'select(.affected[].package.name == "sanitize-html") | .id' limbo/*.json

3
Or scan with OSV-Scanner
```
curl -O https://limbo.watch/osv/limbo-db.zip
unzip -q limbo-db.zip -d limbo-db
osv-scanner scan source --offline-vulnerabilities \
  --local-db-path limbo-db -r .
```
This checks your dependencies against the limbo feed only, so run it next to your usual scan: everything it finds is something OSV doesn’t have yet. Tested with OSV-Scanner 2.7.1; 2.7.0 skips npm lockfile entries that have no resolved field (#3177). We’re proposing upstream that OSV-Scanner add the feed to a normal scan, rather than building another scanner.

One record

{
  "schema_version": "1.6.0",
  "id": "GHSA-xmqh-qfqq-4883",
  "modified": "2026-11-12T11:22:41Z",
  "published": "2026-11-11T14:23:32Z",
  "aliases": [],
  "affected": [
    {
      "package": {
        "ecosystem": "GitHub Actions",
        "name": "useplunk/plunk"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.13.0"
            }
          ]
        }
      ],
      "database_specific": {
        "vulnerable_version_range": "< 0.13.0",
        "patched_versions": "0.13.0",
        "range_converted": true,
        "name_valid": true
      }
    }
  ],
  "severity": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/useplunk/plunk/security/advisories/GHSA-xmqh-qfqq-4883"
    }
  ],
  "database_specific": {
    "limbowatch": {
      "status": "in limbo",
      "repository": "useplunk/plunk",
      "severity": "high",
      "cwe_ids": [],
      "cve": "no CVE anywhere",
      "cited_cve": null,
      "cited_cve_state": null,
      "uncited_cves": [],
      "in_osv": false,
      "reviewed": false,
      "nvd_status": null,
      "likely_permanent": false,
      "first_seen_by_limbowatch": "2026-11-11T14:45:41Z",
      "quality": {
        "names": "ok",
        "ranges": "converted"
      }
    },
    "attribution": "Advisory metadata from published GitHub repository security advisories and the GitHub Advisory Database (https://github.com/advisories, CC BY 4.0); CVE state from CVE Services; OSV.dev; NVD API (this product uses the NVD API but is not endorsed or certified by the NVD). Compiled by Limbowatch (https://limbo.watch), CC BY 4.0."
  }
}

What’s in it, and what isn’t

Facts only: IDs, packages, ranges, severity, CVE state. No titles, descriptions or credits; each record links to the advisory.
Ranges are as entered by maintainers and haven’t been reviewed. Expect some to be wrong. Where one can’t be converted exactly, it’s left out of ranges and kept as text, so it can’t raise a false alarm.
Package names are cleaned where the fix is certain: stray spaces and URLs removed, PyPI and Packagist names in their canonical spelling. The original is kept in name_as_entered; names that still aren’t valid have name_valid: false. Each record’s quality field sums this up, and this page lists every one with its fix.
Go packages name their module, as OSV’s Go records do. Where an advisory names a package inside a module, the module is in package.name and the package in ecosystem_specific.imports, as the Go module proxy reports them.
Most advisories in limbo (C/C++ libraries, applications) name no package OSV has an ecosystem for. Their entries name the repository as a GIT package: the versions are kept as entered, with the ecosystem and name the maintainer gave, and where every version they name is a tag in the repository, OSV GIT ranges give the commits. Match them by repository: the limbowatch scan command does, for git submodules, CMake, Bazel, vcpkg and Conan dependencies.
An advisory leaves the feed when GitHub reviews it, so OSV takes over.
Licensed CC BY 4.0. Credit “Limbowatch (limbo.watch)” and GitHub, as each record’s attribution field says.