The story behind limbo.watch
Why I built Limbowatch
On 16 June 2026, the maintainers of NationalSecurityAgency/skills-service published a security advisory for a vulnerability I had reported: a stored XSS, reachable through user registration, that lets an attacker take over an admin account. GitHub rated it critical, and the fix shipped in 4.4.2.
I assumed the rest would take care of itself. The CVE would go public, scanners would pick it up, and anyone running 4.4.1 or earlier would be told to upgrade. That isn’t what happened.
- The advisory is published. GitHub reserved CVE-2026-54694 for it the day before.
- The CVE is still only reserved. I ask GitHub to check whether something went wrong.
- GitHub replies: a record backlog of CVE requests, about three weeks to clear, no expediting. Dependabot alerts come from the advisory, not the CVE.
- I follow up. GitHub is still publishing CVEs for advisories from May.
- After my third follow-up, the CVE is published: 85 days after the advisory.
- As expected, the advisory isn’t in GitHub’s Advisory Database: it covers a release .jar and a Docker image, not a package in an ecosystem GitHub reviews. It will stay outside the databases scanners read.
The reassurance in that June reply is true of how GitHub works, but it didn’t apply here. Dependabot only alerts on advisories GitHub has reviewed into its Advisory Database, and this one was never going to be reviewed: it affects a release .jar and a Docker image, not a package from an ecosystem GitHub supports. Scanners that start from the CVE had nothing to find either, because for 85 days the CVE was only a reserved ID. Even now OSV’s copy of the record lists git commits but no package, and NVD has deferred it.
A critical vulnerability, fixed and publicly documented, has been invisible for more than four months to every scanner that reads GitHub’s database, OSV or NVD. The people involved were doing their jobs. The review queue is simply far longer than the tools downstream assume.
I wanted to know whether my advisory was unusual. It isn’t. In October I measured the upstream advisories of fifteen popular projects: about 1 in 6 was in limbo, and the median wait for review was 23 days. In November I gave Dependabot the dependency files of 13 of them. It raised 2,020 alerts, none for the 1,080 confirmed findings in limbo, though every affected package was in GitHub’s dependency graph. Today limbo.watch counts 10,059 advisories waiting for review, with a median wait of 55 days, and that’s a floor: it only sees the repositories it watches.
Limbowatch makes that wait visible. It lists what’s waiting, publishes it in the format scanners already read, and will help maintainers and reviewers get advisories through faster. If you maintain a project, request a CVE when you publish and fill in both the affected range and the fixed version. If you run a scanner, the feed is open.
Yujia Lin, creator of Limbowatch