If you are running self-hosted AI infrastructure, your security posture might be built on a lie. A new census conducted by MV2 of Munim, Inc. reveals that 31.6% of published security advisories for widely used AI/ML tools never make it into the global GitHub Advisory Database. This means tools like Dependabot, npm audit, and pip-audit are effectively blind to nearly one-third of known vulnerabilities in projects such as Open WebUI, Flowise, and vLLM. The gap isn't due to a lack of awareness by maintainers, but a failure in the import pipeline between repository-level advisories and the curated global database.

The Two-Tier Advisory Problem

GitHub maintains two distinct layers of security information. The first is the Repository Security Advisory (GRA), which maintainers publish directly on their own repo's Security tab. The second is the global GitHub Advisory Database, the reviewed and curated set that automated scanners actually read. An advisory only protects downstream users once it is imported into the global database under its own GHSA ID. Until that import happens, the advisory is public and valid, but invisible to automated scanning. There is no alert, no pull request, and no audit finding to warn you that your production stack is vulnerable.

Census Findings and Key Offenders

The study surveyed 30 self-hosted AI/ML repos, finding 618 total advisories. Of those, 195 are missing from the global database under their original IDs. The data shows a stark disparity: seven projects, including dify, LibreChat, and anything-llm, have 100% of their advisories missing. For example, all 21 advisories for dify and all 29 for LibreChat failed to appear in the global database. The median time these advisories remain missing is 91.1 days, with some lingering for nearly 1,000 days. By contrast, when GitHub does successfully import a reviewed advisory, the median time is just 3.2 days.

Why Your Scanner Misses These Vulnerabilities

The invisibility stems from how the global database is constructed. A prior study (arXiv 2602.06009) relied on the repository_advisory_url field within the global database, meaning it could only see advisories that had already been imported. It structurally could not count the ones that were never imported. Since OSV.dev ingests GitHub-reviewed advisories directly from this global database, any advisory missing there is also missing from OSV-based scanners like osv-scanner. This creates a systemic blind spot where maintainers do their due diligence, but the tooling ecosystem fails to propagate that knowledge to users.

Key Takeaways

  • Blind Spot Size: 31.6% of 618 audited advisories for 30 AI tools are missing from the global GitHub Advisory Database.
  • Worst Offenders: Projects like dify, LibreChat, anything-llm, and ComfyUI currently have 100% of their advisories missing from global scans.
  • Time Lag: Missing advisories have a median absence of 91.1 days, compared to a 3.2-day median for successfully imported ones.
  • Scanner Impact: Dependabot, npm audit, and OSV-based tools are unable to flag these vulnerabilities because they rely on the global database.
  • Reproducible Data: The full dataset and methodology are open-source under CC BY 4.0 at the Munim Technologies GitHub repo.

The Bottom Line

If you are maintaining a self-hosted AI tool, publishing a repository advisory is not enough; you must actively request global database inclusion and CVE assignment to ensure your users are protected. For users, assume your scanners are missing data and check the source repositories directly for security updates.