How do you check whether a version has known vulnerabilities?

Every runtime, server and library you depend on gets security fixes over time, and the version you run may be one that a published advisory names as affected. Advisories are spread over many databases: GitHub's, the Python and Go security teams', RustSec, Bitnami's and others. OSV.dev, the Open Source Vulnerabilities project run by Google, collects them in one format and answers for an exact version which advisories affect it.

Tool description

Pick the Ecosystem, enter the Name and the exact Version, and press Check version. For a popular runtime or package, such as Node.js, PHP, PostgreSQL, lodash or Django, choose it in Quick pick instead, which fills in the Ecosystem and Name for you. You get every known vulnerability that affects that version, most severe first, with:

  • Its ID, linked to its page on osv.dev, and its CVE ID when it has one
  • The Severity the advisory rates it with: Critical, High, Medium or Low
  • The version it is Fixed in: the lowest fixed version above yours, read from the advisory
  • A short Summary

When several databases describe the same issue, such as a GitHub advisory and its copy in the Python database, they are shown as one vulnerability.

The check runs on our server, which asks OSV.dev's public API. Only the ecosystem, name and version are sent.

AI assistants connected to the Rapid Tool Set MCP server can run the same check as vulnerable_version_checker.

Supported ecosystems

Ecosystem What it covers Name examples
Runtimes and servers, Bitnami Runtimes, web and database servers, apps node (Node.js), php, python, nginx, mariadb
npm JavaScript packages lodash, express
PyPI Python packages django, requests
Packagist PHP packages installed with Composer laravel/framework, symfony/http-kernel
Maven Java packages, as group:artifact org.apache.logging.log4j:log4j-core
NuGet .NET packages Newtonsoft.Json
Go Go modules, by module path github.com/gin-gonic/gin
crates.io Rust crates tokio
RubyGems Ruby gems actionpack, nokogiri
Pub Dart and Flutter packages http
Hex Erlang and Elixir packages phoenix, plug
CRAN R packages commonmark

For runtimes and servers, Bitnami's names are used: node for Node.js (nodejs works too), postgresql, apache for the Apache HTTP Server.

Limitations

  • The version must be spelled exactly as the ecosystem does, such as 18.0.0 or 4.17.15. A misspelled name or a version that doesn't exist finds nothing, the same as a version with no known vulnerabilities.
  • Only published advisories are known. A version with none listed can still have flaws nobody has reported yet.
  • Some advisories have no severity rating; they show as Not rated.
  • The Fixed in version is read from the advisory's version ranges. A newer version may have vulnerabilities of its own, so check the one you upgrade to as well.