# rubysec/ruby-advisory-db

A database of vulnerable Ruby Gems

Repository: https://github.com/rubysec/ruby-advisory-db
Canonical: https://ross.abutalabs.com/products/ruby-advisory-db
Homepage: https://rubysec.com
Language: Ruby
License: NOASSERTION
License Family: other
Topics: rubysec, advisory-files, yaml, security-advisories, metadata, hacktoberfest
Last push: 2026-08-31T12:01:03+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 100, release rhythm 35, longevity 100
- inputs: {"age_days": 4950, "days_push": 2, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1070, forks 248 (observed 2026-09-01T02:14:06.391310+00:00)

## What it is
A community-maintained database of security vulnerability advisories for Ruby gems and Ruby implementations, stored as YAML files identified by CVE or GHSA IDs. It serves as the data source for tools like bundler-audit that check Gemfile.lock files against known vulnerabilities.

## Use cases
- audit my Gemfile.lock for known gem vulnerabilities
- find CVEs affecting a Ruby gem version
- check if a Ruby implementation has security advisories
- feed a vulnerability database into a Ruby dependency scanner
- look up fixed versions for a gem CVE
- contribute a new security advisory for a Ruby library

## When to choose
- you need canonical, plain-text advisory data for Ruby gems or rubies
- you are building or using a Ruby dependency auditing tool like bundler-audit
- you want a community-maintained, easily scriptable vulnerability dataset

## When to avoid
- you need advisories for non-Ruby ecosystems (use OSV, GitHub Advisory DB, or language-specific databases)
- you want a ready-made scanning tool rather than raw data (use bundler-audit instead)
- you need real-time automated vulnerability feeds with API access

## Facets
- artifact type: dataset
- maturity: active
- function: security, vulnerability-scanning, dependency-audit
- domain: security, developer-tools, programming-languages
- platform: ruby, cli, cross-platform
- tags: rubygems, advisory-database, yaml, cve, ghsa, bundler-audit, supply-chain-security

## Member repositories
- rubysec/ruby-advisory-db (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-09-01T02:14:06.391310+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:54:08.714930+00:00, confidence not recorded.
  - readme: https://github.com/rubysec/ruby-advisory-db (fetched 2026-09-01T02:14:06.391310+00:00, sha 4242f193e1d2)
  - homepage: https://rubysec.com (fetched 2026-08-29T12:56:17.182498+00:00, sha ca2cf0cc598c)
- Data as of 2026-08-30T08:39:29.467469+00:00.