Athena Public Vulnerability Disclosures

Public vulnerability disclosures from Athena, an industry coalition coordinating the discovery, remediation, and disclosure of AI-discovered vulnerabilities in open source software.

This repository contains the initial set of advisories being disclosed publicly. Each advisory in advisories/ is identified by a Chainguard identifier (CGP) and includes:

• CGP-<id>.json: the advisory in OSV format, with the vulnerability details.
• CGP-<id>-<purl>.patch: a git format-patch fix for an associated vulnerable version of the package, applicable to the upstream source at that version.

Layout

advisories/
  CGP-3p49-8jjq-wc72/
    CGP-3p49-8jjq-wc72.json
    CGP-3p49-8jjq-wc72-pkg:maven_commons-validator_commons-validator@1.5.1.patch
  ...

Learn more

See the Athena page for how findings are discovered, triaged, and remediated ahead of disclosure.