---
title: "CVEs affecting one open-source package (ranges verbatim)"
method: GET
path: "/api/package/{ecosystem}/{name}"
---

# CVEs affecting one open-source package (ranges verbatim)

`GET /api/package/{ecosystem}/{name}`

## Request

- Base URL: `https://cve-security.com`
- URL: `https://cve-security.com/api/package/{ecosystem}/{name}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

CVE list for a package, KEV-first, with each OSV version range verbatim: `events` plus one render-safe projection per range, `fixed` (the upgrade targets) or `affected_through` (the last vulnerable version, so upgrade past it). No version-membership evaluation is performed server-side; compare versions with your ecosystem's own semantics. {ecosystem} is the purl type (npm, pypi, maven, golang, cargo, composer, gem, nuget, …) or the OSV display name; {name} is the package name and may itself contain slashes (@scope/name, Go module paths, composer vendor/name, percent-encoding optional) or a Maven group:artifact. Alternatively pass ?purl=pkg:npm/lodash and any path is ignored. Covers CVE-linked, GitHub-reviewed OSS advisories via OSV.dev; absence is not evidence of safety. Keyless twin: MCP tool `query_package`.

## Path parameters

- `ecosystem` string, required
- `name` string, required

## Query parameters

- `purl` string

## Response `200`

package{ecosystem,name,purl,key}, cve_count, cves[]{cve_id, url, title, severity, cvss, epss, cisa_kev, known_ransomware_use, published, advisory, advisory_url, ranges[]{type, events, fixed?|affected_through?}}, _meta{source, attribution, absence_semantics}.

## Other responses

- `400`: invalid_package, neither a parseable purl nor a known ecosystem+name.
- `404`: No CVE-linked OSV advisory in our data maps to this package. Absence in our data is not evidence of safety.

---

[API](https://skmtc.dev/cve-security/apis/cve-security-api.md) · [All operations](https://skmtc.dev/cve-security/apis/cve-security-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cve-security/apis/cve-security-api/revisions/2470f9c9a4eb?raw)