GitHub Advisory Database Still Shows the Rejected Fake SQLite CVEs as Critical
Contents
TL;DR
What happened Six CVEs against SQLite turned out to be fabrications, likely AI-generated. MITRE rejected the batch on July 31, 2026, and the NVD records became Rejected (previous post)
What I found August 17, 2026: queried the GitHub Advisory Database API for all six. Every record still carries its original CVSS score and Critical/High severity from July 27–28. All six are type unreviewed, and withdrawn_at is null
Why nothing changed unreviewed records are auto-imported from the NVD feed and never go through GitHub’s analyst review. As of August 17, none of the six had been touched since MITRE’s rejection
What this means unreviewed advisories generate no Dependabot alerts, so these six won’t trigger Dependabot security update PRs. But SCA tools and vulnerability scanners that read the GitHub Advisory Database API directly still see the Critical/High labels
Nearly three weeks after MITRE rejected the six fabricated SQLite CVEs, I queried the GitHub Advisory Database API on August 17, 2026 — and every one of the six still showed its original CVSS score and Critical/High severity.
JFrog Security Research exposed the reports as fabrications on July 30, 2026, MITRE rejected the batch on July 31, and the NVD records flipped to Rejected. That part is covered in the previous post.
The rejection, though, was work done on the MITRE and NVD side. What the downstream databases that ingest their data did with it was a separate question.
GitHub Advisory Database shows all six as first published
Fetching each of the six with the GitHub CLI (gh api /advisories?cve_id=<CVE-ID>) returned type unreviewed for every one.
| CVE | GHSA | severity | CVSS | Last updated |
|---|---|---|---|---|
| CVE-2026-51302 | GHSA-vrg3-8p22-cwh8 | critical | 9.8 | 2026-07-28 |
| CVE-2026-51303 | GHSA-ccgc-4g65-v672 | critical | 9.8 | 2026-07-27 |
| CVE-2026-51300 | GHSA-7jmj-jm53-q38q | critical | 9.1 | 2026-07-28 |
| CVE-2026-51297 | GHSA-jwwq-j3wf-76qr | high | 8.8 | 2026-07-27 |
| CVE-2026-51296 | GHSA-5hvg-wjm2-j333 | high | 7.5 | 2026-07-28 |
| CVE-2026-51304 | GHSA-w2f6-h8v8-pw69 | high | 7.5 | 2026-07-27 |
withdrawn_at is null on all six.
Since MITRE and NVD rejected them on July 31, not one of the six records has been updated.
unreviewed means no GitHub analyst has looked at it
unreviewed is GitHub’s term for records auto-imported from the NVD feed.
They have not been reviewed by GitHub’s security analysts, and they are not eligible to generate Dependabot alerts.
That means these six will not produce any Dependabot security update PRs.
At the same time, the GitHub Advisory Database is public, both the API and the web UI.
For SCA (software composition analysis) tools and vulnerability scanners that read it directly, a CVSS 9.8 or a Critical label is right there to ingest, unreviewed or not.
Nearly three weeks after the rejection, zero updates
Even after the NVD records became Rejected, none of the six GitHub Advisory Database records had changed as of August 17.
At least within the scope of this check, the rejection hadn’t propagated.