> GitHub private vulnerability report template from https://bountyoperator.com/templates/github-private-vulnerability-report. Platform rules checked 15 Oct 2026.
> Replace every {placeholder}. Delete this note before you submit.
> Before you submit, paste the filled draft at https://bountyoperator.com/templates/github-private-vulnerability-report?ref=template#check for a free check.

# {Weakness} in `{function, endpoint or file}` lets {attacker} {what they can do}

## Summary

{What is wrong, in which component and versions, and who is affected. Two or three sentences, no code.}

## Details

- Package: {ecosystem} `{package name}`
- Affected versions: `{range in Advisory Database syntax, for example < 2.4.1}`
- Patched versions: {version, or "no fix released"}
- Source: {repository URL} at `{release tag or 40-character commit}`
- Location: `{path/to/file}` lines {start}-{end}, function `{name}`

Root cause: {the line or missing check that opens the path, and why the surrounding code does not stop it}

```
{The smallest excerpt that shows the root cause, with its line numbers}
```

Path:

1. {Attacker} sends {exact input} to `{entry point}`. {What the code does with it.}
2. {The next step, with the value it carries.}
3. {The effect: the data read, the command run, the check skipped.}

## Proof of concept

Tested on {package} {version}, {operating system and runtime version}, with {configuration: the defaults, or the setting that has to be on}.

1. {Install or check out the affected version: the exact command}
2. {Start it with the configuration above}
3. {Send the input: the exact request, file or call}

```
{The script, request or test that triggers it}
```

Output:

```text
{Pasted output that shows the effect}
```

On the patched version: {the same steps, and what they show now}

## Impact

- Who is affected: {users of which feature, in which configuration}
- What an attacker gains: {read, write, run code or deny service: the concrete effect}
- Preconditions: {none, or each one: a setting, a role, an action by the victim}
- Not affected: {the configurations or versions where this does not apply}

## Weakness and severity

- CWE: CWE-{number}, {name}
- Severity: {critical, high, medium or low}, or the CVSS vector `{CVSS:3.1/AV:N/AC:L/...}`

## AI assistance

- AI assistance: {none, or what the model did: found the bug, wrote the text, wrote the proof}
- Checked by hand: {what you ran or read yourself to confirm each claim}

## Suggested fix

{The change, in the file and function it belongs to.}

```diff
- {vulnerable line}
+ {fixed line}
```

## Limits and non-claims

- Not claimed: {what this report does not say, for example no effect on the default configuration}
- Mocked or assumed: {each mock and assumption, or "nothing: every step runs the released code"}
- Stops working when: {the condition that breaks the path}

## Known issues checked

- Published advisories for this repository: {what you searched, the nearest one, why this differs}
- Issues, pull requests and commits: {what you searched, the nearest match, the difference}
- Security policy: {the rule in SECURITY.md this report falls under, for example the supported versions}