{"id":"CVE-2026-82233","revision":null,"records":[{"revision":"c237eaed22b940e9a0c09dfe0938b307","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-82233","aliases":[],"title":"SiYuan before v3.8.1 Path Traversal via asset.upload","description":"SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.","state":0,"publishedAt":"2026-08-28T10:49:23.913+00:00","modifiedAt":"2026-08-31T18:28:15.029+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.8.1\"\n                        },\n                        {\n                            \"version\": \"3.8.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":5.7,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://www.vulncheck.com/advisories/siyuan-before-3.8.1-path-traversal-via-asset-upload"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82233","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-82233","identifiers":["CVE-2026-82233"]},"retained":false,"historicalAffected":[]},{"revision":"287c60de11a545e49eb7fbf2f3dd4082","observedAt":"2026-11-09T15:15:32.484+00:00","statement":{"source":"euvd","id":"EUVD-2026-67685","aliases":["CVE-2026-82233","GHSA-m4pm-qxhv-84p5"],"title":"SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as …","description":"SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://www.vulncheck.com/advisories/siyuan-before-3.8.1-path-traversal-via-asset-upload"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-67685","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 28, 2026, 10:49:23 AM","dateUpdated":"Aug 31, 2026, 6:28:15 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-67685","identifiers":["EUVD-2026-67685","CVE-2026-82233","GHSA-m4pm-qxhv-84p5"]},"retained":false,"historicalAffected":[]},{"revision":"16794af2d678410a9501fb8224e2cb1d","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-82233","aliases":[],"title":"SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as …","description":"SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection.","state":0,"publishedAt":"2026-08-28T12:16:32.953+00:00","modifiedAt":"2026-08-31T19:17:15.907+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":5.7,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://www.vulncheck.com/advisories/siyuan-before-3.8.1-path-traversal-via-asset-upload"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82233","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-08-28T12:16:32.953","lastModified":"2026-08-31T19:17:15.907"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-82233","identifiers":["CVE-2026-82233"]},"retained":false,"historicalAffected":[]},{"revision":"08bd14f2dee04f7fa0105b90cd897f86","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-p23f-cm6q-2qp8","aliases":["CVE-2026-82233","GO-2026-6655"],"title":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)","description":"# Security Advisory — SiYuan MCP `asset.upload` Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)\n\n| Field | Value |\n|---|---|\n| **Disclosed by** | joysinleung (`joysinleung@gmail.com`) |\n| **Report date** | 2026-08-13 |\n| **Product** | SiYuan (思源笔记) — `siyuan-note/siyuan` |\n| **Go module** | `github.com/siyuan-note/siyuan/kernel` |\n| **Affected versions** | `<= 3.8.0` (latest release at report time; statically confirmed on v3.8.0) |\n| **Patched versions** | 3.8.1 |\n| **Component** | `kernel/mcp/tools/asset.go` (`assetUpload`), `kernel/model/upload.go` (`InsertLocalAssets`) |\n| **Relationship to prior advisory** | **Residual of CVE-2026-66012** (GHSA-cvhv-7xhj-xjp8) MCP remediation. See §Relationship. |\n| **EPSS (exploitation probability)** | Low. Requires the AI Agent to invoke `asset.upload` and the user to approve the (category-level) confirmation; reachable via prompt-injection of the agent. |\n| **KEV (CISA Known Exploited)** | No (not listed in CISA KEV at report time). |\n| **Default-config reachable** | **Partial** — requires the Agent/MCP surface to be configured (admin) and a user approval click; the boundary check itself is entirely absent, so any approved upload reads outside the workspace. |\n\n---\n\n## Summary\n\nSiYuan exposes a native MCP tool `asset` → `asset.upload`. Its `files` argument is documented as a **comma-separated list of absolute file paths**. The handler (`kernel/mcp/tools/asset.go:195`) only normalizes each entry with `filepath.Abs(...)` — it performs **no workspace boundary check** (`IsSubPath`) and **no sensitive-path check** (`IsSensitivePath`). The downstream `model.InsertLocalAssets` (`kernel/model/upload.go:97`) then `os.Open`s each path and copies its bytes into the workspace `assets/` directory.\n\nEvery other AI-plane file primitive in SiYuan is workspace-constrained:\n- `file` / `unzip` tools resolve paths via `resolvePath` (workspace-relative, escape-proof).\n\n`asset.upload` is the **only** AI tool that accepts arbitrary absolute paths with zero boundary validation. An attacker who can steer the Agent (prompt injection) can induce it to upload sensitive files — e.g. `/Users/victim/.ssh/id_rsa`, `~/.aws/credentials`, `/etc/passwd` — into the workspace, from where they are reachable via notes / export / sync.\n\n## Relationship to Prior Advisories\n\n- **CVE-2026-66012** (GHSA-cvhv-7xhj-xjp8) remediated the MCP endpoint by requiring `CheckAdminRole` on `/mcp` and adding `refuseToAccess` for `conf/conf.json` in the *file* tool. However, the **`asset.upload` tool was never given a workspace boundary check** — it still accepts and reads any absolute path. This is a **residual boundary omission** from that remediation: the admin gate restricts *who* may call MCP, but does not constrain *which files* `asset.upload` may read. We report it as the unpatched half of the MCP file-surface hardening.\n\n## Affected Version\n\nStatically confirmed on the latest release **v3.8.0** (tag `v3.8.0`, commit `251596fc0`):\n- `kernel/mcp/tools/asset.go:195` `assetUpload`: `abs, _ := filepath.Abs(strings.TrimSpace(f))` — normalization only.\n- `kernel/model/upload.go:97` `InsertLocalAssets`: iterates the path list and `os.Open(assetAbsPath)` → `writeAssetFile(writePath, ...)` into `assetsDirPath`; the `IsSubPath(assetsDirPath, assetAbsPath)` check at line 130 is **only a dedup guard**, not a boundary limit. No workspace/external restriction is applied.\n\n## Component\n\n- `kernel/mcp/tools/asset.go:195` — `assetUpload` (`files` arg → `filepath.Abs` only).\n- `kernel/model/upload.go:97` — `InsertLocalAssets` (`os.Open` + copy to `assets/`).\n- Contrast (safe): `kernel/mcp/tools/unzip.go:52` `unzipHandler` uses `resolvePath` (workspace-relative, escape-proof).\n\n## Attack Vector\n\n**AI Agent / prompt injection.** Victim lets the Agent process attacker-controlled web/note content → agent is induced to call `asset.upload` with `/Users/victim/.ssh/id_rsa` (or similar) as a `files` entry. The user sees a **category-level** confirmation (\"upload asset\") that does **not** display the specific source path, so the approval is effectively blind to the actual file being read. Once approved, the file is copied into the workspace and exfiltrated via notes/export/sync. No admin role is required beyond the existing Agent/MCP configuration.\n\n## Proof of Concept\n\n```jsonc\n// Agent tool call (asset.upload), attacker-influenced files argument:\n{\n  \"id\": \"<someBlockID>\",\n  \"files\": \"/Users/victim/.ssh/id_rsa,/Users/victim/.aws/credentials,/etc/passwd\"\n}\n```\nHandler flow:\n1. `filepath.Abs(\"/Users/victim/.ssh/id_rsa\")` → `/Users/victim/.ssh/id_rsa` (no `IsSubPath`/`IsSensitivePath` rejection).\n2. `InsertLocalAssets` → `os.Open` → bytes copied into `<workspace>/data/assets/...`.\n3. The private key is now readable via the workspace file API / export / sync.\n\n## Impact\n\nConfidentiality breach: arbitrary local file read (including SSH keys, cloud credentials, OS secrets) through the AI plane. Integrity/availability not directly impacted. Severity is moderated by the required user approval step, but the approval dialog does not reveal the real source path, so the user cannot make an informed decision.\n\n## Scope\n\nReachable only when the Agent/MCP surface is configured and the user approves the upload action. The boundary check is absent regardless of config — any approved upload reads outside the workspace.\n\n## Remediation\n\n1. **Add boundary enforcement in `assetUpload`**: reject any entry where `!util.IsSubPath(util.WorkspaceDir, abs)` or `util.IsSensitivePath(abs)` (same checks used elsewhere).\n2. **Show the real source path in the confirmation dialog** so the user can make an informed decision (currently the `LocalWrite` gate is action-category based and hides the specific path).\n3. Mirror the `resolvePath` workspace-relative constraint already applied to the `file` / `unzip` tools.\n\n> Note: patch authored against v3.8.0 source; not compiled into a full SiYuan release build. Provided for the maintainer to validate in CI.\n\n---\n\n## Appendix: Suggested Patch (F10)\n\n```diff\ndiff --git a/kernel/mcp/tools/asset.go b/kernel/mcp/tools/asset.go\nindex aaa..bbb 100644\n--- a/kernel/mcp/tools/asset.go\n+++ b/kernel/mcp/tools/asset.go\n@@ -195,8 +195,16 @@ func assetUpload(args map[string]any) (CallToolResult, error) {\n \tfileList := strings.Split(filesStr, \",\")\n \tfor i, f := range fileList {\n \t\tabs, err := filepath.Abs(strings.TrimSpace(f))\n-\t\tif err != nil {\n+\t\tif err != nil {\n \t\t\treturn CallToolResult{}, err\n \t\t}\n+\t\t// 边界校验：仅允许工作区内的资产，拒绝任意绝对路径越界读\n+\t\tif !util.IsSubPath(util.WorkspaceDir, abs) || util.IsSensitivePath(abs) {\n+\t\t\tret.Code = -1\n+\t\t\tret.Msg = fmt.Sprintf(\"asset path %s is outside the workspace or sensitive\", abs)\n+\t\t\treturn CallToolResult{}, fmt.Errorf(\"asset path outside workspace: %s\", abs)\n+\t\t}\n \t\tfileList[i] = abs\n \t}\n \tsuccMap, err := model.InsertLocalAssets(id, fileList, true)\n```","state":0,"publishedAt":"2026-10-02T23:16:56+00:00","modifiedAt":"2026-10-07T17:56:03.8226177+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260813142104-b26a4a307b8a"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://github.com/siyuan-note/siyuan/commit/b26a4a307b8ae5067387ea76ce1fad6b7f4bf9e7","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"],"sourceUrl":"https://github.com/advisories/GHSA-p23f-cm6q-2qp8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-p23f-cm6q-2qp8","identifiers":["GHSA-p23f-cm6q-2qp8","CVE-2026-82233","GO-2026-6655"]},"retained":false,"historicalAffected":[]},{"revision":"5728c8774cf84aa8a21b5dc0ce3d4dd8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6655","aliases":["CVE-2026-82233","GHSA-p23f-cm6q-2qp8"],"title":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel","description":"SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-10-07T14:10:14+00:00","modifiedAt":"2026-10-07T17:56:03.8226177+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260813142104-b26a4a307b8a"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p23f-cm6q-2qp8","https://github.com/siyuan-note/siyuan/commit/b26a4a307b8ae5067387ea76ce1fad6b7f4bf9e7","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6655","license":"OSV · upstream source license applies","key":"osv:GO-2026-6655","identifiers":["GO-2026-6655","CVE-2026-82233","GHSA-p23f-cm6q-2qp8"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T11:57:48.1935565+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T11:57:48.1935565+00:00","lastSuccessAt":"2026-11-11T11:57:48.3425698+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:48.3425702+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-08810285716c151004c67847239e44305919603a6514bf8f71e8742fea5ea4c7","complete":true,"records":424036,"lastAttemptAt":"2026-11-11T11:57:47.1356939+00:00","lastSuccessAt":"2026-11-11T11:57:47.0236846+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.1356939+00:00","snapshotPublishedAt":"2026-11-11T11:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-99bdca71b3604150bbac354a4a9d8a89","complete":false,"records":13758,"lastAttemptAt":"2026-11-11T12:09:48.959833+00:00","lastSuccessAt":"2026-11-11T12:09:48.955+00:00","error":null,"lastVerifiedAt":"2026-11-11T12:09:48.955+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13489,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T11:57:48.1935565+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T11:57:48.1935565+00:00","lastSuccessAt":"2026-11-11T11:57:48.3433334+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:48.3433335+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-622dd4c770014d0cabbdd0941fabd46f","complete":true,"records":13752,"lastAttemptAt":"2026-11-11T11:57:48.9429139+00:00","lastSuccessAt":"2026-11-11T10:57:38.856+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:38.856+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T11:57:47.7728063+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.7728063+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T11:57:47.2778993+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.2778993+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-b178858a6ba5f2e20262964fa29d9573839d1b8b735abe524cc7d061ebde5c37","complete":true,"records":3088,"lastAttemptAt":"2026-11-11T11:57:48.1551807+00:00","lastSuccessAt":"2026-11-11T10:57:37.4490966+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:48.1551807+00:00","snapshotPublishedAt":"2026-11-11T10:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T11:57:47.665155+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.665155+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}