{"id":"CVE-2026-82651","revision":null,"records":[{"revision":"d05483634f2043918d3909141bce0f31","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-82651","aliases":[],"title":"SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff","description":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.","state":0,"publishedAt":"2026-08-30T14:33:33.112+00:00","modifiedAt":"2026-08-31T18:52:24.68+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.8.1\"\n                        },\n                        {\n                            \"version\": \"3.8.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6","https://www.vulncheck.com/advisories/siyuan-before-3.8.1-missing-authorization-via-history-and-repo-diff"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82651","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-82651","identifiers":["CVE-2026-82651"]},"retained":false,"historicalAffected":[]},{"revision":"8c2010be2d7f434583d29887359f3a03","observedAt":"2026-11-09T16:04:38.638+00:00","statement":{"source":"euvd","id":"EUVD-2026-68237","aliases":["CVE-2026-82651","GHSA-j8f5-rf5j-w7pm"],"title":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct fil…","description":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6","https://www.vulncheck.com/advisories/siyuan-before-3.8.1-missing-authorization-via-history-and-repo-diff"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-68237","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 30, 2026, 2:33:33 PM","dateUpdated":"Aug 31, 2026, 6:52:24 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-68237","identifiers":["EUVD-2026-68237","CVE-2026-82651","GHSA-j8f5-rf5j-w7pm"]},"retained":false,"historicalAffected":[]},{"revision":"df3ab3b65375413b871ed5885857483e","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-82651","aliases":[],"title":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct fil…","description":"SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independently, so an authenticated administrator can retrieve historical snapshots of sensitive files that the guard is meant to block, including data/.siyuan/publishAccess.json (plaintext publish-mode passwords) and files under data/templates/.","state":0,"publishedAt":"2026-08-30T15:16:45.753+00:00","modifiedAt":"2026-08-31T20:56:08.8+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":4.9,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6","https://www.vulncheck.com/advisories/siyuan-before-3.8.1-missing-authorization-via-history-and-repo-diff"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82651","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-200"],"productCriteria":[],"sourceDates":{"published":"2026-08-30T15:16:45.753","lastModified":"2026-08-31T20:56:08.800"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-82651","identifiers":["CVE-2026-82651"]},"retained":false,"historicalAffected":[]},{"revision":"d2544c5168804d52bb410014d71b9242","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-3cm4-ccvw-6xr6","aliases":["CVE-2026-82651","GO-2026-6662"],"title":"SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*","description":"### Summary\n`GHSA-c8r8-95hg-mp34` added a centralized guard,\n`util.IsForbiddenAbsPath()`, specifically to block access to a small\nset of sensitive files: `conf/conf.json` (plaintext\n`accessAuthCode`/API token/cookie key), `data/snippets/conf.json`,\nthe entire `data/templates/` directory, and\n`data/.siyuan/publishAccess.json` (plaintext publish-mode passwords).\nIt was applied to `kernel/api/file.go` and `kernel/mcp/tools/file.go`.\nTwo other routes in the same server that serve arbitrary files by path,\n`/history/*path` and `/repo/diff/*path`, construct their target paths\nindependently and were not updated to call this new guard. Since the\nrepo/history snapshot system's tracked root is `data/` (confirmed by\n`getSyncIgnoreLines()`, whose ignore file lives at\n`data/.siyuan/syncignore` with entries relative to `data/`), both\n`data/.siyuan/publishAccess.json` and `data/templates/*` fall within\nthe scope that can legitimately be captured in historical snapshots,\nmeaning a prior version of either file can exist in\n`util.HistoryDir`/the repo-diff temp checkout even after the live file\nhas been protected by the new guard. This is CWE-862 (Missing\nAuthorization) applied to a very recently introduced protection\nmechanism.\n\n### Details\n`kernel/server/serve.go`, `/history/*path` (around line 994):\n```go\nginServer.GET(\"/history/*path\", model.CheckAuth, model.CheckAdminRole, func(context *gin.Context) {\n    p := filepath.Join(util.HistoryDir, context.Param(\"path\"))\n    // 加密笔记本的历史是密文（.sy/assets/AV），需先解密再输出\n    if serveEncryptedHistory(context, p) {\n        return\n    }\n    secureAssetContentHeaders(context, p, p)\n    http.ServeFile(context.Writer, context.Request, p)\n})\n```\nNo call to `util.IsForbiddenAbsPath(p)` anywhere in this handler.\n\n`kernel/server/serve.go`, `/repo/diff/*path` (around line 1241):\n```go\nginServer.GET(\"/repo/diff/*path\", model.CheckAuth, model.CheckAdminRole, func(context *gin.Context) {\n    requestPath := filepath.Clean(context.Param(\"path\"))\n    if strings.Contains(requestPath, \"..\") {\n        context.Status(http.StatusUnauthorized)\n        return\n    }\n    ...\n    p := filepath.Join(repoDiffBaseDir, requestPath)\n    if !gulu.File.IsSubPath(repoDiffBaseDir, p) {\n        context.Status(http.StatusUnauthorized)\n        return\n    }\n    http.ServeFile(context.Writer, context.Request, p)\n})\n```\nThis route does have its own traversal protection (`..` rejection and\n`IsSubPath` containment within `repoDiffBaseDir`), but that only\nprevents escaping the diff-checkout directory, it does nothing to\nprevent retrieving a *legitimately checked-out historical copy* of\n`publishAccess.json` or a templates file from within that directory,\nwhich is exactly what the new guard exists to prevent regardless of\nwhich directory the copy currently sits in.\n\n`util.IsForbiddenAbsPath()` itself (`kernel/util/path_guard.go`,\nintroduced by the referenced fix) confirms the intended scope:\n```go\n// 禁止访问 data/.siyuan/publishAccess.json（含发布模式明文访问密码）\npublishAccessPath := NormalizeAndResolve(filepath.Join(DataDir, \".siyuan\", \"publishAccess.json\"))\nif fileNorm == publishAccessPath {\n    return true\n}\n```\nand\n```go\n// 禁止访问 data/templates 目录（含目录本身及其全部子路径）\ntemplatesBase := NormalizeAndResolve(filepath.Join(DataDir, \"templates\"))\nif fileNorm == templatesBase || gulu.File.IsSubPath(templatesBase, fileNorm) {\n    return true\n}\n```\nBoth are paths within `data/`, the same root the sync/history/repo\nsystem tracks.\n\n### Step-by-step reproduction\n1. As the workspace admin, enable Publish with a password on at least\n   one notebook (creating `data/.siyuan/publishAccess.json` with a\n   plaintext password), then let a sync/backup snapshot capture this\n   state (or check whether local history capture already covers\n   `data/.siyuan/` in the deployed version).\n2. Change or remove the publish password, so the live\n   `publishAccess.json` no longer contains the old plaintext password\n   the new guard is meant to hide, going forward.\n3. As the admin, request the historical/diff version instead of the\n   live file:\n   ```bash\n   curl -s http://<target>:6806/history/<snapshot-path-to-publishAccess.json> \\\n     -u \"<workspaceName>:<accessAuthCode>\"\n   curl -s http://<target>:6806/repo/diff/<diff-path-to-publishAccess.json> \\\n     -u \"<workspaceName>:<accessAuthCode>\"\n   ```\n4. Expected if consistently protected, matching the behavior the new\n   guard already provides on the live-file endpoints: rejected.\n   Observed: neither handler calls `IsForbiddenAbsPath`, so the\n   historical copy is served if it exists in that location.\n\n*(Not run against a live compiled kernel, same sandbox limitation noted\nthroughout this review; both handlers are read directly from source at\nthe reviewed commit, and `IsForbiddenAbsPath`'s scope, plus the\nsync-root confirmation via `getSyncIgnoreLines()`, are quoted directly\nabove. Whether these specific files are captured by history/repo\nsnapshots in a given deployment depends on the workspace's actual\nusage history and was not independently verified against a live\ninstance in this review.)*\n\n### Impact\nAn admin-authenticated request to either route can potentially retrieve\na historical copy of `data/.siyuan/publishAccess.json` (disclosing a\nplaintext publish-mode password even after it has been changed or the\nlive file has been protected) or a `data/templates/*` file, directly\nundermining the protection `GHSA-c8r8-95hg-mp34` was written four days\nprior to this review specifically to provide, via two routes that\npredate that fix and were not updated alongside it.\n```\n\n## Affected products\n\n| Field | Value |\n|---|---|\n| Ecosystem | **Go** |\n| Package name | `github.com/siyuan-note/siyuan/kernel` |\n| Affected versions | Present as of commit `251596f` (2026-08-12, the version this review confirmed), i.e. postdates and was not covered by the `GHSA-c8r8-95hg-mp34` fix (commit `3542530`, 2026-08-08) |\n| Patched versions | *(none yet, leave blank until a fix is released)* |\n\n## Severity\n\n| Field | Value |\n|---|---|\n| Vector string | `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:M/I:N/A:N` |\n| Score | **~5.9 (Medium)**, `PR:H` since admin authentication is required at the HTTP layer, confidentiality impact scoped to whatever sensitive historical content happens to exist in the tracked snapshots for a given deployment (a real but deployment-dependent condition, honestly reflected as Medium rather than assumed to always be present), no integrity/availability impact since both are read-only. |\n\n## Weaknesses (CWE)\n\n- **CWE-862**: Missing Authorization (primary)\n- **CWE-200**: Exposure of Sensitive Information to an Unauthorized Actor\n\n## Notes for filing\n- Direct, narrow follow-up to `GHSA-c8r8-95hg-mp34`; recommend\n  referencing that advisory directly when filing, since this is\n  precisely the \"sibling caller missed\" pattern that fix's own\n  centralization (moving the check into a shared `util` function) was\n  presumably intended to prevent, just for two callers that existed\n  before the shared function did and weren't migrated to it.\n- Suggested fix: add `if util.IsForbiddenAbsPath(p) { ... reject ... }`\n  to both handlers, matching the pattern already applied in\n  `kernel/api/file.go` and `kernel/mcp/tools/file.go`.","state":0,"publishedAt":"2026-10-05T17:32:44+00:00","modifiedAt":"2026-10-07T17:55:31.4290318+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260816034002-035bf9a8c311"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6","https://github.com/siyuan-note/siyuan/commit/035bf9a8c311c6f8468f2f1054b4d5e1711787e2","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"],"sourceUrl":"https://github.com/advisories/GHSA-3cm4-ccvw-6xr6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3cm4-ccvw-6xr6","identifiers":["GHSA-3cm4-ccvw-6xr6","CVE-2026-82651","GO-2026-6662"]},"retained":false,"historicalAffected":[]},{"revision":"c986bd02065042608d1348c385214974","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6662","aliases":["CVE-2026-82651","GHSA-3cm4-ccvw-6xr6"],"title":"SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/* in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-10-07T14:10:39+00:00","modifiedAt":"2026-10-07T17:55:31.4290318+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260816034002-035bf9a8c311"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3cm4-ccvw-6xr6","https://github.com/siyuan-note/siyuan/commit/035bf9a8c311c6f8468f2f1054b4d5e1711787e2","https://github.com/siyuan-note/siyuan/releases/tag/v3.8.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6662","license":"OSV · upstream source license applies","key":"osv:GO-2026-6662","identifiers":["GO-2026-6662","CVE-2026-82651","GHSA-3cm4-ccvw-6xr6"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T11:57:48.1935565+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T11:57:48.1935565+00:00","lastSuccessAt":"2026-11-11T11:57:48.3425698+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:48.3425702+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-08810285716c151004c67847239e44305919603a6514bf8f71e8742fea5ea4c7","complete":true,"records":424036,"lastAttemptAt":"2026-11-11T11:57:47.1356939+00:00","lastSuccessAt":"2026-11-11T11:57:47.0236846+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.1356939+00:00","snapshotPublishedAt":"2026-11-11T11:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-99bdca71b3604150bbac354a4a9d8a89","complete":false,"records":13758,"lastAttemptAt":"2026-11-11T12:09:48.959833+00:00","lastSuccessAt":"2026-11-11T12:09:48.955+00:00","error":null,"lastVerifiedAt":"2026-11-11T12:09:48.955+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13489,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T11:57:48.1935565+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T11:57:48.1935565+00:00","lastSuccessAt":"2026-11-11T11:57:48.3433334+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:48.3433335+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-622dd4c770014d0cabbdd0941fabd46f","complete":true,"records":13752,"lastAttemptAt":"2026-11-11T11:57:48.9429139+00:00","lastSuccessAt":"2026-11-11T10:57:38.856+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:38.856+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T11:57:47.7728063+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.7728063+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T11:57:47.2778993+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.2778993+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-b178858a6ba5f2e20262964fa29d9573839d1b8b735abe524cc7d061ebde5c37","complete":true,"records":3088,"lastAttemptAt":"2026-11-11T11:57:48.1551807+00:00","lastSuccessAt":"2026-11-11T10:57:37.4490966+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:48.1551807+00:00","snapshotPublishedAt":"2026-11-11T10:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T11:57:47.665155+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:57:47.665155+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}