{"id":"CVE-2026-86540","revision":null,"records":[{"revision":"b3a06017ef504c73ba2f624b159a893a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-86540","aliases":[],"title":"knowns before 0.30.0 Arbitrary Code Execution via LSP Binary","description":"knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.","state":0,"publishedAt":"2026-09-07T23:03:18.654+00:00","modifiedAt":"2026-09-24T14:21:24.01+00:00","affected":[{"ecosystem":"Vendor product","name":"knowns","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"knowns-dev\",\n                    \"product\": \"knowns\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/knowns\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.30.0\"\n                        },\n                        {\n                            \"version\": \"0.30.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216","https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396","https://github.com/knowns-dev/knowns/releases/tag/v0.30.0","https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-86540","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-86540","identifiers":["CVE-2026-86540"]},"retained":false,"historicalAffected":[]},{"revision":"42bde92c74714eea8729bfe78754ed51","observedAt":"2026-11-09T16:07:27.542+00:00","statement":{"source":"euvd","id":"EUVD-2026-72558","aliases":["CVE-2026-86540","GHSA-6ph4-r249-58p2","GHSA-mc52-mwq4-vfx3"],"title":"knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with…","description":"knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5,"severity":null}],"references":["https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216","https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396","https://github.com/knowns-dev/knowns/releases/tag/v0.30.0","https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72558","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 7, 2026, 11:03:18 PM","dateUpdated":"Sep 24, 2026, 2:21:24 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-72558","identifiers":["EUVD-2026-72558","CVE-2026-86540","GHSA-6ph4-r249-58p2","GHSA-mc52-mwq4-vfx3"]},"retained":false,"historicalAffected":[]},{"revision":"acb8245ebbd64f9e8b3d200faa93b60d","observedAt":"2026-10-25T16:19:16.24+00:00","statement":{"source":"nvd","id":"CVE-2026-86540","aliases":[],"title":"knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with…","description":"knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.","state":0,"publishedAt":"2026-09-07T23:16:53.723+00:00","modifiedAt":"2026-09-08T19:56:50.95+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.5,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216","https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396","https://github.com/knowns-dev/knowns/releases/tag/v0.30.0","https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3","https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86540","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-78"],"productCriteria":[],"sourceDates":{"published":"2026-09-07T23:16:53.723","lastModified":"2026-09-08T19:56:50.950"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-86540","identifiers":["CVE-2026-86540"]},"retained":false,"historicalAffected":[]},{"revision":"4401fd4dd40642bb8dc4c61d938fdcc0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6ph4-r249-58p2","aliases":[],"title":"Duplicate Advisory: knowns vulnerable to command injection","description":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references.\n\n# Original Description\n\nknowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.","state":2,"publishedAt":"2026-09-08T00:30:22+00:00","modifiedAt":"2026-10-06T19:00:43.116804+00:00","affected":[{"ecosystem":"npm","name":"knowns","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.30.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3","https://nvd.nist.gov/vuln/detail/CVE-2026-86540","https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396","https://github.com/knowns-dev/knowns","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216","https://github.com/knowns-dev/knowns/releases/tag/v0.30.0","https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary"],"sourceUrl":"https://github.com/advisories/GHSA-6ph4-r249-58p2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6ph4-r249-58p2","identifiers":["GHSA-6ph4-r249-58p2"]},"retained":false,"historicalAffected":[]},{"revision":"8ea85b6636be41f88e035dd24cd08fa9","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-mc52-mwq4-vfx3","aliases":["CVE-2026-86540"],"title":"knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json","description":"## Overview\n\nA critical **Arbitrary Code Execution (ACE)** vulnerability exists in the Knowns Language Server Protocol (LSP) detection and startup pipeline. The system blindly trusts the `settings.lsp.languages.<lang>.binary` field defined in the project-level `.knowns/config.json` file. \n\nBecause this field is **never validated** against an allowlist of managed binaries, and absolute paths are implicitly accepted, opening a malicious repository (or a legitimate repository where the config has been tampered with) results in the immediate execution of an attacker-controlled binary. The payload is executed **twice** per session: once during the initial `runVersionCheck` (health check), and again when the LSP server process is spawned via `Server.Start()`. When chained with the previously identified Config Overwrite vulnerabilities, this flaw yields a fully unauthenticated Remote Code Execution chain.\n\n## Affected paths\n\n| File Path | Role | Vulnerability & Execution Impact |\n| :--- | :--- | :--- |\n| **`internal/models/config.go`** | Validation Gap | **Missing Binary Validation (CWE-829):** `ProjectSettings.Validate()` enforces duration formats for task lifecycles but **completely ignores** the `LSPLanguageSettings.Binary` field. Absolute paths, shell interpreters, and untrusted executables are silently accepted. |\n| **`internal/lsp/detect.go`** | Execution Sink #1 | **Unsanitized Health Check Execution:** `Detector.resolve()` passes the unvalidated override to `exec.LookPath()`, then invokes `runVersionCheck()` which blindly calls `cmd.Run()` on the attacker-controlled binary with `CheckArgs`. |\n| **`internal/lsp/server.go`** | Execution Sink #2 | **Unsanitized LSP Server Spawn:** `Server.Start()` passes the resolved binary path to `knownsprocess.Command()` and spawns it as a long-running background process via `cmd.Start()`, executing the payload a second time. |\n\n## Root Cause\n\n### Missing Validation in Configuration Schema\nIn `internal/models/config.go`, the `ProjectSettings.Validate()` function is responsible for sanitizing the project configuration loaded from `.knowns/config.json`. However, it only validates task lifecycle durations:\n\n```go\nfunc (s ProjectSettings) Validate() error {\n    settings := s.EffectiveTaskLifecycle()\n    if _, err := ParseTaskLifecycleDuration(settings.ArchiveAfter); err != nil { ... }\n    // NO VALIDATION FOR s.LSP.Languages[lang].Binary\n    return nil\n}\n```\n\nThe `LSPLanguageSettings` struct exposes a `Binary` string field. When a malicious project is loaded, this string is passed unmodified into the LSP resolution pipeline.\n\n### Blind Execution in LSP Detector\nIn `internal/lsp/detect.go`, the `Detector.resolve()` function accepts an `override` string (from the config) and forces it into the execution pipeline:\n\n```go\nfunc (d *Detector) resolve(ctx context.Context, root string, lang Language, override string) (ServerCommand, bool) {\n    binaries := lang.Binaries\n    if override != \"\" {\n        binary := Binary{Name: override} // Attacker's malicious path injected here\n        binaries = []Binary{binary}\n    }\n    for _, binary := range binaries {\n        path, err := d.LookPath(binary.Name) // Accepts absolute paths (e.g., /tmp/evil.sh)\n        // ...\n        err = d.RunCheck(checkCtx, path, binary.CheckArgs...) // EXECUTION #1\n        // ...\n    }\n}\n```\n\n`d.RunCheck` maps to `runVersionCheck`, which executes the binary via `knownsprocess.CommandContext(ctx, path, args...).Run()`.\n\n### Unrestricted Process Spawn\nIn `internal/lsp/server.go`, when the LSP manager starts the server, it executes the same compromised path:\n\n```go\nfunc (s *Server) Start(ctx context.Context) error {\n    // ...\n    cmd := knownsprocess.Command(s.Command.Path, s.Command.Args...) // EXECUTION #2\n    cmd.Dir = s.Root\n    // ...\n    if err := cmd.Start(); err != nil { ... }\n}\n```\n\n## Attack Vector\n\n| Phase | Request / Action | Effect |\n| :--- | :--- | :--- |\n| **1. Plant** | Attacker commits `.knowns/config.json` containing `{\"settings\":{\"lsp\":{\"languages\":{\"go\":{\"binary\":\"/tmp/evil.sh\"}}}}}` to a repository. | Malicious config embedded in the project. |\n| **2. Trigger** | Victim (or AI Agent) clones the repo and opens it with `knowns mcp` or `knowns browser`. | Auto-detection scans the project, finds a `.go` file, and loads the malicious config. |\n| **3. Execute (Health Check)** | `Detector.resolve()` calls `runVersionCheck(\"/tmp/evil.sh\", \"version\")`. | **RCE Execution #1** occurs silently in the background. |\n| **4. Execute (LSP Spawn)** | `Server.Start()` calls `cmd.Start()` with the same binary. | **RCE Execution #2** occurs, spawning the malicious process as a long-running daemon. |\n\n**Chained Attack Vector (Unauthenticated RCE):**\nIf combined with the **Config Overwrite** vulnerability (via `code.replace` path traversal), a remote attacker can overwrite `.knowns/config.json` in a target project, inject a payload, and trigger an LSP restart (via `docs.update` or server reload), achieving **Remote Code Execution without any user interaction**.\n\n## Analysis\n\nThis vulnerability is a textbook example of **Inclusion of Functionality from Untrusted Control Sphere (CWE-829)**, commonly known in the IDE/Editor space as the \"Malicious Workspace\" vulnerability (similar to historical CVEs in VS Code where `.vscode/settings.json` could point to malicious interpreter paths).\n\nThe core failure is the lack of a strict allowlist for executable paths. By relying on `exec.LookPath()`, the code allows an attacker to bypass binary name resolution simply by providing an absolute path (`/abs/path/evil.sh`) or a path containing a slash (`./evil.sh`). \n\nFurthermore, the execution happens **automatically** upon project load. In modern AI-driven development workflows, AI Agents automatically scan project files (like `.go`, `.ts`, `.py`) to provide context. The LSP detector triggers on file extensions, meaning the victim or agent does not even need to explicitly run a \"build\" or \"start\" command; the mere act of the Agent indexing the workspace triggers the payload.\n\n## Fix\n\n*Patch is available right now at [New Release](https://github.com/knowns-dev/knowns/releases).*","state":0,"publishedAt":"2026-10-06T18:58:38+00:00","modifiedAt":"2026-10-06T19:15:03.4946544+00:00","affected":[{"ecosystem":"npm","name":"knowns","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.30.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/knowns-dev/knowns/security/advisories/GHSA-mc52-mwq4-vfx3","https://nvd.nist.gov/vuln/detail/CVE-2026-86540","https://github.com/knowns-dev/knowns/commit/d3989829fb5095666d23d005b2f78a082832a396","https://github.com/knowns-dev/knowns","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/lsp/detect.go#L128-L157","https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/models/config.go#L205-L216","https://github.com/knowns-dev/knowns/releases/tag/v0.30.0","https://www.vulncheck.com/advisories/knowns-before-0.30.0-arbitrary-code-execution-via-lsp-binary"],"sourceUrl":"https://github.com/advisories/GHSA-mc52-mwq4-vfx3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-mc52-mwq4-vfx3","identifiers":["GHSA-mc52-mwq4-vfx3","CVE-2026-86540"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T13:57:33.6529555+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T13:57:33.6529555+00:00","lastSuccessAt":"2026-11-11T13:57:33.8241235+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:33.8241245+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-50d710c9a9d82d7c4f0dbc882eeaa04edd96b04262f8e1dc90b5d781e709dfb5","complete":true,"records":424128,"lastAttemptAt":"2026-11-11T13:57:32.8474715+00:00","lastSuccessAt":"2026-11-11T13:57:32.6784104+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:32.8474715+00:00","snapshotPublishedAt":"2026-11-11T13:27:44+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f0a4583a21084daab8e852bf5d038b99","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T14:09:33.1310684+00:00","lastSuccessAt":"2026-11-11T14:09:33.127+00:00","error":null,"lastVerifiedAt":"2026-11-11T14:09:33.127+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13569,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T13:57:33.6529555+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T13:57:33.6529555+00:00","lastSuccessAt":"2026-11-11T13:57:33.8250558+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:33.8250561+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-11785b13898646a1917b06b09d2df4a4","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T13:57:34.9144807+00:00","lastSuccessAt":"2026-11-11T13:57:34.909+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:34.909+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T13:57:33.3950468+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:33.3950468+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T13:57:32.9057946+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:32.9057946+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T13:57:33.6132068+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:33.6132068+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-10cb353ca77c2a8069d6892d1d394d936b12c0add3c8749e2a1a03a1c5d50426","complete":true,"records":231666,"lastAttemptAt":"2026-11-11T13:57:33.0989698+00:00","lastSuccessAt":"2026-11-11T12:59:55.8981437+00:00","error":null,"lastVerifiedAt":"2026-11-11T13:57:33.0989698+00:00","snapshotPublishedAt":"2026-11-11T12:32:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}