{"id":"EUVD-2026-25144","revision":null,"records":[{"revision":"cffcc76bd2dc4dd6b014feb0629b7a5e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41179","aliases":[],"title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","state":0,"publishedAt":"2026-04-23T00:03:36.282+00:00","modifiedAt":"2026-07-15T00:59:47.559+00:00","affected":[{"ecosystem":"Vendor product","name":"rclone","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"rclone\",\n                    \"product\": \"rclone\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.48.0, < 1.73.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.2,"severity":"CRITICAL"}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q","https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go","https://github.com/rclone/rclone/releases/tag/v1.73.5","https://rclone.org/changelog/#v1-73-5-2026-04-19"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41179","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41179","identifiers":["CVE-2026-41179"]},"retained":false,"historicalAffected":[]},{"revision":"3f49e5c4a3d7456fbb1154fe301c46e8","observedAt":"2026-11-15T12:03:18.649+00:00","statement":{"source":"euvd","id":"EUVD-2026-25144","aliases":["CVE-2026-41179","GHSA-jfwf-28xr-xw6q"],"title":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true…","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.2,"severity":null}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q","https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go","https://github.com/rclone/rclone/releases/tag/v1.73.5","https://rclone.org/changelog/#v1-73-5-2026-04-19"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25144","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 23, 2026, 12:03:36 AM","dateUpdated":"Jul 15, 2026, 12:59:47 AM"},"relatedAdvisories":[{"id":"openSUSE-SU-2026:20620-1","title":"Security update for rclone","vulnerabilityIds":["CVE-2024-45337","CVE-2024-45338","CVE-2024-51744","CVE-2024-52522","CVE-2025-22869","CVE-2025-22870","CVE-2025-30204","CVE-2025-58181","CVE-2025-68121","CVE-2026-1229","CVE-2026-27141","CVE-2026-33186","CVE-2026-41176","CVE-2026-41179"]},{"id":"WID-SEC-W-2026-1179","title":"rclone: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-41176","CVE-2026-41179"]},{"id":"openSUSE-SU-2026:10584-1","title":"rclone-1.73.5-1.1 on GA media","vulnerabilityIds":["CVE-2026-41176","CVE-2026-41179"]},{"id":"openSUSE-SU-2026:21436-1","title":"Security update for rclone","vulnerabilityIds":["CVE-2025-68121","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-27141","CVE-2026-27145","CVE-2026-32952","CVE-2026-33809","CVE-2026-33813","CVE-2026-33814","CVE-2026-39821","CVE-2026-39824","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-41176","CVE-2026-41179","CVE-2026-42500","CVE-2026-42502","CVE-2026-42504","CVE-2026-42506","CVE-2026-42507","CVE-2026-42508","CVE-2026-44740","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-49980","CVE-2026-54572","CVE-2026-59732","CVE-2026-59733"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25144","identifiers":["EUVD-2026-25144","CVE-2026-41179","GHSA-jfwf-28xr-xw6q"]},"retained":false,"historicalAffected":[]},{"revision":"3357a19e61d74ce5b1530ee931860250","observedAt":"2026-11-12T15:18:55.774+00:00","statement":{"source":"nvd","id":"CVE-2026-41179","aliases":[],"title":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true…","description":"Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication. Version 1.73.5 patches the issue.","state":0,"publishedAt":"2026-04-23T00:16:45.947+00:00","modifiedAt":"2026-11-11T23:10:00.263+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.2,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go","https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b","https://github.com/rclone/rclone/releases/tag/v1.73.5","https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q","https://rclone.org/changelog/#v1-73-5-2026-04-19","https://access.redhat.com/security/cve/CVE-2026-41179","https://bugzilla.redhat.com/show_bug.cgi?id=2460988","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41179.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41179","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-78","CWE-306","CWE-94"],"productCriteria":["cpe:2.3:a:rclone:rclone:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-23T00:16:45.947","lastModified":"2026-11-11T23:10:00.263"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41179","identifiers":["CVE-2026-41179"]},"retained":false,"historicalAffected":[]},{"revision":"f89f70279a654bdf92057bba126972f9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jfwf-28xr-xw6q","aliases":["BIT-rclone-2026-41179","CVE-2026-41179","GO-2026-5466"],"title":"RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution","description":"### Summary\nThe RC endpoint `operations/fsinfo` is exposed without `AuthRequired: true` and accepts attacker-controlled `fs` input. Because `rc.GetFs(...)` supports inline backend definitions, an unauthenticated attacker can instantiate an attacker-controlled backend on demand. For the WebDAV backend, `bearer_token_command` is executed during backend initialization, making single-request unauthenticated local command execution possible on reachable RC deployments without global HTTP authentication.\n\n### Preconditions\n\nPreconditions for this vulnerability are:\n\n- The rclone remote control API **must** be enabled, either by the `--rc` flag or by running the `rclone rcd` server\n- The remote control API **must** be reachable by the attacker - by default rclone only serves the rc to localhost unless the `--rc-addr` flag is in use\n- The rc must have been deployed **without** global RC HTTP authentication - so not using `--rc-user`/`--rc-pass`/`--rc-htpasswd`/etc\n\n\n### Details\nThe root cause consists of the following pieces:\n\n1. `operations/fsinfo` is not protected with `AuthRequired: true`\n2. `operations/fsinfo` calls `rc.GetFs(...)` on attacker-controlled input\n3. `rc.GetFs(...)` supports inline backend creation through object-valued `fs`\n4. WebDAV backend initialization executes `bearer_token_command`\n\nRelevant code paths:\n\n- [`fs/operations/rc.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go)\n  - `operations/fsinfo` is registered without `AuthRequired: true`\n  - `rcFsInfo()` calls `rc.GetFs(ctx, in)`\n\n- [`fs/rc/cache.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go)\n  - `GetFs()` / `GetFsNamed()` can parse an object-valued `fs`\n  - `getConfigMap()` converts attacker-controlled JSON into a backend config string\n\n- [`backend/webdav/webdav.go`](https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go)\n  - `bearer_token_command` is a supported backend option\n  - `NewFs(...)` calls `fetchAndSetBearerToken()` when `bearer_token_command` is set\n  - `fetchBearerToken()` invokes `exec.Command(...)`\n\nThis creates a practical single-request unauthenticated command-execution primitive on reachable RC servers without global HTTP authentication.\n\nThis was alidated on:\n- current `master` as of 2026-04-14: `bf55d5e6d37fd86164a87782191f9e1ffcaafa82`\n- latest public release tested locally: `v1.73.4`\n\nThis was also validated on a public amd64 Ubuntu host controlled by the tester, using direct host execution (not containerized PoC execution).\n\n### PoC\n#### Minimal single-request form PoC\nStart a vulnerable RC server:\n\n```bash\nrclone rcd --rc-addr 127.0.0.1:5572\n```\n\nNo `--rc-user`, no `--rc-pass`, no `--rc-htpasswd`.\n\nThen send a single request:\n\n```bash\ncurl -sS -X POST http://127.0.0.1:5572/operations/fsinfo \\\n  --data-urlencode \"fs=:webdav,url='http://127.0.0.1/',vendor=other,bearer_token_command='/usr/bin/touch /tmp/rclone_fsinfo_rce_poc_marker':\"\n```\n\nExpected result:\n- HTTP 200 JSON response from `operations/fsinfo`\n- `/tmp/rclone_fsinfo_rce_poc_marker` is created on the host\n\n### Impact\nThis is effectively a single-request unauthenticated command-execution vulnerability on reachable RC deployments without global HTTP authentication.\n\nIn practice, command execution in the rclone process context can lead to higher-impact outcomes such as local file read, file write, or shell access, depending on the deployed environment.\n\n#### Testing performed\nThis was successfully reproduced:\n- on a local test environment\n- on a public amd64 Ubuntu host controlled by the tester\n\nOn the public host it was confirmed:\n\n- the unauthenticated `operations/fsinfo` exploit worked\n- command execution occurred on the host\n- the issue was reproducible through direct host execution","state":0,"publishedAt":"2026-04-22T14:45:10+00:00","modifiedAt":"2026-09-10T03:50:44.5887078+00:00","affected":[{"ecosystem":"Go","name":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.48.0"},{"kind":"fixed","version":"1.73.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q","https://nvd.nist.gov/vuln/detail/CVE-2026-41179","https://github.com/rclone/rclone/commit/2a9e952b38e03a96bf40c9eb6e8e22199865ee3b","https://github.com/rclone/rclone","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/backend/webdav/webdav.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/operations/rc.go","https://github.com/rclone/rclone/blob/bf55d5e6d37fd86164a87782191f9e1ffcaafa82/fs/rc/cache.go","https://github.com/rclone/rclone/releases/tag/v1.73.5","https://rclone.org/changelog/#v1-73-5-2026-04-19"],"sourceUrl":"https://github.com/advisories/GHSA-jfwf-28xr-xw6q","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jfwf-28xr-xw6q","identifiers":["GHSA-jfwf-28xr-xw6q","BIT-rclone-2026-41179","CVE-2026-41179","GO-2026-5466"]},"retained":false,"historicalAffected":[]},{"revision":"688616461cd240658c29ee3f35029625","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5466","aliases":["BIT-rclone-2026-41179","CVE-2026-41179","GHSA-jfwf-28xr-xw6q"],"title":"Unauthenticated backend instantiation in github.com/rclone/rclone","description":"The operations/fsinfo remote control (RC) endpoint in rclone was registered without requiring authentication. This allowed unauthenticated callers to instantiate arbitrary backends via inline backend definitions, which could lead to local command execution if the backend configuration allows it (e.g., via bearer_token_command in webdav or ssh in sftp).","state":0,"publishedAt":"2026-08-11T20:19:48+00:00","modifiedAt":"2026-08-14T15:42:03.3692711+00:00","affected":[{"ecosystem":"Go","name":"github.com/ncw/rclone","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.48.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/rclone/rclone","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.49.0"},{"kind":"fixed","version":"1.73.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/rclone/rclone/security/advisories/GHSA-jfwf-28xr-xw6q","https://github.com/rclone/rclone/commit/9e3e68d00c3ecf475a1432fc206400cfb4df7e3f","https://github.com/rclone/rclone/releases/tag/v1.73.5"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5466","license":"OSV · upstream source license applies","key":"osv:GO-2026-5466","identifiers":["GO-2026-5466","BIT-rclone-2026-41179","CVE-2026-41179","GHSA-jfwf-28xr-xw6q"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.2867767+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.2867777+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-24e910670d68255a90dfc1d94d37ac5394a0a43e960361a78142e746e5b8e0e9","complete":true,"records":425790,"lastAttemptAt":"2026-11-15T13:01:16.7308429+00:00","lastSuccessAt":"2026-11-15T13:01:16.7018281+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:16.7308429+00:00","snapshotPublishedAt":"2026-11-15T12:22:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47f38f0996d04d31b51da25d0a0d9bc1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T13:17:28.4296709+00:00","lastSuccessAt":"2026-11-15T13:17:28.424+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:17:28.424+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13628,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.3027206+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.3027219+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-00496e381624434cb51cd6ee97f87d5f","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T13:02:04.5706057+00:00","lastSuccessAt":"2026-11-15T13:02:04.555+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:02:04.555+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T13:01:38.1237717+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:38.1237717+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T13:01:22.067621+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:22.067621+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T13:01:41.1317031+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:41.1317031+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T13:01:28.8971106+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:28.8971106+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}