{"id":"EUVD-2026-60971","revision":null,"records":[{"revision":"e33cdec7efcc42deb98c8b1ba19e5fc6","observedAt":"2026-10-29T22:48:55.035+00:00","statement":{"source":"cve-program","id":"CVE-2026-75913","aliases":[],"title":"CodeWhale before 0.8.64 Argument Injection via git_show","description":"CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in codewhale / codewhale-tui 0.8.64 by adding rev validation; the deprecated deepseek-tui crate has no fixed release.","state":0,"publishedAt":"2026-08-18T15:22:01.505+00:00","modifiedAt":"2026-10-29T21:16:54.792+00:00","affected":[{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.3.27\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThanOrEqual\": \"0.8.41\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.3.27\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.41\"\n                        },\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/codewhale-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/codewhale\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","score":8.5,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-7j5w-7r7x-9v27","https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020","https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-show"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75913","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-75913","identifiers":["CVE-2026-75913"]},"retained":false,"historicalAffected":[]},{"revision":"ae7417a388754ab5952139a790483f02","observedAt":"2026-11-05T13:43:44.252+00:00","statement":{"source":"euvd","id":"EUVD-2026-60971","aliases":["CVE-2026-75913","GHSA-7j5w-7r7x-9v27"],"title":"CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability …","description":"CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in codewhale / codewhale-tui 0.8.64 by adding rev validation; the deprecated deepseek-tui crate has no fixed release.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","score":8.5,"severity":null}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-7j5w-7r7x-9v27","https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020","https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-show"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60971","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 3:22:01 PM","dateUpdated":"Oct 29, 2026, 9:16:54 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60971","identifiers":["EUVD-2026-60971","CVE-2026-75913","GHSA-7j5w-7r7x-9v27"]},"retained":false,"historicalAffected":[]},{"revision":"141b0fde994d4eb39cedc9a4016bd92a","observedAt":"2026-10-31T19:04:57.61+00:00","statement":{"source":"nvd","id":"CVE-2026-75913","aliases":[],"title":"CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability …","description":"CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in codewhale / codewhale-tui 0.8.64 by adding rev validation; the deprecated deepseek-tui crate has no fixed release.","state":0,"publishedAt":"2026-08-18T16:18:23.363+00:00","modifiedAt":"2026-10-29T21:17:33.277+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.5,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020","https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-7j5w-7r7x-9v27","https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-show"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75913","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-73"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T16:18:23.363","lastModified":"2026-10-29T21:17:33.277"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-75913","identifiers":["CVE-2026-75913"]},"retained":false,"historicalAffected":[]},{"revision":"f5d507144d884fdb87796113b66d1019","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-7j5w-7r7x-9v27","aliases":["CVE-2026-75913"],"title":"CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval","description":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 9a34b5034d29f05d1f28fa61b04719ca6a741020. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n# Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval\n\n## Overview\n\nThe `git_show` tool in DeepSeek-TUI executes `git show` with the model-supplied `rev` parameter passed unvalidated into the argv. `git show` honours the `--output=<path>` option, so a `rev` value beginning with `--output=` is interpreted as a flag rather than a revision. The tool is registered with `ApprovalRequirement::Auto` and declares `ToolCapability::ReadOnly`, so the write happens without a user prompt and contradicts the capability the catalog advertises to the model and the user.\n\nThis is the same vulnerability class as GHSA-72w5-pf8h-xfp4 (CVE-2026-45374): an auto-approved tool produces an effect outside the boundary the user consented to.\n\n## Impact\n\nA malicious repository combined with prompt injection, the threat model already documented in CVE-2026-45311 (auto-loaded `AGENTS.md` is treated as instructions by the model) yields an unprompted arbitrary file write at the privilege of the user running DeepSeek-TUI.\n\nUseful targets reachable as the invoking user:\n\n- `~/.ssh/authorized_keys`\n- `~/.bashrc`, `~/.zshrc`, `~/.profile`\n- `~/.gitconfig` (chainable into RCE via `core.editor`)\n- `~/.config/**`, `~/.aws/credentials`, project source files\n\nThe written content is the `git show` rendering of HEAD commit hash, author/date header, indented commit message, and (when `patch=true`) diff hunks. The commit subject, body, author identity, and diff text are entirely attacker-controlled because the attacker owns the repository HEAD. The leading `commit <hash>` line prevents clean overwrite of formats that reject unknown tokens, but is silently ignorable in files parsed as comments-or-text (crontab, dotfiles consumed by tolerant readers) and is irrelevant for the destructive/DoS sub-case (clobbering `~/.ssh/authorized_keys` locks the user out; clobbering a project file corrupts source).\n\n## Technical Details\n\n### Root Cause\n\n`crates/tui/src/tools/git_history.rs`:\n\n```rust\n// L196-198\nfn approval_requirement(&self) -> ApprovalRequirement {\n    ApprovalRequirement::Auto\n}\n\n// L204-228 (excerpt)\nasync fn execute(&self, input: Value, context: &ToolContext) -> Result<ToolResult, ToolError> {\n    let rev = required_str(&input, \"rev\")?;\n    ...\n    let mut args = vec![\n        \"show\".to_string(),\n        \"--no-color\".to_string(),\n        \"--no-ext-diff\".to_string(),\n    ];\n    if patch { args.push(format!(\"--unified={unified}\")); }\n    else     { args.push(\"--no-patch\".to_string()); }\n    if stat  { args.push(\"--stat\".to_string()); }\n    args.push(rev.to_string());        // unvalidated, no `--end-of-options` sentinel\n    ...\n}\n```\n\nThe JSON schema for `rev` is `{\"type\": \"string\"}` (L161-164) with no `pattern`, no enum, and no length cap. `required_str` performs no semantic validation. The argv has no `--end-of-options` separator between the trailing options and `rev`, so git's option parser keeps consuming flags from `rev`.\n\nThe same pattern in `git_blame` (L322-388) is tracked in a separate advisory.\n\n### Why `--output` Works\n\n`git show` shares its option parser with `git log` / `git diff`, which expose `--output=<file>`. The implementation opens the path with `O_WRONLY | O_CREAT | O_TRUNC` and writes the formatted output there. No permission check beyond the filesystem's own running as the user is sufficient to clobber anything the user owns.\n\n## Proof of Concept\n\nThe vulnerable argv assembled by the tool when invoked with\n`{\"rev\": \"--output=/home/victim/.bashrc\"}` is equivalent to:\n\n```\ngit show --no-color --no-ext-diff --no-patch --stat --output=/home/victim/.bashrc\n```\n\nReproduced against system `git` as a non-root user:\n\n```\n$ id\nuid=1001(lowtest) gid=1001(lowtest) groups=1001(lowtest)\n\n$ cd /tmp/lp && git init -q\n$ echo a > a.txt && git add a.txt\n$ git -c user.email=a@b -c user.name=a commit -q -m \"lol\"\n\n$ git show --no-color --no-patch \"--output=/home/lowtest/.bashrc_clobbered\" HEAD\n$ ls -la /home/lowtest/.bashrc_clobbered\n-rw-rw-r-- 1 lowtest lowtest 128 May 19 07:05 /home/lowtest/.bashrc_clobbered\n```\n\nEnd-to-end exploitation path:\n\n- Attacker publishes a repository whose `AGENTS.md` instructs the model to call `git_show` with `rev` set to a crafted `--output=` string targeting a file in the victim's home directory. The same auto-load pathway documented in CVE-2026-45311 applies.\n- Victim opens the repository in DeepSeek-TUI and issues any prompt that exercises the agent loop.\n- The model issues the tool call. Because `approval_requirement()` returns `Auto`, no approval UI is shown.\n- `git show --output=<path>` overwrites the target file with attacker-controlled commit metadata and diff text.\n\n## Remediation\n\nTwo changes in `crates/tui/src/tools/git_history.rs`:\n\nInsert an end-of-options sentinel before `rev` so git stops parsing flags:\n\n   ```rust\n   args.push(\"--end-of-options\".to_string());\n   args.push(rev.to_string());\n   ```\n\nReject `rev` values that begin with `-` (or restrict to a revision-shape\n   regex `^[A-Za-z0-9._/^~@:{}-]+$` after the leading character check):\n\n   ```rust\n   if rev.starts_with('-') {\n       return Err(ToolError::invalid_input(\"rev must not start with '-'\"));\n   }\n   ```\n\nA regression test mirroring `run_tests_requires_user_approval` (`test_runner.rs:197`) should assert that `rev = \"--output=/tmp/x\"` is rejected.","state":0,"publishedAt":"2026-09-04T18:02:37+00:00","modifiedAt":"2026-09-04T19:00:04.282033+00:00","affected":[{"ecosystem":"crates.io","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.3.27"},{"kind":"last_affected","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.3.27"},{"kind":"fixed","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"codewhale-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"codewhale","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-7j5w-7r7x-9v27","https://nvd.nist.gov/vuln/detail/CVE-2026-75913","https://github.com/Hmbown/CodeWhale/commit/9a34b5034d29f05d1f28fa61b04719ca6a741020","https://github.com/Hmbown/CodeWhale","https://www.vulncheck.com/advisories/codewhale-before-argument-injection-via-git-show"],"sourceUrl":"https://github.com/advisories/GHSA-7j5w-7r7x-9v27","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7j5w-7r7x-9v27","identifiers":["GHSA-7j5w-7r7x-9v27","CVE-2026-75913"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T04:26:54.6034598+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T04:26:54.6034598+00:00","lastSuccessAt":"2026-11-07T04:26:54.7529863+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.7529874+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-f2cb380904b5f12493f409ae3c6d6c9a507fe9d31e15cd21f0d0b573e613fef1","complete":true,"records":420500,"lastAttemptAt":"2026-11-07T04:26:54.1988994+00:00","lastSuccessAt":"2026-11-07T03:26:58.5714293+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.1988994+00:00","snapshotPublishedAt":"2026-11-07T03:24:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-715c0f3771e44acaadcabfd22fd19b53","complete":true,"records":13630,"lastAttemptAt":"2026-11-07T04:38:26.5467121+00:00","lastSuccessAt":"2026-11-07T04:38:26.542+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:38:26.542+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T04:26:54.6034598+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T04:26:54.6034598+00:00","lastSuccessAt":"2026-11-07T04:26:54.7537548+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.7537551+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-34343b4ea57e47c5a482c8fcf20a381e","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T04:26:55.2642231+00:00","lastSuccessAt":"2026-11-07T01:26:55.938+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:55.938+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T04:26:54.5521252+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.5521252+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T04:26:54.3450753+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.3450753+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T04:26:54.565066+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.565066+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T04:26:54.4507985+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T04:26:54.4507985+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}