{"id":"GHSA-46r4-q7wv-32fc","revision":null,"records":[{"revision":"24cf19ec90a34e20badd5ddbab0084f7","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-113727","aliases":[],"title":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs","description":"OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.","state":0,"publishedAt":"2026-10-20T21:08:37.372+00:00","modifiedAt":"2026-10-23T02:10:59.28+00:00","affected":[{"ecosystem":"Vendor product","name":"openchoreo","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"openchoreo\",\n                    \"product\": \"openchoreo\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, < 1.0.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.1.0, < 1.1.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.2.0, < 1.2.5\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","score":7.4,"severity":"HIGH"}],"references":["https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc","https://github.com/openchoreo/openchoreo/pull/4596","https://github.com/openchoreo/openchoreo/pull/4618","https://github.com/openchoreo/openchoreo/pull/4626","https://github.com/openchoreo/openchoreo/pull/4627","https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca","https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb","https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14","https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426","https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6","https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7","https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113727","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-113727","identifiers":["CVE-2026-113727"]},"retained":false,"historicalAffected":[]},{"revision":"d2e98936a3b742508b5d85100c2d3b7a","observedAt":"2026-11-07T04:34:49.836+00:00","statement":{"source":"euvd","id":"EUVD-2026-105772","aliases":["CVE-2026-113727","GHSA-46r4-q7wv-32fc"],"title":"OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the su…","description":"OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","score":7.4,"severity":null}],"references":["https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc","https://github.com/openchoreo/openchoreo/pull/4596","https://github.com/openchoreo/openchoreo/pull/4618","https://github.com/openchoreo/openchoreo/pull/4626","https://github.com/openchoreo/openchoreo/pull/4627","https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca","https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb","https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14","https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426","https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6","https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7","https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105772","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 20, 2026, 9:08:37 PM","dateUpdated":"Oct 23, 2026, 2:10:59 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-105772","identifiers":["EUVD-2026-105772","CVE-2026-113727","GHSA-46r4-q7wv-32fc"]},"retained":false,"historicalAffected":[]},{"revision":"26227574576d47c88f9119063b4c46c5","observedAt":"2026-10-25T05:17:18.597+00:00","statement":{"source":"nvd","id":"CVE-2026-113727","aliases":[],"title":"OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the su…","description":"OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored WorkflowRun by the URL path. An authenticated caller with workflowrun:update for one project or component in the same namespace can name another run in the path, submit ownership labels for a scope they control, and rewrite the victim run's ownership labels. Subsequent authorization then treats the attacker as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or place the run into a permanent ComponentValidationFailed state. The namespace comes from the URL, so the issue is cross-project or cross-component within one namespace and is not anonymously reachable or cross-tenant. This issue is fixed in 1.0.6, 1.1.7, and 1.2.5.","state":0,"publishedAt":"2026-10-20T22:19:29.57+00:00","modifiedAt":"2026-10-23T03:16:31.367+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","score":7.4,"severity":"HIGH"}],"references":["https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca","https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb","https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14","https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426","https://github.com/openchoreo/openchoreo/pull/4596","https://github.com/openchoreo/openchoreo/pull/4618","https://github.com/openchoreo/openchoreo/pull/4626","https://github.com/openchoreo/openchoreo/pull/4627","https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6","https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7","https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5","https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-113727","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-639"],"productCriteria":[],"sourceDates":{"published":"2026-10-20T22:19:29.570","lastModified":"2026-10-23T03:16:31.367"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-113727","identifiers":["CVE-2026-113727"]},"retained":false,"historicalAffected":[]},{"revision":"bc25189d48bb4cd5be48a35e1bab5589","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-46r4-q7wv-32fc","aliases":["CVE-2026-113727","GO-2026-6825"],"title":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs","description":"## Summary\n\nThe OpenChoreo API server authorized `PUT .../workflowruns/{runName}` against ownership metadata taken from the request body, while the object it actually mutated was selected by the URL path. Nothing forced the two to agree.\n\nA `WorkflowRun`'s membership in a project and component is carried entirely by its `openchoreo.dev/project` and `openchoreo.dev/component` labels. Because the `workflowrun:update` check read those labels from the submitted object rather than the stored one, a caller holding `workflowrun:update` on one component could name a run belonging to a different project or component in the URL, supply labels for the component they legitimately control, pass the check, and have the unrelated run rewritten with their own ownership labels.\n\nThe namespace is taken from the URL and feeds both the authorization check and the Kubernetes read, so it cannot diverge. This is cross-project and cross-component escalation inside a single namespace, not a cross-tenant issue.\n\n## Impact\n\nRewriting the ownership labels transfers authority over the run. Every other WorkflowRun check (view, logs, events, status, delete, list) derives its scope from the stored labels, so once the write lands the policy engine legitimately grants the attacker access to an object they never had rights to. They can then:\n\n- Read the victim's build logs. These stream raw pod logs from the workflow plane and routinely carry source paths, registry destinations, and credentials a build step echoed by accident.\n- Read the run's Kubernetes events.\n- Delete the run.\n\nSo the primary impact is confidentiality and availability, not only integrity. On the integrity side, `spec.workflow.parameters` can be overwritten on a pending run, and manipulating the two ownership labels can either wedge the run in a permanent `ComponentValidationFailed` condition or downgrade it to a standalone run that skips component validation.\n\nExploitation requires an authenticated caller with an `AuthzRoleBinding` or `ClusterAuthzRoleBinding` granting `workflowrun:update` at project or component scope in the victim's namespace, plus knowledge of the target run's name. An anonymous caller cannot reach this.\n\n## Patches\n\nThe authorization check now loads the stored WorkflowRun and derives every ownership attribute from it instead of from the request body. Separately, the `openchoreo.dev/project` and `openchoreo.dev/component` labels are now immutable on update, so an authorized caller cannot hand their own run to another project either.\n\n| Line | Affected | Fixed in |\n|---|---|---|\n| 1.0.x | 1.0.0 through 1.0.5 | 1.0.6 |\n| 1.1.x | 1.1.0 through 1.1.6 | 1.1.7 |\n| 1.2.x | 1.2.0 through 1.2.4 | 1.2.5 |\n\nUpgrade to the patched release on your line. No configuration change is needed after upgrading.\n\n## Workarounds\n\nIf you cannot upgrade immediately, restrict who holds `workflowrun:update`.\n\nAudit your `AuthzRole` and `ClusterAuthzRole` definitions for that action and remove it from any role granted to principals you would not trust with write access to every workflow run in the namespace. Among the roles shipped with OpenChoreo, only the system role `workload-publisher` lists `workflowrun:update` explicitly, and `admin` holds it through its `*` wildcard. Custom roles in your own values file may also include it, so check those.\n\nTreat any credential bound to `workload-publisher` as privileged. CI systems are the usual holder, and a leaked CI token is enough to run this.","state":0,"publishedAt":"2026-10-21T16:29:53+00:00","modifiedAt":"2026-11-05T23:26:14.3952644+00:00","affected":[{"ecosystem":"Go","name":"github.com/openchoreo/openchoreo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.0.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/openchoreo/openchoreo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.1.0"},{"kind":"fixed","version":"1.1.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/openchoreo/openchoreo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.0"},{"kind":"fixed","version":"1.2.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc","https://nvd.nist.gov/vuln/detail/CVE-2026-113727","https://github.com/openchoreo/openchoreo/pull/4596","https://github.com/openchoreo/openchoreo/pull/4618","https://github.com/openchoreo/openchoreo/pull/4626","https://github.com/openchoreo/openchoreo/pull/4627","https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca","https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb","https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14","https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426","https://github.com/openchoreo/openchoreo","https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6","https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7","https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"],"sourceUrl":"https://github.com/advisories/GHSA-46r4-q7wv-32fc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-46r4-q7wv-32fc","identifiers":["GHSA-46r4-q7wv-32fc","CVE-2026-113727","GO-2026-6825"]},"retained":false,"historicalAffected":[]},{"revision":"3fc48dab8d0244249f46705e878e6c69","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6825","aliases":["CVE-2026-113727","GHSA-46r4-q7wv-32fc"],"title":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo","description":"OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs in github.com/openchoreo/openchoreo","state":0,"publishedAt":"2026-11-05T22:54:05+00:00","modifiedAt":"2026-11-05T23:15:12.7977975+00:00","affected":[{"ecosystem":"Go","name":"github.com/openchoreo/openchoreo","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.0.6"},{"kind":"introduced","version":"1.1.0"},{"kind":"fixed","version":"1.1.7"},{"kind":"introduced","version":"1.2.0"},{"kind":"fixed","version":"1.2.5"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/openchoreo/openchoreo/security/advisories/GHSA-46r4-q7wv-32fc","https://nvd.nist.gov/vuln/detail/CVE-2026-113727","https://github.com/openchoreo/openchoreo/commit/0e311468bb704b0dce7753b89c9d0204009285ca","https://github.com/openchoreo/openchoreo/commit/477031c6fece0666f144942fb02c0b579dacc0bb","https://github.com/openchoreo/openchoreo/commit/91e1e868eb8e0e67274109018d00a767b22eda14","https://github.com/openchoreo/openchoreo/commit/d5ed0ef62d9c9af7b05a72aed2bcbc0ac9d45426","https://github.com/openchoreo/openchoreo/pull/4596","https://github.com/openchoreo/openchoreo/pull/4618","https://github.com/openchoreo/openchoreo/pull/4626","https://github.com/openchoreo/openchoreo/pull/4627","https://github.com/openchoreo/openchoreo/releases/tag/v1.0.6","https://github.com/openchoreo/openchoreo/releases/tag/v1.1.7","https://github.com/openchoreo/openchoreo/releases/tag/v1.2.5"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6825","license":"OSV · upstream source license applies","key":"osv:GO-2026-6825","identifiers":["GO-2026-6825","CVE-2026-113727","GHSA-46r4-q7wv-32fc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0239033+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0239043+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-83dbcd705162368a7389ef21c7d5877b90bc9ecd8679671f4b5e02683a8e1d4f","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T06:06:40.5628876+00:00","lastSuccessAt":"2026-11-08T06:06:40.5495855+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.5628876+00:00","snapshotPublishedAt":"2026-11-08T05:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T06:07:06.8623217+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0246874+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0246876+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f61a222d691b4992bb1403f1a88575db","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T06:07:06.2347163+00:00","lastSuccessAt":"2026-11-08T06:07:06.231+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:07:06.231+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T06:06:40.830411+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.830411+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T06:06:40.6194681+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.6194681+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T06:06:40.8424247+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.8424247+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T06:06:40.7260451+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.7260451+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}