{"id":"GHSA-f6ww-3ggp-fr8h","revision":null,"records":[{"revision":"328ece88c1d14781baa005bea63368af","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41674","aliases":[],"title":"xmldom: XML injection through unvalidated DocumentType serialization","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","state":0,"publishedAt":"2026-05-07T03:47:51.14+00:00","modifiedAt":"2026-09-10T12:05:00.67+00:00","affected":[{"ecosystem":"Vendor product","name":"xmldom","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"xmldom\",\n                    \"product\": \"xmldom\",\n                    \"versions\": [\n                        {\n                            \"version\": \"xmldom <= 0.6.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"@xmldom/xmldom >= 0.9.0, < 0.9.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"@xmldom/xmldom < 0.8.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h","https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41674","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41674","identifiers":["CVE-2026-41674"]},"retained":false,"historicalAffected":[]},{"revision":"eb94ec7fbdf649e782b67e3f140ff729","observedAt":"2026-11-15T14:05:54.911+00:00","statement":{"source":"euvd","id":"EUVD-2026-28289","aliases":["CVE-2026-41674","GHSA-f6ww-3ggp-fr8h"],"title":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node…","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h","https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28289","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 7, 2026, 3:47:51 AM","dateUpdated":"Sep 10, 2026, 12:05:00 PM"},"relatedAdvisories":[{"id":"RHSA-2026:26234","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.5 release.","vulnerabilityIds":["CVE-2026-6321","CVE-2026-6322","CVE-2026-24781","CVE-2026-32281","CVE-2026-41242","CVE-2026-41672","CVE-2026-41673","CVE-2026-41674","CVE-2026-41675","CVE-2026-44293"]},{"id":"RHSA-2026:20034","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.17 bug fix and security update","vulnerabilityIds":["CVE-2025-58183","CVE-2026-29063","CVE-2026-33186","CVE-2026-34986","CVE-2026-35469","CVE-2026-41674"]},{"id":"RHSA-2026:21338","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.7 release.","vulnerabilityIds":["CVE-2026-6321","CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-40895","CVE-2026-41240","CVE-2026-41242","CVE-2026-41674","CVE-2026-42033","CVE-2026-42035","CVE-2026-42039","CVE-2026-42041","CVE-2026-42043","CVE-2026-42044"]},{"id":"msrc_CVE-2026-41674","title":"xmldom: XML injection through unvalidated DocumentType serialization","vulnerabilityIds":["CVE-2026-41674"]},{"id":"WID-SEC-W-2026-1833","title":"IBM App Connect Enterprise (basic-ftp, xmldom): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-39983","CVE-2026-41324","CVE-2026-41672","CVE-2026-41673","CVE-2026-41674","CVE-2026-41675"]},{"id":"RHSA-2026:21703","title":"Red Hat Security Advisory: OpenShift Container Platform 4.20.24 bug fix and security update","vulnerabilityIds":["CVE-2026-26996","CVE-2026-29063","CVE-2026-33186","CVE-2026-34986","CVE-2026-41674"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28289","identifiers":["EUVD-2026-28289","CVE-2026-41674","GHSA-f6ww-3ggp-fr8h"]},"retained":false,"historicalAffected":[]},{"revision":"10e5f0df087f4168bba8b6df079ef81f","observedAt":"2026-10-25T09:17:41.905+00:00","statement":{"source":"nvd","id":"CVE-2026-41674","aliases":[],"title":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node…","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","state":0,"publishedAt":"2026-05-07T04:16:33.433+00:00","modifiedAt":"2026-09-10T13:20:02.843+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h","https://access.redhat.com/errata/RHSA-2026:20034","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21703","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/security/cve/CVE-2026-41674","https://bugzilla.redhat.com/show_bug.cgi?id=2467620","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41674.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41674","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-91"],"productCriteria":[],"sourceDates":{"published":"2026-05-07T04:16:33.433","lastModified":"2026-09-10T13:20:02.843"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41674","identifiers":["CVE-2026-41674"]},"retained":false,"historicalAffected":[]},{"revision":"f39538a6935041039339d69149b14d78","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-f6ww-3ggp-fr8h","aliases":["CVE-2026-41674"],"title":"xmldom has XML injection through unvalidated DocumentType serialization","description":"## Summary\n\nThe package serializes `DocumentType` node fields (`internalSubset`, `publicId`, `systemId`) verbatim\nwithout any escaping or validation. When these fields are set programmatically to attacker-controlled\nstrings, `XMLSerializer.serializeToString` can produce output where the DOCTYPE declaration is\nterminated early and arbitrary markup appears outside it.\n\n---\n\n## Details\n\n`DOMImplementation.createDocumentType(qualifiedName, publicId, systemId, internalSubset)` validates\nonly `qualifiedName` against the XML QName production. The remaining three arguments are stored\nas-is with no validation.\n\nThe XMLSerializer emits `DocumentType` nodes as:\n\n```\n<!DOCTYPE name[ PUBLIC pubid][ SYSTEM sysid][ [internalSubset]]>\n```\n\nAll fields are pushed into the output buffer verbatim — no escaping, no quoting added.\n\n**`internalSubset` injection:** The serializer wraps `internalSubset` with ` [` and `]`. A value\ncontaining `]>` closes the internal subset and the DOCTYPE declaration at the injection point.\nAny content after `]>` in `internalSubset` appears outside the DOCTYPE in the serialized output as\nraw XML markup. Reported by @TharVid (GHSA-f6ww-3ggp-fr8h). Affected: `@xmldom/xmldom` ≥ 0.9.0\nvia `createDocumentType` API; 0.8.x only via direct property write.\n\n**`publicId` injection:** The serializer emits `publicId` verbatim after `PUBLIC` with no\nquoting added. A value containing an injected system identifier (e.g.,\n`\"pubid\" SYSTEM \"evil\"`) breaks the intended quoting context, injecting a fake SYSTEM entry\ninto the serialized DOCTYPE declaration. Identified during internal security research. Affected:\nboth branches, all versions back to 0.1.0.\n\n**`systemId` injection:** The serializer emits `systemId` verbatim. A value containing `>`\nterminates the DOCTYPE declaration early; content after `>` appears as raw XML markup outside\nthe DOCTYPE context. Identified during internal security research. Affected: both branches, all\nversions back to 0.1.0.\n\nThe parse path is safe: the SAX parser enforces the `PubidLiteral` and `SystemLiteral` grammar\nproductions, which exclude the relevant characters, and the internal subset parser only accepts a\nsubset it can structurally validate. The vulnerability is reachable only through programmatic\n`createDocumentType` calls with attacker-controlled arguments.\n\n---\n\n## Affected code\n\n**`lib/dom.js` — `createDocumentType` (lines 898–910):**\n\n```js\ncreateDocumentType: function (qualifiedName, publicId, systemId, internalSubset) {\n    validateQualifiedName(qualifiedName);          // only qualifiedName is validated\n    var node = new DocumentType(PDC);\n    node.name = qualifiedName;\n    node.nodeName = qualifiedName;\n    node.publicId = publicId || '';               // stored verbatim\n    node.systemId = systemId || '';               // stored verbatim\n    node.internalSubset = internalSubset || '';   // stored verbatim\n    node.childNodes = new NodeList();\n    return node;\n},\n```\n\n**`lib/dom.js` — serializer DOCTYPE case (lines 2948–2964):**\n\n```js\ncase DOCUMENT_TYPE_NODE:\n    var pubid = node.publicId;\n    var sysid = node.systemId;\n    buf.push(g.DOCTYPE_DECL_START, ' ', node.name);\n    if (pubid) {\n        buf.push(' ', g.PUBLIC, ' ', pubid);\n        if (sysid && sysid !== '.') {\n            buf.push(' ', sysid);\n        }\n    } else if (sysid && sysid !== '.') {\n        buf.push(' ', g.SYSTEM, ' ', sysid);\n    }\n    if (node.internalSubset) {\n        buf.push(' [', node.internalSubset, ']');  // internalSubset emitted verbatim\n    }\n    buf.push('>');\n    return;\n```\n\n---\n\n## PoC\n\n### internalSubset injection\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst impl = new DOMImplementation();\nconst doctype = impl.createDocumentType(\n    'root',\n    '',\n    '',\n    ']><injected/><![CDATA['\n);\nconst doc = impl.createDocument(null, 'root', doctype);\nconst xml = new XMLSerializer().serializeToString(doc);\nconsole.log(xml);\n// <!DOCTYPE root []><injected/><![CDATA[]><root/>\n//                   ^^^^^^^^^^  injected element outside DOCTYPE\n```\n\n### publicId quoting context break\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst impl = new DOMImplementation();\nconst doctype = impl.createDocumentType(\n    'root',\n    '\"injected PUBLIC_ID\" SYSTEM \"evil\"',\n    '',\n    ''\n);\nconst doc = impl.createDocument(null, 'root', doctype);\nconsole.log(new XMLSerializer().serializeToString(doc));\n// <!DOCTYPE root PUBLIC \"injected PUBLIC_ID\" SYSTEM \"evil\"><root/>\n// quoting context broken — SYSTEM entry injected\n```\n\n### systemId injection\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst impl = new DOMImplementation();\nconst doctype = impl.createDocumentType(\n    'root',\n    '',\n    '\"sysid\"><injected attr=\"pwn\"/>',\n    ''\n);\nconst doc = impl.createDocument(null, 'root', doctype);\nconsole.log(new XMLSerializer().serializeToString(doc));\n// <!DOCTYPE root SYSTEM \"sysid\"><injected attr=\"pwn\"/>><root/>\n// > in sysid closes DOCTYPE early; <injected/> appears as sibling element\n```\n\n---\n\n## Impact\n\nAn application that programmatically constructs `DocumentType` nodes from user-controlled data and\nthen serializes the document can emit a DOCTYPE declaration where the internal subset is closed\nearly or where injected SYSTEM entities or other declarations appear in the serialized output.\n\nDownstream XML parsers that re-parse the serialized output and expand entities from the injected\nDOCTYPE declarations may be susceptible to XXE-class attacks if they enable entity expansion.\n\n---\n\n## Fix Applied\n\n> **⚠ Opt-in required.** Protection is not automatic. Existing serialization calls remain\n> vulnerable unless `{ requireWellFormed: true }` is explicitly passed. Applications that pass\n> untrusted data to `createDocumentType()` or write untrusted values directly to a\n> `DocumentType` node's `publicId`, `systemId`, or `internalSubset` properties should audit\n> all `serializeToString()` call sites and add the option.\n\n`XMLSerializer.serializeToString()` now accepts an options object as a second argument. When `{ requireWellFormed: true }` is passed, the serializer validates the `DocumentType` node's `publicId`, `systemId`, and `internalSubset` fields before emitting the DOCTYPE declaration and throws `InvalidStateError` if any field contains an injection sequence:\n\n- **`publicId`**: throws if non-empty and does not match the XML `PubidLiteral` production (XML 1.0 [12])\n- **`systemId`**: throws if non-empty and does not match the XML `SystemLiteral` production (XML 1.0 [11])\n- **`internalSubset`**: throws if it contains `]>` (which closes the internal subset and DOCTYPE declaration early)\n\nAll three checks apply regardless of how the invalid value entered the node — whether via `createDocumentType` arguments or a subsequent direct property write.\n\n### PoC — fixed path\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\nconst impl = new DOMImplementation();\n\n// internalSubset injection\nconst dt1 = impl.createDocumentType('root', '', '', ']><injected/><![CDATA[');\nconst doc1 = impl.createDocument(null, 'root', dt1);\n\n// Default (unchanged): verbatim — injection present\nconsole.log(new XMLSerializer().serializeToString(doc1));\n// <!DOCTYPE root []><injected/><![CDATA[]><root/>\n\n// Opt-in guard: throws InvalidStateError\ntry {\n  new XMLSerializer().serializeToString(doc1, { requireWellFormed: true });\n} catch (e) {\n  console.log(e.name, e.message);\n  // InvalidStateError: DocumentType internalSubset contains \"]>\"\n}\n```\n\nThe guard also covers post-creation property writes:\n\n```js\nconst dt2 = impl.createDocumentType('root', '', '');\ndt2.systemId = '\"sysid\"><injected attr=\"pwn\"/>';\nconst doc2 = impl.createDocument(null, 'root', dt2);\nnew XMLSerializer().serializeToString(doc2, { requireWellFormed: true });\n// InvalidStateError: DocumentType systemId is not a valid SystemLiteral\n```\n\n### Why the default stays verbatim\n\nThe W3C DOM Parsing and Serialization spec §3.2.1.3 defines a `require well-formed` flag whose **default value is `false`**. With the flag unset, the spec permits verbatim serialization of DOCTYPE fields. Unconditionally throwing would be a behavioral breaking change with no spec justification. The opt-in `requireWellFormed: true` flag allows applications that require injection safety to enable strict mode without breaking existing deployments.\n\n### Residual limitation\n\n`createDocumentType(qualifiedName, publicId, systemId[, internalSubset])` does not validate `publicId`, `systemId`, or `internalSubset` at creation time. This creation-time validation is a breaking change and is deferred to a future breaking release.\n\nWhen the default serialization path is used (without `requireWellFormed: true`), all three fields are still emitted verbatim. Applications that do not pass `requireWellFormed: true` remain exposed.","state":0,"publishedAt":"2026-04-22T20:19:12+00:00","modifiedAt":"2026-09-10T03:50:44.09361+00:00","affected":[{"ecosystem":"npm","name":"@xmldom/xmldom","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.8.13"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@xmldom/xmldom","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.9.0"},{"kind":"fixed","version":"0.9.10"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"xmldom","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h","https://nvd.nist.gov/vuln/detail/CVE-2026-41674","https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314","https://github.com/xmldom/xmldom","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"sourceUrl":"https://github.com/advisories/GHSA-f6ww-3ggp-fr8h","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f6ww-3ggp-fr8h","identifiers":["GHSA-f6ww-3ggp-fr8h","CVE-2026-41674"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T18:44:29.5338368+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T18:44:29.5338368+00:00","lastSuccessAt":"2026-11-15T18:44:29.78352+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.783521+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-b9fbd1daaa4463d210736a9586507854993056a11f4ff4425329364edc1bad1c","complete":true,"records":425838,"lastAttemptAt":"2026-11-15T18:44:28.9589827+00:00","lastSuccessAt":"2026-11-15T18:44:28.9300882+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:28.9589827+00:00","snapshotPublishedAt":"2026-11-15T18:19:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-690aaf2f7fdd47eaaa0e869ffa316905","complete":true,"records":13821,"lastAttemptAt":"2026-11-15T18:59:39.6961048+00:00","lastSuccessAt":"2026-11-15T18:59:39.692+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:59:39.692+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T18:44:29.5338368+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T18:44:29.5338368+00:00","lastSuccessAt":"2026-11-15T18:44:29.7845261+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.7845265+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-78486e6112e2477ab52683c61207b1f4","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T18:45:05.0249417+00:00","lastSuccessAt":"2026-11-15T18:45:05.012+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:45:05.012+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T18:44:29.2701797+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.2701797+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T18:44:29.0330557+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.0330557+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T18:44:29.2929405+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.2929405+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T18:44:29.1494018+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T18:44:29.1494018+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}