{"id":"GHSA-j759-j44w-7fr8","revision":null,"records":[{"revision":"22890094281d4c71af4311116d0bc177","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41672","aliases":[],"title":"xmldom: XML node injection through unvalidated comment serialization","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","state":0,"publishedAt":"2026-05-07T03:36:16.914+00:00","modifiedAt":"2026-08-28T12:04:23.913+00:00","affected":[{"ecosystem":"Vendor product","name":"xmldom","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"xmldom\",\n                    \"product\": \"xmldom\",\n                    \"versions\": [\n                        {\n                            \"version\": \"xmldom <= 0.6.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"@xmldom/xmldom >= 0.9.0, < 0.9.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"@xmldom/xmldom < 0.8.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8","https://github.com/xmldom/xmldom/pull/987","https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7","https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41672","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41672","identifiers":["CVE-2026-41672"]},"retained":false,"historicalAffected":[]},{"revision":"58e78fbddfcb4162a8916eecab3c72ab","observedAt":"2026-11-13T13:08:38.574+00:00","statement":{"source":"euvd","id":"EUVD-2026-28285","aliases":["CVE-2026-41672","GHSA-j759-j44w-7fr8"],"title":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled c…","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8","https://github.com/xmldom/xmldom/pull/987","https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7","https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28285","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 7, 2026, 3:36:16 AM","dateUpdated":"Aug 28, 2026, 12:04:23 PM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-41672","title":"xmldom: XML node injection through unvalidated comment serialization","vulnerabilityIds":["CVE-2026-41672"]},{"id":"RHSA-2026:60520","title":"Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-66471","CVE-2025-66626","CVE-2025-71329","CVE-2025-71330","CVE-2026-0545","CVE-2026-2614","CVE-2026-5241","CVE-2026-5422","CVE-2026-6322","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-12243","CVE-2026-12481","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-13717","CVE-2026-14450","CVE-2026-15154","CVE-2026-15218","CVE-2026-15378","CVE-2026-15467","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-18948","CVE-2026-18951","CVE-2026-18982","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32283","CVE-2026-33079","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-35397","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-40171","CVE-2026-41672","CVE-2026-41673","CVE-2026-41675","CVE-2026-42211","CVE-2026-42215","CVE-2026-42264","CVE-2026-42266","CVE-2026-42284","CVE-2026-42305","CVE-2026-42311","CVE-2026-42338","CVE-2026-42342","CVE-2026-42499","CVE-2026-42502","CVE-2026-42508","CVE-2026-42557","CVE-2026-44017","CVE-2026-44018","CVE-2026-44020","CVE-2026-44240","CVE-2026-44244","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-44293","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44513","CVE-2026-44660","CVE-2026-44705","CVE-2026-44724","CVE-2026-44727","CVE-2026-44827","CVE-2026-44843","CVE-2026-45292","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-45804","CVE-2026-46595","CVE-2026-46597","CVE-2026-46625","CVE-2026-47214","CVE-2026-48526","CVE-2026-48710","CVE-2026-48712","CVE-2026-48779","CVE-2026-48801","CVE-2026-49476","CVE-2026-49477","CVE-2026-49851","CVE-2026-49978","CVE-2026-50193","CVE-2026-53550","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-54293","CVE-2026-55379","CVE-2026-55380","CVE-2026-55685","CVE-2026-56121","CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211","CVE-2026-58049","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-64835","CVE-2026-64849","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244"]},{"id":"RHSA-2026:26234","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.5 release.","vulnerabilityIds":["CVE-2026-6321","CVE-2026-6322","CVE-2026-24781","CVE-2026-32281","CVE-2026-41242","CVE-2026-41672","CVE-2026-41673","CVE-2026-41674","CVE-2026-41675","CVE-2026-44293"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28285","identifiers":["EUVD-2026-28285","CVE-2026-41672","GHSA-j759-j44w-7fr8"]},"retained":false,"historicalAffected":[]},{"revision":"ad38047c77d04faa8bc229d745488f45","observedAt":"2026-10-25T09:17:41.905+00:00","statement":{"source":"nvd","id":"CVE-2026-41672","aliases":[],"title":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled c…","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","state":0,"publishedAt":"2026-05-07T04:16:33.087+00:00","modifiedAt":"2026-08-28T16:17:57.72+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7","https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1","https://github.com/xmldom/xmldom/pull/987","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/security/cve/CVE-2026-41672","https://bugzilla.redhat.com/show_bug.cgi?id=2467631","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41672.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41672","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-91"],"productCriteria":[],"sourceDates":{"published":"2026-05-07T04:16:33.087","lastModified":"2026-08-28T16:17:57.720"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41672","identifiers":["CVE-2026-41672"]},"retained":false,"historicalAffected":[]},{"revision":"0c72aceb05e84cf09d1cb3c67d7a28e4","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-j759-j44w-7fr8","aliases":["CVE-2026-41672"],"title":"xmldom has XML node injection through unvalidated comment serialization","description":"## Summary\n\nThe package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output.\n\n---\n\n## Details\n\nThe issue is in the DOM construction and serialization flow for comment nodes.\n\nWhen `createComment(data)` is called, the supplied string is stored as comment data through the generic character-data handling path. That content is kept as-is. Later, when the document is serialized, the serializer writes comment nodes by concatenating the XML comment delimiters with the stored `node.data` value directly.\n\nThat behavior is unsafe because XML comments are a syntax-sensitive context. If attacker-controlled input contains a sequence that closes the comment, the serializer does not preserve it as literal comment text. Instead, it emits output where the remainder of the payload is treated as live XML markup.\n\nThis is a real injection bug, not a formatting issue. The serializer already applies context-aware handling in other places, such as escaping text nodes and rewriting unsafe CDATA terminators. Comment content does not receive equivalent treatment. Because of that gap, untrusted data can break out of the comment boundary and modify the structure of the final XML document.\n\n---\n\n## PoC\n\n```js\nconst { DOMImplementation, DOMParser, XMLSerializer } = require('@xmldom/xmldom');\n\nconst doc = new DOMImplementation().createDocument(null, 'root', null);\n\ndoc.documentElement.appendChild(\n  doc.createComment('--><injected attr=\"1\"/><!--')\n);\n\nconst xml = new XMLSerializer().serializeToString(doc);\nconsole.log(xml);\n// <root><!----><injected attr=\"1\"/><!----></root>\n\nconst reparsed = new DOMParser().parseFromString(xml, 'text/xml');\nconsole.log(reparsed.documentElement.childNodes.item(1).nodeName);\n// injected\n```\n\n---\n\n## Impact\n\nAn application that uses the package to build XML from untrusted input can be made to emit attacker-controlled elements outside the intended comment boundary. That allows the attacker to alter the meaning and structure of generated XML documents.\n\nIn practice, this can affect any workflow that generates XML and then stores it, forwards it, signs it, or hands it to another parser. Realistic targets include XML-based configuration, policy documents, and message formats where downstream consumers trust the serialized structure.\n\n---\n\n## Disclosure\n\nThis vulnerability was publicly disclosed at 2026-04-06T11:25:07Z via [xmldom/xmldom#987](https://github.com/xmldom/xmldom/pull/987), which was subsequently closed without being merged.\n\n---\n\n## Fix Applied\n\n> **⚠ Opt-in required.** Protection is not automatic. Existing serialization calls remain\n> vulnerable unless `{ requireWellFormed: true }` is explicitly passed. Applications that pass\n> untrusted data to `createComment()` or mutate comment nodes with untrusted input (via\n> `appendData`, `insertData`, `replaceData`, `.data =`, or `.textContent =`) should audit all\n> `serializeToString()` call sites and add the option.\n\n`XMLSerializer.serializeToString()` now accepts an options object as a second argument. When `{ requireWellFormed: true }` is passed, the serializer throws `InvalidStateError` before emitting a Comment node whose `.data` would produce malformed XML.\n\nOn `@xmldom/xmldom` ≥ 0.9.10, the full W3C DOM Parsing §3.2.1.4 check is applied: throws if `.data` contains `--` anywhere, ends with `-`, or contains characters outside the XML Char production.\n\nOn `@xmldom/xmldom` ≥ 0.8.13 (LTS), only the `-->` injection sequence is checked. The `0.8.x` SAX parser accepts comments containing `--` (without `>`), so throwing on bare `--` would break a previously-working round-trip on that branch. The `-->` check is sufficient to prevent injection.\n\n### PoC — fixed path\n\n```js\nconst { DOMImplementation, XMLSerializer } = require('@xmldom/xmldom');\n\nconst doc = new DOMImplementation().createDocument(null, 'root', null);\ndoc.documentElement.appendChild(doc.createComment('--><injected attr=\"1\"/><!--'));\n\n// Default (unchanged): verbatim — injection present\nconst unsafe = new XMLSerializer().serializeToString(doc);\nconsole.log(unsafe);\n// <root><!----><injected attr=\"1\"/><!----></root>\n\n// Opt-in guard: throws InvalidStateError before serializing\ntry {\n  new XMLSerializer().serializeToString(doc, { requireWellFormed: true });\n} catch (e) {\n  console.log(e.name, e.message);\n  // InvalidStateError: The comment node data contains \"--\" or ends with \"-\"  (0.9.x)\n  // InvalidStateError: The comment node data contains \"-->\"  (0.8.x — only --> is checked)\n}\n```\n\n### Why the default stays verbatim\n\nThe W3C DOM Parsing and Serialization spec §3.2.1.4 defines a `require well-formed` flag whose **default value is `false`**. With the flag unset, the spec explicitly permits serializing ill-formed comment content verbatim — this is also the behavior of browser implementations (Chrome, Firefox, Safari): `new XMLSerializer().serializeToString(doc)` produces the injection sequence without error in all major browsers.\n\nUnconditionally throwing would be a behavioral breaking change with no spec justification. The opt-in `requireWellFormed: true` flag allows applications that require injection safety to enable strict mode without breaking existing deployments.\n\n### Residual limitation\n\nThe fix operates at serialization time only. There is no creation-time check in `createComment` — the spec does not require one for comment data. Any path that leads to a Comment node with `--` in its data (`createComment`, `appendData`, `.data =`, etc.) produces a node that serializes safely only when `{ requireWellFormed: true }` is passed to `serializeToString`.","state":0,"publishedAt":"2026-04-22T20:16:07+00:00","modifiedAt":"2026-09-10T03:51:02.2075032+00:00","affected":[{"ecosystem":"npm","name":"@xmldom/xmldom","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.8.13"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@xmldom/xmldom","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.9.0"},{"kind":"fixed","version":"0.9.10"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"xmldom","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"0.6.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8","https://nvd.nist.gov/vuln/detail/CVE-2026-41672","https://github.com/xmldom/xmldom/pull/987","https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7","https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1","https://github.com/xmldom/xmldom","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10"],"sourceUrl":"https://github.com/advisories/GHSA-j759-j44w-7fr8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j759-j44w-7fr8","identifiers":["GHSA-j759-j44w-7fr8","CVE-2026-41672"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4673918+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4673928+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-f90179050d1e68c26defb06294e68ca9aad67fa6285a72a309f2510089445b08","complete":true,"records":425787,"lastAttemptAt":"2026-11-15T11:01:58.8542146+00:00","lastSuccessAt":"2026-11-15T11:01:58.8389797+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:58.8542146+00:00","snapshotPublishedAt":"2026-11-15T10:28:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f981543109394c8f9b3df5737aa835e7","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T11:15:00.6236179+00:00","lastSuccessAt":"2026-11-15T11:15:00.619+00:00","error":"257 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T11:15:00.619+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13558,"expectedIdentifiers":13874,"failedIdentifiers":257},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T11:05:17.2943378+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T11:05:17.2943378+00:00","lastSuccessAt":"2026-11-15T11:05:17.4693563+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.4693566+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T11:05:18.0594066+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":null,"lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T11:05:12.198625+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.198625+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T11:01:59.0034935+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:01:59.0034935+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T11:05:17.2566792+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:17.2566792+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T11:05:12.0533004+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T11:05:12.0533004+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}