{"id":"GHSA-q2vg-7qgx-x5fc","revision":null,"records":[{"revision":"5f69ffbe8cd840d7857fff49859920f2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72811","aliases":[],"title":"SiYuan before v3.7.4 SQL Injection via backlink search","description":"SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL MATCH/search statement while escaping only the double-quote character and not the single quote. A single quote in the client keyword (first-order, reachable by an anonymous or RoleReader user on the publish surface) or in stored document metadata (second-order) breaks out of the string literal. Because the query runs on the main read-write siyuan.db handle via a statement-stacking-capable driver, an attacker can execute arbitrary SQL, enabling cross-notebook read and write. Fixed in v3.7.4.","state":0,"publishedAt":"2026-08-14T11:35:24.767+00:00","modifiedAt":"2026-08-14T16:52:14.903+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.4\"\n                        },\n                        {\n                            \"version\": \"3.7.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":9.9,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","score":10,"severity":"CRITICAL"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72811","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72811","identifiers":["CVE-2026-72811"]},"retained":false,"historicalAffected":[]},{"revision":"59197bfd6cee41d1b428fe82e488ecd9","observedAt":"2026-11-13T17:03:48.742+00:00","statement":{"source":"euvd","id":"EUVD-2026-58626","aliases":["CVE-2026-72811","GHSA-p8cp-78hp-wmq8","GHSA-q2vg-7qgx-x5fc"],"title":"SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into…","description":"SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL MATCH/search statement while escaping only the double-quote character and not the single quote. A single quote in the client keyword (first-order, reachable by an anonymous or RoleReader user on the publish surface) or in stored document metadata (second-order) breaks out of the string literal. Because the query runs on the main read-write siyuan.db handle via a statement-stacking-capable driver, an attacker can execute arbitrary SQL, enabling cross-notebook read and write. Fixed in v3.7.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":9.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58626","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 14, 2026, 11:35:24 AM","dateUpdated":"Aug 14, 2026, 4:52:14 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58626","identifiers":["EUVD-2026-58626","CVE-2026-72811","GHSA-p8cp-78hp-wmq8","GHSA-q2vg-7qgx-x5fc"]},"retained":false,"historicalAffected":[]},{"revision":"b42b6355e48249308ccacfddfee08f2b","observedAt":"2026-10-25T15:19:03.401+00:00","statement":{"source":"nvd","id":"CVE-2026-72811","aliases":[],"title":"SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into…","description":"SiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL MATCH/search statement while escaping only the double-quote character and not the single quote. A single quote in the client keyword (first-order, reachable by an anonymous or RoleReader user on the publish surface) or in stored document metadata (second-order) breaks out of the string literal. Because the query runs on the main read-write siyuan.db handle via a statement-stacking-capable driver, an attacker can execute arbitrary SQL, enabling cross-notebook read and write. Fixed in v3.7.4.","state":0,"publishedAt":"2026-08-14T12:16:43.903+00:00","modifiedAt":"2026-08-26T16:56:50.83+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.9,"severity":"CRITICAL"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","score":10,"severity":"CRITICAL"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72811","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-89"],"productCriteria":[],"sourceDates":{"published":"2026-08-14T12:16:43.903","lastModified":"2026-08-26T16:56:50.830"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-72811","identifiers":["CVE-2026-72811"]},"retained":false,"historicalAffected":[]},{"revision":"74ba9b4d46de4da9b3dd730e14f3f4ea","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-p8cp-78hp-wmq8","aliases":[],"title":"Duplicate Advisory: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-q2vg-7qgx-x5fc. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions <= v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query (kernel/model/backlink.go), which concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL MATCH/search statement while escaping only the double-quote character and not the single quote. A single quote in the client keyword (first-order, reachable by an anonymous or RoleReader user on the publish surface) or in stored document metadata (second-order) breaks out of the string literal. Because the query runs on the main read-write siyuan.db handle via a statement-stacking-capable driver, an attacker can execute arbitrary SQL, enabling cross-notebook read and write. Fixed in v3.7.4.","state":2,"publishedAt":"2026-08-14T12:31:24+00:00","modifiedAt":"2026-09-03T22:30:08.6079852+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc","https://nvd.nist.gov/vuln/detail/CVE-2026-72811","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search"],"sourceUrl":"https://github.com/advisories/GHSA-p8cp-78hp-wmq8","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-p8cp-78hp-wmq8","identifiers":["GHSA-p8cp-78hp-wmq8"]},"retained":false,"historicalAffected":[]},{"revision":"9391dde4f05744099936763a283329e2","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-q2vg-7qgx-x5fc","aliases":["CVE-2026-72811","GO-2026-6402"],"title":"SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle","description":"**CVE:** This vulnerability corresponds to [CVE-2026-72811](https://nvd.nist.gov/vuln/detail/CVE-2026-72811).\n\n### Summary\n\nThe backlink/mention search query (`kernel/model/backlink.go`) concatenates stored block metadata (title, name, alias, anchor text) and the client-supplied keyword into a SQL `MATCH`/search statement, escaping only the double-quote character (`\"`) and not the single quote (`'`). A single quote in either the client keyword or in stored document metadata breaks out of the string literal. The query runs on the main read-write `siyuan.db` handle through a statement-stacking-capable driver.\n\nThis yields two vectors:\n- **First-order:** a client-supplied keyword containing `'` injects directly. This path is reachable by an anonymous reader on the publish surface.\n- **Second-order:** a document whose title/name/alias contains `'` is stored safely (indexing uses parameterized inserts) but detonates when that stored value is later concatenated into the backlink query including on another user's kernel that has ingested the malicious document.\n\n### Details\n\n**Storage is safe; reuse is not.** Indexing INSERTs (`kernel/sql/upsert.go`) are parameterized (`(?,?,…)` with bound arguments for `Name`/`Content`/`Markdown`/`IAL`), so malicious `.sy` content is stored intact and safely. The injection is in the *reuse* path: the backlink/mention MATCH query (`kernel/model/backlink.go`, around line 980) builds its condition by concatenating the stored title/name/alias/anchor and the client keyword, applying only `\"`→escaping and not `'`. A `'` in either source terminates the literal and lands in SQL context.\n\n**Sink / handle.** The concatenated statement reaches `SelectBlocksRawStmtNoParse` → `query()` on the global read-write `siyuan.db` handle (DSN has no `mode=ro`/`_query_only`), driven by the vendored `88250/go-sqlite3` fork whose connection `query` loops over `;`-separated statements (stacking possible). Ceiling is arbitrary SQL cross-notebook read and write.\n\n**Route / auth tier.** The backlink/mention family (`getBacklink`, `getBacklink2`, `getBacklinkDoc`, `getBackmentionDoc`) is `CheckAuth`-only, so the first-order client-keyword vector is reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`.\n\n**Scope of the injection surface (confirmed the only second-order sink).** A sweep of the query paths that reuse stored content confirmed this is the sole injectable reuse sink: indexing INSERTs are parameterized, tag search uses `content LIKE ?` with pattern escaping, virtual refs use in-memory matching (no SQL), `IN(...)` joins use node-IDs/hex-hashes/ROWIDs (no quote surface), and the graph name/content filter escapes `'`. Only the backlink/mention MATCH path concatenates with `'` unescaped.\n\n### Proof of Concept\n\nReproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled). Strictly non-destructive verification, a syntax-error probe and a stored-value observation; no UNION exfiltration, no write, no DDL.\n\n**First-order (client keyword), anonymous reader on port 6808:**\n```\nPOST http://127.0.0.1:6808/api/ref/getBacklink2\n{\"id\":\"<block id>\",\"k\":\"a'b\",\"mk\":\"\"}\n```\nThe keyword `a'b` reaches the concatenated `MATCH` condition and produces a SQL parse error, confirming the single quote breaks out of the literal and the client keyword lands in SQL context.\n\n**Second-order (stored title), setup via admin then observed anonymously:**\nA document whose title contains a single quote e.g. `(\"locked-doc\")` style metadata is stored safely by the parameterized indexer, then appears at the exact unescaped position in the backlink query when that document participates in a backlink/mention lookup, breaking the query the same way. This demonstrates that stored document metadata detonates on reuse, independent of the client keyword.\n\nVerification was limited to the syntax-error probe and the stored-value position observation; no exfiltration or write statement was executed. Full reproduction detail available privately on request.\n\n### Impact\n\n**First-order:** an anonymous reader (publish mode with auth disabled) or any publish `RoleReader` injects arbitrary SQL into the backlink/mention query via the keyword parameter, on the read-write main handle: cross-notebook read disclosure and, via statement stacking, write and `ATTACH`. This is the same anonymous-arbitrary-SQL severity as the search/embed injection findings, on a different sink.\n\n**Second-order:** a document whose title/name/alias contains injection content is stored safely but executes when that stored value is concatenated into the backlink query. This fires on any kernel that has ingested the malicious document for example via a shared or imported `.sy` file, sync, or an opened `.sy.zip`. The precondition here is content delivery into the victim workspace (not a direct anonymous request), so it is a distinct, delivery-dependent threat model from the first-order vector.\n\nEncrypted notebooks are out of scope; code execution is not reachable in the default build (no `load_extension`).\n\n**Distinctness from the other SQL findings:** this is a different sink (`backlink.go` MATCH query) from the `searchDocs` (`LIKE` keyword), `searchEmbedBlock` (verbatim stmt), and `getEmbedBlock` (`IN`-clause ID array) findings, and it is the only one with a second-order (stored-content) vector. A fix to any of those does not remediate this path.\n\n### Suggested fix\n\nParameterize the backlink/mention query bind the keyword and any stored metadata as placeholders rather than concatenating or escape `'` (and use `LIKE`-pattern escaping) consistently, matching the tag-search and graph-filter paths that already do so. The second-order vector specifically requires that stored metadata be bound rather than concatenated, since escaping at storage time is not the defense (storage is already safe); the fix must be at the query-construction site.","state":0,"publishedAt":"2026-09-03T22:27:50+00:00","modifiedAt":"2026-09-10T15:25:26.2361984+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260723004839-1a5b3431d5ab"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc","https://nvd.nist.gov/vuln/detail/CVE-2026-72811","https://github.com/siyuan-note/siyuan/commit/1a5b3431d5ab3036b19c1cc79486fedd6906fb57","https://github.com/siyuan-note/siyuan","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search"],"sourceUrl":"https://github.com/advisories/GHSA-q2vg-7qgx-x5fc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q2vg-7qgx-x5fc","identifiers":["GHSA-q2vg-7qgx-x5fc","CVE-2026-72811","GO-2026-6402"]},"retained":false,"historicalAffected":[]},{"revision":"e1cbd469bf2a486f985c0b3be3697aaa","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6402","aliases":["CVE-2026-72811","GHSA-q2vg-7qgx-x5fc"],"title":"SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:15:14.7903945+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260723004839-1a5b3431d5ab"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-q2vg-7qgx-x5fc","https://nvd.nist.gov/vuln/detail/CVE-2026-72811","https://github.com/siyuan-note/siyuan/commit/1a5b3431d5ab3036b19c1cc79486fedd6906fb57","https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-backlink-search"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6402","license":"OSV · upstream source license applies","key":"osv:GO-2026-6402","identifiers":["GO-2026-6402","CVE-2026-72811","GHSA-q2vg-7qgx-x5fc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T02:30:47.8730310+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T02:30:47.873031+00:00","lastSuccessAt":"2026-11-15T02:30:48.0284679+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:48.0284689+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-4a3b956be05e66f2d334d680698b5f8b1ae425e61f61bc83c4992e5887bfe17d","complete":true,"records":425766,"lastAttemptAt":"2026-11-15T02:30:47.2010811+00:00","lastSuccessAt":"2026-11-15T02:30:47.193798+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:47.2010811+00:00","snapshotPublishedAt":"2026-11-15T02:22:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-fffeee11411049318edc5a8d2dca1046","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T02:40:11.1475507+00:00","lastSuccessAt":"2026-11-15T02:40:11.142+00:00","error":"18 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T02:40:11.142+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13856,"expectedIdentifiers":13874,"failedIdentifiers":18},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T02:30:47.8730310+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T02:30:47.873031+00:00","lastSuccessAt":"2026-11-15T02:30:48.0298151+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:48.0298198+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b4e16143cf664d0aa856e1009c943b33","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T02:30:50.0807193+00:00","lastSuccessAt":"2026-11-15T02:30:50.077+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:50.077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T02:30:47.8246194+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:47.8246194+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T02:30:47.3421403+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:47.3421403+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T02:30:47.8368492+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:47.8368492+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-deb41cb32d3b3d67de7960b1647d789a5218551d33a54a4b027ba315bcba590f","complete":true,"records":232473,"lastAttemptAt":"2026-11-15T02:30:47.7245904+00:00","lastSuccessAt":"2026-11-15T01:46:53.6377511+00:00","error":null,"lastVerifiedAt":"2026-11-15T02:30:47.7245904+00:00","snapshotPublishedAt":"2026-11-15T00:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}