{"id":"GO-2026-6833","revision":null,"records":[{"revision":"925b85425396498b968caf318df4908f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73049","aliases":[],"title":"SiYuan before v3.7.4 Information Disclosure via getAttributeViewBacklinks","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.","state":0,"publishedAt":"2026-08-14T11:35:45.099+00:00","modifiedAt":"2026-08-18T02:03:21.089+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.4\"\n                        },\n                        {\n                            \"version\": \"3.7.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinks"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73049","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73049","identifiers":["CVE-2026-73049"]},"retained":false,"historicalAffected":[]},{"revision":"dae142ea29e6478385c11c400c622bcd","observedAt":"2026-11-07T15:31:36.981+00:00","statement":{"source":"euvd","id":"EUVD-2026-58618","aliases":["CVE-2026-73049","GHSA-6xvp-3rfv-g2g2","GHSA-p4qw-vx5p-g984"],"title":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can s…","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinks"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58618","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 14, 2026, 11:35:45 AM","dateUpdated":"Aug 18, 2026, 2:03:21 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-58618","identifiers":["EUVD-2026-58618","CVE-2026-73049","GHSA-6xvp-3rfv-g2g2","GHSA-p4qw-vx5p-g984"]},"retained":false,"historicalAffected":[]},{"revision":"5d654bb0f68e4f31943c057a393fb356","observedAt":"2026-10-25T15:19:03.401+00:00","statement":{"source":"nvd","id":"CVE-2026-73049","aliases":[],"title":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can s…","description":"SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.","state":0,"publishedAt":"2026-08-14T12:16:47.697+00:00","modifiedAt":"2026-08-26T17:04:11.547+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinks"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73049","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-08-14T12:16:47.697","lastModified":"2026-08-26T17:04:11.547"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-73049","identifiers":["CVE-2026-73049"]},"retained":false,"historicalAffected":[]},{"revision":"0ed32a265890498b840aea3972c870c7","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-6xvp-3rfv-g2g2","aliases":[],"title":"Duplicate Advisory: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-p4qw-vx5p-g984. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.","state":2,"publishedAt":"2026-08-14T12:31:28+00:00","modifiedAt":"2026-10-23T18:45:08.5742752+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984","https://nvd.nist.gov/vuln/detail/CVE-2026-73049","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinks"],"sourceUrl":"https://github.com/advisories/GHSA-6xvp-3rfv-g2g2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6xvp-3rfv-g2g2","identifiers":["GHSA-6xvp-3rfv-g2g2"]},"retained":false,"historicalAffected":[]},{"revision":"7d1815afc7a5401abb9793468b009cc7","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-p4qw-vx5p-g984","aliases":["CVE-2026-73049","GO-2026-6833"],"title":"SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers","description":"### Summary\n\n`/api/av/getAttributeViewBacklinks` filters its results for reader roles through `FilterAttributeViewBacklinksByPublishAccess`. That function resolves its ignore list with `GetDisablePublishAccess`, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check.\n\nThe result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it.\n\nThe rest of the function is correct. It takes `*gin.Context` and calls `GetPathPasswordByPublishAccess` and `CheckPublishAuthCookie` at all four decision points, so the password-protected and private tiers are properly enforced. The defect is the choice of list, on one line.\n\n### Details\n\n**Route,** `kernel/api/router.go:545` on the development branch and `:527` on master:\n\n```go\nginServer.Handle(\"POST\", \"/api/av/getAttributeViewBacklinks\", model.CheckAuth, getAttributeViewBacklinks)\n```\n\n`CheckAuth` only. No `CheckAdminRole`, no `CheckReadonly`.\n\n**The defect.** In `FilterAttributeViewBacklinksByPublishAccess` (`kernel/model/publish_access.go:1060` on dev, `:435` on master):\n\n```go\npublishIgnore := GetDisablePublishAccess(publishAccess)\n```\n\n`GetDisablePublishAccess` returns only entries at the forbidden tier. A hidden document has `visible:false`, `password:\"\"`, `disable:false`, so it does not appear in that list. `CheckPathAccessableByPublishIgnore` therefore returns true for it, and because the password is empty the authentication branch short-circuits. Hidden documents pass both halves of the check.\n\n**The sibling filter uses the correct list.** The regular backlink panel is the same product feature in the same UI, and it is gated properly. `kernel/api/ref.go:170` `getBacklink2` calls `FilterPathsByPublishAccess`, which at `kernel/model/publish_access.go:1256` resolves its list with `GetInvisiblePublishAccess`. Two backlink filters in the same file, opposite list choices.\n\n**The distinction the tiers are meant to draw.** The shipped description of the hidden tier, from `app/appearance/langs/en.json`:\n\n```\npublishAccessHiddenComment = \"Not publicly visible, can be accessed directly.\"\n```\n\nA direct-access endpoint using the forbidden list is consistent with that: hidden documents are meant to be reachable when the caller already knows the identifier. Backlink discovery is not direct access. The caller supplies the target row and receives the identities of referring rows it never named, which is enumeration, and enumeration is precisely what \"not publicly visible\" excludes.\n\n**Origin.** The filter was introduced by `6da2c736e` (2026-07-18, \"Show database relation backlinks in the attribute panel\", #10599) with this list choice from the start. No security-focused commit has touched the attribute-view backlink path since.\n\n**What is returned.** Per matched backlink: `AvName` (the database name), `Title` (the row title), `DatabasePath` (the HPath of the containing document), `BoxID`, `DatabaseBlockID`, and `Relations[].KeyName`. These are author-written names and titles, not opaque identifiers.\n\n### Proof of Concept\n\nPublish mode enabled, `Publish.Auth.Enable` false, anonymous client with no credentials or cookies. Document A is public and holds a database with a row. Document B is set to varying tiers and holds a database whose relation field points at A's row. The attacker needs only A's `avID` and `itemID`, both present in the DOM of A's own published page.\n\nListing control first, establishing that the platform agrees B must not be listed:\n\n```\nPOST /api/filetree/listDocsByPath\n→ returns only the public document\n```\n\nThen the same backlinks request at four tier settings, spaced to clear the 30-second `GetPublishAccess()` cache:\n\n| Tier of document B | Result |\n|---|---|\n| Hidden (`visible:false`, no password, `disable:false`) | `total:1`, with `avName`, `title`, `databasePath` and `relations[].keyName` for the row in B |\n| Forbidden (`disable:true`) | `total:0` |\n| Private (password set) | `total:0` |\n| Hidden again (restored) | `total:1`, reproducible |\n\nThe forbidden row confirms that the disable list is what the filter consults. The private row confirms that the password half works correctly. The gap is the hidden tier alone.\n\n```\nPOST /api/av/getAttributeViewBacklinks\n{\"avID\":\"<public database id>\",\"itemID\":\"<public row id>\"}\n\n→ 200, total:1, disclosing the database name, row title and document path\n       of a document the same session cannot list\n```\n\n### Impact\n\nAn anonymous reader in publish mode, or any publish `RoleReader`, discovers that a hidden document contains a database row referencing a public one, and receives that row's title, its database's name, and the containing document's path. Names and titles are author-written and routinely describe their subject, so this discloses both the existence and the topic of documents the author marked as not publicly visible.\n\nThe reader does not need to know anything about the hidden document beforehand. The only input is a public row identifier taken from a page they are already entitled to view.\n\nConfidentiality only, with no integrity or availability impact. No document body content is returned.\n\n### Suggested fix\n\nChange the list resolution in `FilterAttributeViewBacklinksByPublishAccess` to `GetInvisiblePublishAccess`, mirroring `FilterPathsByPublishAccess` on the regular backlink path. The password handling in the function is already correct and needs no change.","state":0,"publishedAt":"2026-10-23T18:30:42+00:00","modifiedAt":"2026-11-05T23:26:06.992612+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260730150429-5b42614311b0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984","https://nvd.nist.gov/vuln/detail/CVE-2026-73049","https://github.com/siyuan-note/siyuan/commit/5b42614311b0afda29ccc65e55d74bf3e8cc9054","https://github.com/siyuan-note/siyuan","https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinks"],"sourceUrl":"https://github.com/advisories/GHSA-p4qw-vx5p-g984","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-p4qw-vx5p-g984","identifiers":["GHSA-p4qw-vx5p-g984","CVE-2026-73049","GO-2026-6833"]},"retained":false,"historicalAffected":[]},{"revision":"9c6d595f1e084b599449ddc0094f6860","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6833","aliases":["CVE-2026-73049","GHSA-p4qw-vx5p-g984"],"title":"SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-11-05T22:54:22+00:00","modifiedAt":"2026-11-05T23:15:13.4026612+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260730150429-5b42614311b0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984","https://nvd.nist.gov/vuln/detail/CVE-2026-73049","https://github.com/siyuan-note/siyuan/commit/5b42614311b0afda29ccc65e55d74bf3e8cc9054","https://github.com/siyuan-note/siyuan/releases/tag/v3.7.4-alpha.4","https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewbacklinks"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6833","license":"OSV · upstream source license applies","key":"osv:GO-2026-6833","identifiers":["GO-2026-6833","CVE-2026-73049","GHSA-p4qw-vx5p-g984"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8753142+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.875316+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-5f996ab4d545d4c69ea2b6ee3009c8c4105f63df9cfbbf4c578c7470282be4b4","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T05:06:53.5215713+00:00","lastSuccessAt":"2026-11-08T05:06:53.4988286+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.5215713+00:00","snapshotPublishedAt":"2026-11-08T04:25:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T05:08:40.2673541+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8762568+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.8762573+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-449054d6321e4ff8818c6b898fdac406","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T05:08:11.1749792+00:00","lastSuccessAt":"2026-11-08T05:08:11.17+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:11.17+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T05:06:54.1714031+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.1714031+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T05:06:53.6785795+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.6785795+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T05:06:54.5508124+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.5508124+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T05:06:54.0611713+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.0611713+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}