Medium
oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection
Type: advisorySources: OSV
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories (topics) named "Topic Manifests" ({mirror}/debs/manifest/topics.json) from remote repository servers, registering them as APT source entries. However, the name field in said metadata were not checked for transliteration. In this case, a malicious party may supply a malformed Topic Manifest, which may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list as oma-topics finishes fetching and registering metadata. This vulnerability is fixed in 1.25.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-39958
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 03:25 UTC · Revision 1
Source evidence
oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection
core-osv · Original sourcePublished 9 Apr 2026, 16:28 UTC
oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories (topics) named "Topic Manifests" ({mirror}/debs/manifest/topics.json) from remote repository servers, registering them as APT source entries. However, the name field in said metadata were not checked for transliteration. In this case, a malicious party may supply a malformed Topic Manifest, which may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list as oma-topics finishes fetching and registering metadata. This vulnerability is fixed in 1.25.2.
osv:CVE-2026-39958
Complete source record
{
"id": "fa8c3e56b2c40ee2b658efc47930eb638c2e45d2dbe0568bed7a4669f4052866",
"url": "https://osv.dev/vulnerability/CVE-2026-39958",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "oma-topic: name Field in Topic Manifests (topic.json) May Allow CRLF Injection",
"summary": "oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories (topics) named \"Topic Manifests\" ({mirror}/debs/manifest/topics.json) from remote repository servers, registering them as APT source entries. However, the name field in said metadata were not checked for transliteration. In this case, a malicious party may supply a malformed Topic Manifest, which may cause malicious APT source entries to be added to /etc/apt/sources.list.d/atm.list as oma-topics finishes fetching and registering metadata. This vulnerability is fixed in 1.25.2.",
"evidence": "osv:CVE-2026-39958",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-39958",
"aliases": [
"CVE-2026-39958",
"GHSA-86jc-7r6q-cr3f"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/aosc-dev/oma",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "bd5b465397f69d1478fe87a2d9669d3f76d6c116"
},
{
"fixed": "b361c0f219bbf91a684610c76210f71f093dbc18"
},
{
"fixed": "0e3761bbba6a085c0a87c81aaeae481f395a3b0c"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "1.25.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "b361c0f219bbf91a684610c76210f71f093dbc18"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "0e3761bbba6a085c0a87c81aaeae481f395a3b0c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.25.2"
}
]
}
}
],
"versions": [
"oma-refresh-v0.54.4",
"v1.25.0",
"v1.25.0-rc.3",
"oma-fetch-v0.36.2",
"v1.25.0-rc.2",
"v1.25.0-rc.1",
"oma-tum-v0.6.1",
"oma-mirror-v0.8.1",
"oma-fetch-v0.36.1",
"oma-contents-v0.19.0",
"oma-console-v0.31.0",
"v1.24.0-rc.2",
"v1.24.0-rc.1",
"oma-utils-v0.13.0",
"oma-tum-v0.6.0",
"oma-topics-v0.26.0",
"oma-repo-verify-v0.10.0",
"oma-refresh-v0.53.1",
"oma-pm-v0.60.1",
"oma-pm-operation-type-v0.10.1",
"oma-mirror-v0.8.0",
"oma-history-v0.9.0",
"oma-fetch-v0.35.0",
"oma-contents-v0.18.0",
"oma-console-v0.30.0",
"echo",
"apt-auth-config-v0.5.0",
"v1.23.0-rc.1",
"oma-utils-v0.12.3",
"oma-tum-v0.5.2",
"oma-refresh-v0.51.2",
"oma-pm-v0.59.1",
"v1.22.0",
"v1.22.0-rc.1",
"oma-tum-v0.5.0",
"oma-refresh-v0.50.0",
"oma-pm-v0.57.0",
"oma-fetch-v0.34.0",
"oma-console-v0.29.1",
"oma-fetch-v0.32.1",
"v1.21.0-rc.1",
"oma-refresh-v0.49.1",
"oma-pm-v0.56.1",
"oma-fetch-v0.49.1",
"oma-utils-v0.12.0",
"oma-refresh-v0.49.0",
"oma-pm-v0.56.0",
"oma-pm-operation-type-v0.9.2",
"v1.20.0-rc.1",
"oma-tum-v0.2.0",
"oma-topics-v0.25.0",
"oma-refresh-v0.48.6",
"oma-pm-v0.55.0",
"oma-mirror-v0.7.0",
"oma-history-v0.8.0",
"v1.19.0-rc.2",
"oma-refresh-v0.48.4",
"oma-pm-v0.54.0",
"v1.19.0-rc.1",
"oma-tum-v0.1.1",
"oma-tum-v0.1.0",
"v1.18.0",
"v1.18.0-rc.2",
"v1.18.0-rc.1",
"oma-refresh-v0.48.3",
"oma-pm-v0.53.0",
"oma-history-v0.7.0",
"oma-fetch-v0.31.0",
"oma-refresh-v0.48.2",
"oma-refresh-v0.48.1",
"oma-refresh-v0.48.0",
"oma-mirror-v0.5.1",
"v1.17.0-rc.3",
"oma-refresh-v0.47.0",
"oma-refresh-v0.46.1",
"oma-pm-v0.52.1",
"oma-fetch-v0.30.0",
"oma-repo-verify-v0.8.0",
"oma-refresh-v0.46.0",
"v1.17.0-rc.4",
"oma-refresh-v0.45.0",
"v1.17.0-rc.2",
"v1.17.0-rc.1",
"oma-utils-v0.11.2",
"oma-refresh-v0.44.0",
"oma-pm-v0.52.0",
"oma-fetch-v0.29.0",
"oma-console-v0.28.0",
"oma-pm-v0.50.0",
"v1.16.0-rc.2",
"v1.16.0-rc.1",
"oma-pm-v0.49.0",
"oma-history-v0.6.1",
"oma-contents-v0.17.1",
"oma-refresh-v0.42.2",
"oma-pm-v0.48.5",
"oma-fetch-v0.28.0",
"v1.15.0-rc.1",
"oma-pm-v0.48.4",
"oma-utils-v0.11.1",
"oma-repo-verify-v0.6.1",
"oma-refresh-v0.42.1",
"oma-pm-v0.48.3",
"oma-fetch-v0.27.0",
"oma-pm-v0.48.2",
"oma-pm-v0.48.1",
"oma-fetch-v0.26.1",
"oma-utils-v0.11.0",
"oma-topics-v0.22.0",
"oma-repo-verify-v0.6.0",
"oma-refresh-v0.42.0",
"oma-pm-v0.48.0",
"oma-pm-operation-type-v0.9.0",
"oma-mirror-v0.4.0",
"oma-history-v0.6.0",
"oma-fetch-v0.26.0",
"oma-contents-v0.17.0",
"oma-console-v0.27.0",
"apt-auth-config-v0.4.0",
"v1.14.514-rc.1",
"oma-utils-v0.10.5",
"oma-topics-v0.21.0",
"oma-refresh-v0.41.0",
"oma-pm-v0.46.0",
"oma-pm-operation-type-v0.8.0",
"oma-mirror-v0.3.0",
"oma-history-v0.5.0",
"oma-fetch-v0.25.0",
"oma-console-v0.26.0",
"apt-auth-config-v0.3.0",
"oma-contents-v0.16.0",
"oma-refresh-v0.39.3",
"oma-pm-v0.45.3",
"oma-fetch-v0.24.0",
"oma-repo-verify-v0.4.0",
"oma-refresh-v0.39.2",
"oma-pm-v0.45.2",
"oma-refresh-v0.39.1",
"oma-fetch-v0.23.0",
"oma-refresh-v0.39.0",
"oma-refresh-v0.38.3",
"v1.13.0-rc.1",
"oma-refresh-v0.38.2",
"oma-topics-v0.20.0",
"oma-repo-verify-v0.3.0",
"oma-refresh-v0.38.0",
"oma-pm-v0.45.0",
"oma-fetch-v0.22.0",
"oma-contents-v0.15.0",
"oma-refresh-v0.37.2",
"oma-topics-v0.19.0",
"oma-refresh-v0.37.1",
"oma-utils-v0.10.4",
"oma-repo-verify-v0.2.0",
"oma-refresh-v0.37.0",
"oma-pm-v0.44.0",
"oma-console-v0.25.0",
"oma-utils-v0.10.3",
"oma-refresh-v0.35.6",
"oma-pm-v0.24.4",
"oma-fetch-v0.20.0",
"oma-console-v0.24.0",
"oma-utils-v0.10.2",
"oma-refresh-v0.35.5",
"oma-pm-v0.42.3",
"oma-fetch-v0.19.0",
"oma-console-v0.23.0",
"oma-console-v0.21.2",
"oma-utils-v0.10.0",
"oma-refresh-v0.35.3",
"oma-pm-v0.42.0",
"oma-pm-operation-type-v0.7.0",
"oma-historty-v0.4.10",
"oma-contents-v0.14.2",
"oma-refresh-v0.35.2",
"oma-pm-v0.41.1",
"oma-topics-v0.18.2",
"oma-mirror-v0.2.0",
"oma-refreesh-v0.35.1",
"oma-pm-operation-type-v0.6.1",
"oma-fetch-v0.17.2",
"oma-pm-v0.41.0",
"oma-pm-v0.40.0",
"oma-topics-v0.18.1",
"oma-pm-v0.39.0",
"oma-pm-operation-type-v0.6.0",
"oma-history-v0.4.9",
"oma-utils-v0.9.2",
"oma-topics-v0.18.0",
"oma-repo-verify-v0.1.1",
"oma-refresh-v0.35.0",
"oma-history-v0.4.8",
"oma-fetch-v0.17.1",
"oma-contents-v0.14.1",
"oma-console-v0.21.1",
"oma-pm-v0.38.1",
"oma-utils-v0.9.1",
"oma-refresh-v0.34.0",
"oma-pm-v0.38.0",
"oma-fetch-v0.17.0",
"oma-console-v0.21.0",
"apt-auth-config-v0.1.0",
"oma-console-v0.20.2",
"oma-console-v0.20.1",
"oma-utils-v0.8.9",
"oma-pm-v0.37.2",
"oma-console-v0.20.0",
"oma-pm-v0.37.0",
"oma-pm-operation-type-v0.5.0",
"oma-history-v0.4.7",
"v1.12.0-rc.1",
"oma-refresh-v0.32.1",
"oma-mirror-v0.1.0",
"oma-utils-v0.8.8",
"oma-pm-v0.36.1",
"oma-console-v0.19.0",
"oma-topics-v0.17.0",
"oma-refresh-v0.32.0",
"oma-pm-v0.36.0",
"oma-topics-v0.16.0",
"oma-refresh-v0.31.0",
"oma-pm-v0.35.0",
"oma-fetch-v0.16.0",
"oma-refresh-v0.30.0",
"oma-fetch-v0.15.1",
"oma-topics-v0.15.0",
"oma-refresh-v0.29.0",
"oma-pm-v0.34.0",
"oma-history-v0.4.6",
"oma-fetch-v0.15.0",
"oma-console-v0.17.5",
"oma-pm-v0.33.5",
"oma-pm-v0.33.4",
"v1.11.0-rc1",
"oma-refresh-v0.28.0",
"oma-console-v0.17.4",
"oma-console-v0.17.2",
"oma-refresh-v0.27.0",
"v1.10.0-rc1",
"oma-utils-v0.8.6",
"oma-pm-v0.33.2",
"oma-contents-v0.13.0",
"oma-console-v0.17.0",
"oma-console-v0.16.1",
"oma-utils-v0.8.5",
"oma-pm-v0.33.1",
"oma-console-v0.16.0",
"oma-pm-v0.33.0",
"oma-pm-v0.32.0",
"oma-pm-v0.31.0",
"oma-history-v0.4.5",
"oma-pm-operation-type-v0.4.0",
"oma-refresh-v0.26.5",
"oma-fetch-v0.14.0",
"oma-refresh-v0.26.2",
"oma-refresh-v0.26.1",
"oma-contents-v0.11.0",
"v1.9.0-rc1",
"oma-refresh-v0.26.0",
"oma-pm-v0.30.0",
"oma-oma-pm-operation-type-v0.3.0",
"oma-history-v0.4.4",
"oma-refresh-v0.25.0",
"oma-utils-v0.8.4",
"oma-pm-v0.29.2",
"oma-console-v0.15.0",
"v1.8.0-rc.1",
"oma-refresh-v0.24.1",
"oma-pm-v0.29.1",
"oma-contents-v0.10.1",
"oma-pm-v0.29.0",
"oma-contents-v0.10.0",
"v1.7.1",
"v1.7.0",
"oma-contents-v0.9.0",
"oma-console-v0.14.3",
"oma-refresh-v0.24.0",
"oma-pm-v0.28.3",
"oma-fetch-v0.13.0",
"oma-contents-v0.8.0",
"v1.6.0",
"oma-console-v0.14.2",
"oma-console-v0.14.1",
"oma-utils-v0.8.3",
"oma-pm-v0.28.2",
"oma-console-v0.14.0",
"oma-console-v0.13.1",
"oma-pm-v0.28.1",
"oma-pm-v0.28.0",
"oma-utils-v0.8.2",
"oma-pm-v0.27.2",
"oma-console-v0.13.0",
"v1.5.2",
"oma-topics-v0.14.1",
"v1.5.1",
"v1.5.0",
"oma-utils-v0.8.1",
"oma-topics-v0.14.0",
"oma-refresh-v0.23.1",
"oma-pm-v0.27.1",
"oma-console-v0.12.0",
"oma-topics-v0.13.0",
"oma-refresh-v0.23.0",
"oma-repo-verify-v0.1.0",
"v1.4.3-with-deb-ci",
"v1.4.3",
"oma-pm-v0.27.0",
"v1.4.2",
"oma-refresh-v0.22.2",
"oma-topics-v0.12.0",
"oma-refresh-v0.22.1",
"v1.4.1",
"oma-topics-v0.11.1",
"v1.4.0",
"oma-refresh-v0.22.0",
"oma-topics-v0.11.0",
"oma-refresh-v0.21.0",
"v1.3.39",
"oma-pm-v0.26.0",
"v1.3.38",
"v1.3.37",
"v1.3.36",
"oma-pm-v0.25.0",
"oma-topics-v0.10.0",
"oma-refresh-v0.20.4",
"v1.3.35",
"oma-refresh-v0.20.3",
"v1.3.34",
"oma-topics-v0.9.0",
"oma-refresh-v0.20.2",
"v1.3.33",
"oma-refresh-v0.20.1",
"oma-refresh-v0.20.0",
"oma-pm-v0.24.0",
"oma-pm-operation-type-v0.2.0",
"oma-history-v0.4.3",
"oma-fetch-v0.12.0",
"v1.3.32",
"oma-refresh-v0.19.0",
"v1.3.31",
"oma-refresh-v0.18.3",
"oma-pm-v0.23.2",
"v1.3.30",
"oma-pm-v0.23.1",
"oma-contents-v0.7.4",
"v1.3.29",
"oma-pm-v0.23.0",
"v1.3.28",
"oma-refresh-v0.18.2",
"v1.3.27",
"oma-refresh-v0.18.1",
"v1.3.26",
"oma-pm-v0.22.1",
"oma-pm-v0.22.0",
"oma-refresh-v0.18.0",
"v1.3.25",
"oma-refresh-v0.17.0",
"oma-pm-v0.21.1",
"oma-fetch-v0.11.0",
"v1.3.24",
"oma-refresh-v0.16.5",
"oma-refresh-v0.16.4",
"v1.3.23",
"v1.3.22",
"oma-pm-v0.21.0",
"v1.3.21",
"oma-fetch-v0.10.3",
"v1.3.20",
"oma-utils-v0.8.0",
"oma-refresh-v0.16.3",
"oma-pm-v0.20.1",
"oma-pm-operation-type-v0.1.5",
"v1.3.19",
"oma-refresh-v0.16.2",
"oma-fetch-v0.10.2",
"v1.3.18",
"oma-refresh-v0.16.1",
"oma-fetch-v0.10.1",
"oma-refresh-v0.16.0",
"oma-contents-v0.7.3",
"v1.3.17",
"oma-refresh-v0.15.2",
"v1.3.16",
"oma-refresh-v0.15.1",
"oma-pm-v0.20.0",
"v1.3.15",
"oma-refresh-v0.15.0",
"v1.3.14",
"oma-refresh-v0.14.2",
"v1.3.13",
"oma-refresh-v0.14.1",
"v1.3.12",
"oma-pm-v0.19.0",
"oma-refresh-v0.14.0",
"oma-pm-v0.18.13",
"oma-fetch-v0.10.0",
"oma-pm-v0.18.12",
"v1.3.11",
"release-test",
"v1.3.10",
"oma-refresh-v0.13.2",
"oma-refresh-v0.13.1",
"v1.3.9",
"v1.3.8",
"v1.3.7",
"v1.3.6",
"oma-refresh-v0.13.0",
"oma-pm-v0.18.11",
"oma-refresh-v0.12.13",
"v1.3.5",
"oma-refresh-v0.12.12+sequoua-header-fi",
"oma-fetch-v0.9.1",
"v1.3.4",
"oma-refresh-v0.12.11+sequoia-header-fix",
"oma-pm-v0.18.10",
"oma-fetch-v0.9.0",
"v1.3.3",
"oma-refresh-v0.12.10+sequoia-header-fix",
"oma-fetch-v0.8.6",
"v1.3.2",
"oma-history-v0.4.2",
"oma-refresh-v0.12.9+sequoia-header-fix",
"v1.3.1",
"oma-pm-v0.18.9",
"v1.3.0",
"v1.2.24",
"oma-console-v0.10.1",
"v1.2.23",
"oma-refresh-v0.12.6+sequoia-header-fix",
"v1.2.22",
"v1.2.21",
"oma-utils-v0.6.4",
"v1.2.20",
"oma-pm-v0.15.13",
"v1.2.19",
"oma-utils-v0.6.3",
"oma-pm-v0.15.12",
"oma-console-v0.10.0",
"v1.2.18",
"oma-pm-v0.15.11",
"v1.2.17",
"oma-console-v0.9.2",
"v1.2.16",
"oma-utils-v0.6.2",
"v1.2.15",
"v1.2.14",
"oma-refresh-v0.12.5",
"v1.2.13",
"oma-topics-v0.7.2",
"oma-refresh-v0.12.4",
"oma-fetch-v0.8.3",
"v1.2.12",
"v1.2.11",
"v1.2.10",
"v1.2.9",
"oma-topics-v0.7.1",
"oma-pm-v0.15.8",
"v1.2.8",
"oma-pm-v0.15.7",
"v1.2.7",
"v1.2.6",
"oma-pm-v0.15.6",
"v1.2.5",
"oma-refresh-v0.12.1",
"oma-fetch-v0.8.1",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"oma-history-v0.3.0",
"v1.2.0",
"v1.1.8",
"oma-pm-v0.9.1",
"v1.1.7",
"v1.1.6",
"oma-pm-v0.9.0",
"v1.1.5",
"v1.1.4",
"v1.1.3",
"v1.1.2",
"oma-refresh-v0.6.10",
"v1.1.1",
"oma-utils-v0.2.0",
"oma-refresh-v0.6.9",
"oma-pm-v0.8.4",
"v1.1.0",
"oma-refresh-v0.6.7",
"oma-pm-v0.8.3",
"oma-fetch-v0.5.0",
"oma-utils-v0.1.9",
"oma-topics-v0.3.3",
"oma-refresh-v0.6.6",
"oma-pm-v0.8.2",
"oma-fetch-v0.4.1",
"oma-console-v0.5.0",
"oma-refresh-v0.6.5",
"oma-pm-v0.8.1",
"oma-fetch-v0.4.0",
"v1.1.0-beta.9",
"v1.1.0-beta.8",
"oma-utils-v0.1.8",
"oma-topics-v0.3.2",
"oma-pm-v0.8.0",
"oma-pm-v0.6.4",
"oma-fetch-v0.3.6",
"oma-console-v0.4.0",
"v1.1.0-beta.7",
"oma-pm-v0.7.2",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0",
"v0.45.6",
"v0.45.5",
"v0.45.4",
"v0.45.3",
"v0.45.2",
"v0.45.1",
"v0.45.0",
"v0.44.2",
"v0.44.1",
"v0.44.0",
"v0.43.2",
"v0.43.1",
"v0.43.0",
"v0.42.0",
"v0.41.1",
"v0.41.0",
"v0.40.0",
"v0.39.0",
"v0.38.2",
"v0.38.1",
"v0.38.0",
"v0.37.1",
"v0.37.0",
"v0.36.3",
"v0.36.2",
"v0.36.1",
"v0.36.0",
"v0.35.0",
"v0.34.0",
"v0.33.1",
"v0.33.0",
"v0.32.2",
"v0.32.1",
"v0.32.0",
"v0.31.1",
"v0.31.0",
"v0.30.3",
"v0.30.2",
"v0.30.1",
"v0.30.0",
"v0.29.1",
"v0.29.0",
"v0.28.2",
"v0.28.1",
"v0.28.0",
"v0.27.0",
"v0.26.0",
"v0.25.0",
"v0.24.3",
"v0.24.2",
"v0.24.1",
"v0.24.0",
"v0.23.0",
"v0.22.0",
"v0.21.0",
"v0.20.0",
"v0.19.0",
"v0.18.1",
"v0.18.0",
"v0.17.1",
"v0.17.0",
"v0.16.0",
"v0.15.0",
"v0.14.0",
"v0.13.2",
"0.13.1",
"0.1.0-alpha.12",
"0.1.0-alpha.11",
"0.1.0-alpha.10",
"0.1.0-alpha.9",
"0.1.0-alpha.8",
"0.1.0-alpha.7",
"0.1.0-alpha.6",
"0.1.0-alpha.5",
"0.1.0-alpha.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39958.json"
}
}
],
"modified": "2026-10-28T02:30:53.169955017Z",
"provider": "osv",
"references": [
"https://github.com/AOSC-Dev/oma/releases/tag/v1.25.2",
"https://github.com/AOSC-Dev/oma/security/advisories/GHSA-86jc-7r6q-cr3f",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39958.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-39958",
"https://github.com/AOSC-Dev/oma/commit/b361c0f219bbf91a684610c76210f71f093dbc18",
"https://github.com/AOSC-Dev/oma/pull/733"
],
"provider_metadata": {
"cwe_ids": [
"CWE-93"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39958.json"
}
},
"related_cves": [
{
"value": "CVE-2026-39958",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 522188,
"published_at": "2026-04-09T16:28:18.758+00:00"
}