{
    "document": {
        "category": "csaf_base",
        "csaf_version": "2.0",
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        },
        "lang": "en",
        "notes": [
            {
                "category": "legal_disclaimer",
                "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
            }
        ],
        "publisher": {
            "category": "coordinator",
            "contact_details": "cert@ncsc.nl",
            "name": "National Cyber Security Centre",
            "namespace": "https://www.ncsc.nl/"
        },
        "title": "CVE-2026-32611",
        "tracking": {
            "current_release_date": "2026-03-22T16:42:27.807409Z",
            "generator": {
                "date": "2026-02-17T15:00:00Z",
                "engine": {
                    "name": "V.E.L.M.A",
                    "version": "1.7"
                }
            },
            "id": "CVE-2026-32611",
            "initial_release_date": "2026-03-16T16:42:58.962810Z",
            "revision_history": [
                {
                    "date": "2026-03-16T16:42:58.962810Z",
                    "number": "1",
                    "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)."
                },
                {
                    "date": "2026-03-16T16:43:00.603380Z",
                    "number": "2",
                    "summary": "NCSC Score created."
                },
                {
                    "date": "2026-03-18T17:39:33.960355Z",
                    "number": "3",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-18T17:39:36.801266Z",
                    "number": "4",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-18T18:27:44.550616Z",
                    "number": "5",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-18T18:27:46.296191Z",
                    "number": "6",
                    "summary": "NCSC Score updated."
                },
                {
                    "date": "2026-03-18T19:38:59.307525Z",
                    "number": "7",
                    "summary": "Unknown change."
                },
                {
                    "date": "2026-03-18T23:09:23.152967Z",
                    "number": "8",
                    "summary": "References created (1)."
                },
                {
                    "date": "2026-03-19T00:43:04.949279Z",
                    "number": "9",
                    "summary": "Source created.| CVE status created. (valid)| Products connected (1)."
                },
                {
                    "date": "2026-03-19T06:43:20.199383Z",
                    "number": "10",
                    "summary": "Description created for source."
                },
                {
                    "date": "2026-03-19T15:31:23.668084Z",
                    "number": "11",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)."
                },
                {
                    "date": "2026-03-19T21:00:11.195819Z",
                    "number": "12",
                    "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (3).| CWES updated (1)."
                },
                {
                    "date": "2026-03-20T09:29:53.716855Z",
                    "number": "13",
                    "summary": "Source connected.| CVE status created. (valid)| EPSS created."
                },
                {
                    "date": "2026-03-20T18:16:58.548285Z",
                    "number": "14",
                    "summary": "Products connected (1).| Product Identifiers created (1).| Exploits created (1)."
                },
                {
                    "date": "2026-03-20T18:17:00.285234Z",
                    "number": "15",
                    "summary": "NCSC Score updated."
                }
            ],
            "status": "interim",
            "version": "15"
        }
    },
    "product_tree": {
        "branches": [
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "branches": [
                                    {
                                        "category": "product_version_range",
                                        "name": "vers:deb/unknown",
                                        "product": {
                                            "name": "vers:deb/unknown",
                                            "product_id": "CSAFPID-5843883"
                                        }
                                    }
                                ],
                                "category": "product_name",
                                "name": "glances"
                            }
                        ],
                        "category": "product_family",
                        "name": "bookworm"
                    }
                ],
                "category": "vendor",
                "name": "Debian"
            },
            {
                "branches": [
                    {
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": "vers:unknown/<4.5.2",
                                "product": {
                                    "name": "vers:unknown/<4.5.2",
                                    "product_id": "CSAFPID-5841720",
                                    "product_identification_helper": {
                                        "cpe": "cpe:2.3:a:nicolargo:glances:*:*:*:*:*:*:*:*"
                                    }
                                }
                            }
                        ],
                        "category": "product_name",
                        "name": "glances"
                    }
                ],
                "category": "vendor",
                "name": "nicolargo"
            }
        ]
    },
    "vulnerabilities": [
        {
            "cve": "CVE-2026-32611",
            "cwe": {
                "id": "CWE-89",
                "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
            },
            "notes": [
                {
                    "category": "description",
                    "text": "## Summary\n\nThe GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names.\n\n## Details\n\nThe DuckDB export module constructs SQL DDL statements by directly interpolating stat field names and plugin names into f-strings.\n\n**Vulnerable CREATE TABLE construction** (`glances/exports/glances_duckdb/__init__.py:156-162`):\n\n```python\ncreate_query = f\"\"\"\nCREATE TABLE {plugin} (\n{', '.join(creation_list)}\n);\"\"\"\nself.client.execute(create_query)\n```\n\nThe `creation_list` is built from stat dictionary keys in the `update()` method (`glances/exports/glances_duckdb/__init__.py:117-118`):\n\n```python\nfor key, value in plugin_stats.items():\n    creation_list.append(f\"{key} {convert_types[type(self.normalize(value)).__name__]}\")\n```\n\nThe INSERT statement also uses the unescaped `plugin` name (`glances/exports/glances_duckdb/__init__.py:172-174`):\n\n```python\ninsert_query = f\"\"\"\nINSERT INTO {plugin} VALUES (\n{', '.join(['?' for _ in values])}\n);\"\"\"\n```\n\nWhile INSERT values use `?` placeholders (safe), the table name `{plugin}` is directly interpolated in both CREATE TABLE and INSERT INTO statements. Column names in creation_list are also directly interpolated without quoting.\n\n**Comparison with the TimescaleDB fix (commit 39161f0):**\n\nThe TimescaleDB fix addressed this exact pattern by:\n1. Using `psycopg.sql.Identifier()` for table and column names\n2. Using `psycopg.sql.SQL()` for composing queries\n3. Using `%s` placeholders for all values\n\nThe DuckDB module was not part of this fix despite having the same vulnerability class.\n\n**Attack vector:**\n\nThe primary attack vector is through stat dictionary keys. While most keys come from hardcoded psutil field names (e.g., `cpu_percent`, `memory_usage`), any future plugin that introduces dynamic keys from external data (container labels, custom metrics, user-defined sensor names) would create an exploitable injection path. Additionally, the table name (`plugin`) comes from the internal plugins list, but any custom plugin with a crafted name could inject SQL.\n\n## PoC\n\nThe injection is demonstrable when column or table names contain SQL metacharacters:\n\n```python\n# Simulated injection via a hypothetical plugin with dynamic keys\n# If a stat dict contained a key like:\n#   \"cpu_percent BIGINT); DROP TABLE cpu; --\"\n# The creation_list would produce:\n#   \"cpu_percent BIGINT); DROP TABLE cpu; -- VARCHAR\"\n# Which in the CREATE TABLE f-string becomes:\n#   CREATE TABLE plugin_name (\n#     time TIMETZ,\n#     hostname_id VARCHAR,\n#     cpu_percent BIGINT); DROP TABLE cpu; -- VARCHAR\n#   );\n```\n\n```bash\n# Verify with DuckDB export enabled:\n# 1. Configure DuckDB export in glances.conf:\n# [duckdb]\n# database=/tmp/glances.duckdb\n\n# 2. Start Glances with DuckDB export and debug logging\nglances --export duckdb --debug 2>&1 | grep \"Create table\"\n\n# 3. Observe the unescaped SQL in debug output\n```\n\n## Impact\n\n- **Defense-in-depth gap:** The identical vulnerability pattern was identified and fixed in TimescaleDB (GHSA-x46r) but the fix was not applied to the sibling DuckDB module. This represents an incomplete patch that leaves the same attack surface open through a different code path.\n\n- **Future exploitability:** If any Glances plugin is added or modified to produce stat dictionary keys from external/user-controlled data (e.g., container metadata, custom metric names, SNMP OID labels), the DuckDB export would become immediately exploitable for SQL injection without any additional code changes.\n\n- **Data integrity:** A successful injection in the CREATE TABLE statement could corrupt the DuckDB database, create unauthorized tables, or modify schema in ways that affect other applications reading from the same database file.\n\n## Recommended Fix\n\nApply the same parameterization approach used in the TimescaleDB fix. DuckDB supports identifier quoting with double quotes:\n\n```python\n# glances/exports/glances_duckdb/__init__.py\n\ndef _quote_identifier(name):\n    \"\"\"Quote a SQL identifier to prevent injection.\"\"\"\n    # DuckDB uses double-quote escaping for identifiers\n    return '\"' + name.replace('\"', '\"\"') + '\"'\n\ndef export(self, plugin, creation_list, values_list):\n    \"\"\"Export the stats to the DuckDB server.\"\"\"\n    logger.debug(f\"Export {plugin} stats to DuckDB\")\n\n    table_list = [t[0] for t in self.client.sql(\"SHOW TABLES\").fetchall()]\n    if plugin not in table_list:\n        # Quote table and column names to prevent injection\n        quoted_plugin = _quote_identifier(plugin)\n        quoted_fields = []\n        for item in creation_list:\n            parts = item.split(' ', 1)\n            col_name = _quote_identifier(parts[0])\n            col_type = parts[1] if len(parts) > 1 else 'VARCHAR'\n            quoted_fields.append(f\"{col_name} {col_type}\")\n\n        create_query = f\"CREATE TABLE {quoted_plugin} ({', '.join(quoted_fields)});\"\n        try:\n            self.client.execute(create_query)\n        except Exception as e:\n            logger.error(f\"Cannot create table {plugin}: {e}\")\n            return\n\n    self.client.commit()\n\n    # Insert with quoted table name\n    quoted_plugin = _quote_identifier(plugin)\n    for values in values_list:\n        insert_query = f\"INSERT INTO {quoted_plugin} VALUES ({', '.join(['?' for _ in values])});\"\n        try:\n            self.client.execute(insert_query, values)\n        except Exception as e:\n            logger.error(f\"Cannot insert data into table {plugin}: {e}\")\n\n    self.client.commit()\n```",
                    "title": "github - https://github.com/advisories/GHSA-49g7-2ww7-3vf5"
                },
                {
                    "category": "description",
                    "text": "Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.",
                    "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-32611"
                },
                {
                    "category": "description",
                    "text": "Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.",
                    "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-32611"
                },
                {
                    "category": "description",
                    "text": "Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.",
                    "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-32611"
                },
                {
                    "category": "description",
                    "text": "## Summary\n\nThe GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names.\n\n## Details\n\nThe DuckDB export module constructs SQL DDL statements by directly interpolating stat field names and plugin names into f-strings.\n\n**Vulnerable CREATE TABLE construction** (`glances/exports/glances_duckdb/__init__.py:156-162`):\n\n```python\ncreate_query = f\"\"\"\nCREATE TABLE {plugin} (\n{', '.join(creation_list)}\n);\"\"\"\nself.client.execute(create_query)\n```\n\nThe `creation_list` is built from stat dictionary keys in the `update()` method (`glances/exports/glances_duckdb/__init__.py:117-118`):\n\n```python\nfor key, value in plugin_stats.items():\n    creation_list.append(f\"{key} {convert_types[type(self.normalize(value)).__name__]}\")\n```\n\nThe INSERT statement also uses the unescaped `plugin` name (`glances/exports/glances_duckdb/__init__.py:172-174`):\n\n```python\ninsert_query = f\"\"\"\nINSERT INTO {plugin} VALUES (\n{', '.join(['?' for _ in values])}\n);\"\"\"\n```\n\nWhile INSERT values use `?` placeholders (safe), the table name `{plugin}` is directly interpolated in both CREATE TABLE and INSERT INTO statements. Column names in creation_list are also directly interpolated without quoting.\n\n**Comparison with the TimescaleDB fix (commit 39161f0):**\n\nThe TimescaleDB fix addressed this exact pattern by:\n1. Using `psycopg.sql.Identifier()` for table and column names\n2. Using `psycopg.sql.SQL()` for composing queries\n3. Using `%s` placeholders for all values\n\nThe DuckDB module was not part of this fix despite having the same vulnerability class.\n\n**Attack vector:**\n\nThe primary attack vector is through stat dictionary keys. While most keys come from hardcoded psutil field names (e.g., `cpu_percent`, `memory_usage`), any future plugin that introduces dynamic keys from external data (container labels, custom metrics, user-defined sensor names) would create an exploitable injection path. Additionally, the table name (`plugin`) comes from the internal plugins list, but any custom plugin with a crafted name could inject SQL.\n\n## PoC\n\nThe injection is demonstrable when column or table names contain SQL metacharacters:\n\n```python\n# Simulated injection via a hypothetical plugin with dynamic keys\n# If a stat dict contained a key like:\n#   \"cpu_percent BIGINT); DROP TABLE cpu; --\"\n# The creation_list would produce:\n#   \"cpu_percent BIGINT); DROP TABLE cpu; -- VARCHAR\"\n# Which in the CREATE TABLE f-string becomes:\n#   CREATE TABLE plugin_name (\n#     time TIMETZ,\n#     hostname_id VARCHAR,\n#     cpu_percent BIGINT); DROP TABLE cpu; -- VARCHAR\n#   );\n```\n\n```bash\n# Verify with DuckDB export enabled:\n# 1. Configure DuckDB export in glances.conf:\n# [duckdb]\n# database=/tmp/glances.duckdb\n\n# 2. Start Glances with DuckDB export and debug logging\nglances --export duckdb --debug 2>&1 | grep \"Create table\"\n\n# 3. Observe the unescaped SQL in debug output\n```\n\n## Impact\n\n- **Defense-in-depth gap:** The identical vulnerability pattern was identified and fixed in TimescaleDB (GHSA-x46r) but the fix was not applied to the sibling DuckDB module. This represents an incomplete patch that leaves the same attack surface open through a different code path.\n\n- **Future exploitability:** If any Glances plugin is added or modified to produce stat dictionary keys from external/user-controlled data (e.g., container metadata, custom metric names, SNMP OID labels), the DuckDB export would become immediately exploitable for SQL injection without any additional code changes.\n\n- **Data integrity:** A successful injection in the CREATE TABLE statement could corrupt the DuckDB database, create unauthorized tables, or modify schema in ways that affect other applications reading from the same database file.\n\n## Recommended Fix\n\nApply the same parameterization approach used in the TimescaleDB fix. DuckDB supports identifier quoting with double quotes:\n\n```python\n# glances/exports/glances_duckdb/__init__.py\n\ndef _quote_identifier(name):\n    \"\"\"Quote a SQL identifier to prevent injection.\"\"\"\n    # DuckDB uses double-quote escaping for identifiers\n    return '\"' + name.replace('\"', '\"\"') + '\"'\n\ndef export(self, plugin, creation_list, values_list):\n    \"\"\"Export the stats to the DuckDB server.\"\"\"\n    logger.debug(f\"Export {plugin} stats to DuckDB\")\n\n    table_list = [t[0] for t in self.client.sql(\"SHOW TABLES\").fetchall()]\n    if plugin not in table_list:\n        # Quote table and column names to prevent injection\n        quoted_plugin = _quote_identifier(plugin)\n        quoted_fields = []\n        for item in creation_list:\n            parts = item.split(' ', 1)\n            col_name = _quote_identifier(parts[0])\n            col_type = parts[1] if len(parts) > 1 else 'VARCHAR'\n            quoted_fields.append(f\"{col_name} {col_type}\")\n\n        create_query = f\"CREATE TABLE {quoted_plugin} ({', '.join(quoted_fields)});\"\n        try:\n            self.client.execute(create_query)\n        except Exception as e:\n            logger.error(f\"Cannot create table {plugin}: {e}\")\n            return\n\n    self.client.commit()\n\n    # Insert with quoted table name\n    quoted_plugin = _quote_identifier(plugin)\n    for values in values_list:\n        insert_query = f\"INSERT INTO {quoted_plugin} VALUES ({', '.join(['?' for _ in values])});\"\n        try:\n            self.client.execute(insert_query, values)\n        except Exception as e:\n            logger.error(f\"Cannot insert data into table {plugin}: {e}\")\n\n    self.client.commit()\n```",
                    "title": "github - https://api.github.com/advisories/GHSA-49g7-2ww7-3vf5"
                },
                {
                    "category": "description",
                    "text": "Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix (commit 39161f0) addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and `psycopg.sql` composable objects. However, the DuckDB export module (`glances/exports/glances_duckdb/__init__.py`) was not included in this fix and contains the same class of vulnerability: table names and column names derived from monitoring statistics are directly interpolated into SQL statements via f-strings. While DuckDB INSERT values already use parameterized queries (`?` placeholders), the DDL construction and table name references do not escape or parameterize identifier names. Version 4.5.3 provides a more complete fix.",
                    "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32611"
                },
                {
                    "category": "other",
                    "text": "0.0001",
                    "title": "EPSS"
                },
                {
                    "category": "other",
                    "text": "3.6",
                    "title": "NCSC Score"
                },
                {
                    "category": "other",
                    "text": "The value of the most recent CVSS (V3) score, Exploit code publicly available, There is exploit data available from source Nvd",
                    "title": "NCSC Score top decreasing factors"
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-5841720",
                    "CSAFPID-5843883"
                ]
            },
            "references": [
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://github.com/advisories/GHSA-49g7-2ww7-3vf5"
                },
                {
                    "category": "external",
                    "summary": "Source raw - github",
                    "url": "https://api.github.com/advisories/GHSA-49g7-2ww7-3vf5"
                },
                {
                    "category": "external",
                    "summary": "Source - cveprojectv5",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2026-32611"
                },
                {
                    "category": "external",
                    "summary": "Source raw - cveprojectv5",
                    "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/32xxx/CVE-2026-32611.json"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32611"
                },
                {
                    "category": "external",
                    "summary": "Source raw - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32611"
                },
                {
                    "category": "external",
                    "summary": "Source - debian",
                    "url": "https://security-tracker.debian.org/tracker/CVE-2026-32611"
                },
                {
                    "category": "external",
                    "summary": "Source - github",
                    "url": "https://api.github.com/advisories/GHSA-49g7-2ww7-3vf5"
                },
                {
                    "category": "external",
                    "summary": "Source - nvd",
                    "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-32611"
                },
                {
                    "category": "external",
                    "summary": "Source - first",
                    "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd",
                    "url": "https://github.com/nicolargo/glances/security/advisories/GHSA-49g7-2ww7-3vf5"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd",
                    "url": "https://github.com/nicolargo/glances/commit/63b7da28895249d775202d639e5531ba63491a5c"
                },
                {
                    "category": "external",
                    "summary": "Reference - cveprojectv5; github; nvd",
                    "url": "https://github.com/nicolargo/glances/releases/tag/v4.5.2"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://github.com/advisories/GHSA-49g7-2ww7-3vf5"
                },
                {
                    "category": "external",
                    "summary": "Reference - github",
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32611"
                }
            ],
            "scores": [
                {
                    "cvss_v3": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
                        "baseScore": 7.0,
                        "baseSeverity": "HIGH"
                    },
                    "products": [
                        "CSAFPID-5841720",
                        "CSAFPID-5843883"
                    ]
                }
            ],
            "title": "CVE-2026-32611"
        }
    ]
}