Search
Find a vulnerability
Search criteria
4 vulnerabilities by OpenHands
CVE-2026-112346 (GCVE-0-2026-112346)
Vulnerability from nvd – Published: 2026-10-26 15:34 – Updated: 2026-10-26 15:34 X_Open Source
VLAI
EPSS
VEX
Title
OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
Summary
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Severity
9.8 (Critical)
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/OpenHands/software-agent-sdk/r… | release-notes |
| https://github.com/OpenHands/software-agent-sdk/p… | issue-tracking |
| https://github.com/OpenHands/software-agent-sdk/c… | patch |
| https://www.vulncheck.com/advisories/openhands-so… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenHands | OpenHands Software Agent SDK |
Affected:
0 , < 1.52.0
(semver)
|
Date Public
2026-09-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/OpenHands/software-agent-sdk",
"product": "OpenHands Software Agent SDK",
"repo": "https://github.com/OpenHands/software-agent-sdk",
"vendor": "OpenHands",
"versions": [
{
"lessThan": "1.52.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mil4n"
}
],
"datePublic": "2026-09-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:34:30.749Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Fixed Release Tag",
"tags": [
"release-notes"
],
"url": "https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.52.0"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/OpenHands/software-agent-sdk/pull/5209"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/OpenHands/software-agent-sdk/commit/7b66584ff8899144eb4ce679c2811861342af9de"
},
{
"name": "VulnCheck Advisory: OpenHands Software Agent SDK \u003c 1.52.0 Unauthenticated Sandbox Agent Server RCE",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "OpenHands Software Agent SDK \u003c 1.52.0 Unauthenticated Sandbox Agent Server RCE",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112346",
"datePublished": "2026-10-26T15:34:30.749Z",
"dateReserved": "2026-10-19T14:41:46.702Z",
"dateUpdated": "2026-10-26T15:34:30.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33718 (GCVE-0-2026-33718)
Vulnerability from nvd – Published: 2026-03-27 00:12 – Updated: 2026-03-27 20:04
VLAI
EPSS
VEX
Title
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
Summary
OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 20:04 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OpenHands/OpenHands/security/a… | x_refsource_CONFIRM |
| https://github.com/OpenHands/OpenHands/pull/13051 | x_refsource_MISC |
| https://docs.python.org/3/library/shlex.html#shle… | x_refsource_MISC |
| https://docs.python.org/3/library/subprocess.html… | x_refsource_MISC |
| https://owasp.org/www-community/attacks/Command_I… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33718",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T20:04:41.208442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T20:04:54.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenHands",
"vendor": "OpenHands",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T00:12:24.752Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw"
},
{
"name": "https://github.com/OpenHands/OpenHands/pull/13051",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenHands/OpenHands/pull/13051"
},
{
"name": "https://docs.python.org/3/library/shlex.html#shlex.quote",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.python.org/3/library/shlex.html#shlex.quote"
},
{
"name": "https://docs.python.org/3/library/subprocess.html#security-considerations",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.python.org/3/library/subprocess.html#security-considerations"
},
{
"name": "https://owasp.org/www-community/attacks/Command_Injection",
"tags": [
"x_refsource_MISC"
],
"url": "https://owasp.org/www-community/attacks/Command_Injection"
}
],
"source": {
"advisory": "GHSA-7h8w-hj9j-8rjw",
"discovery": "UNKNOWN"
},
"title": "OpenHands is Vulnerable to Command Injection through its Git Diff Handler"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33718",
"datePublished": "2026-03-27T00:12:24.752Z",
"dateReserved": "2026-03-23T17:06:05.749Z",
"dateUpdated": "2026-03-27T20:04:54.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112346 (GCVE-0-2026-112346)
Vulnerability from cvelistv5 – Published: 2026-10-26 15:34 – Updated: 2026-10-26 15:34 X_Open Source
VLAI
EPSS
VEX
Title
OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE
Summary
OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store.
Severity
9.8 (Critical)
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/OpenHands/software-agent-sdk/r… | release-notes |
| https://github.com/OpenHands/software-agent-sdk/p… | issue-tracking |
| https://github.com/OpenHands/software-agent-sdk/c… | patch |
| https://www.vulncheck.com/advisories/openhands-so… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| OpenHands | OpenHands Software Agent SDK |
Affected:
0 , < 1.52.0
(semver)
|
Date Public
2026-09-21 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/OpenHands/software-agent-sdk",
"product": "OpenHands Software Agent SDK",
"repo": "https://github.com/OpenHands/software-agent-sdk",
"vendor": "OpenHands",
"versions": [
{
"lessThan": "1.52.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mil4n"
}
],
"datePublic": "2026-09-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling authentication by default. Attackers who can reach the published container port can send unauthenticated HTTP and WebSocket requests to execute arbitrary shell commands as root in the sandbox, access the mounted workspace, and read plaintext secrets from the secrets store."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T15:34:30.749Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Fixed Release Tag",
"tags": [
"release-notes"
],
"url": "https://github.com/OpenHands/software-agent-sdk/releases/tag/v1.52.0"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking"
],
"url": "https://github.com/OpenHands/software-agent-sdk/pull/5209"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/OpenHands/software-agent-sdk/commit/7b66584ff8899144eb4ce679c2811861342af9de"
},
{
"name": "VulnCheck Advisory: OpenHands Software Agent SDK \u003c 1.52.0 Unauthenticated Sandbox Agent Server RCE",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openhands-software-agent-sdk-unauthenticated-sandbox-agent-server-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_open-source"
],
"title": "OpenHands Software Agent SDK \u003c 1.52.0 Unauthenticated Sandbox Agent Server RCE",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-112346",
"datePublished": "2026-10-26T15:34:30.749Z",
"dateReserved": "2026-10-19T14:41:46.702Z",
"dateUpdated": "2026-10-26T15:34:30.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33718 (GCVE-0-2026-33718)
Vulnerability from cvelistv5 – Published: 2026-03-27 00:12 – Updated: 2026-03-27 20:04
VLAI
EPSS
VEX
Title
OpenHands is Vulnerable to Command Injection through its Git Diff Handler
Summary
OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 20:04 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OpenHands/OpenHands/security/a… | x_refsource_CONFIRM |
| https://github.com/OpenHands/OpenHands/pull/13051 | x_refsource_MISC |
| https://docs.python.org/3/library/shlex.html#shle… | x_refsource_MISC |
| https://docs.python.org/3/library/subprocess.html… | x_refsource_MISC |
| https://owasp.org/www-community/attacks/Command_I… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33718",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T20:04:41.208442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T20:04:54.607Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OpenHands",
"vendor": "OpenHands",
"versions": [
{
"status": "affected",
"version": "\u003c 1.5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenHands is software for AI-driven development. Starting in version 1.5.0, a Command Injection vulnerability exists in the `get_git_diff()` method at `openhands/runtime/utils/git_handler.py:134`. The `path` parameter from the `/api/conversations/{conversation_id}/git/diff` API endpoint is passed unsanitized to a shell command, allowing authenticated attackers to execute arbitrary commands in the agent sandbox. The user is already allowed to instruct the agent to execute commands, but this bypasses the normal channels. Version 1.5.0 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T00:12:24.752Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OpenHands/OpenHands/security/advisories/GHSA-7h8w-hj9j-8rjw"
},
{
"name": "https://github.com/OpenHands/OpenHands/pull/13051",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OpenHands/OpenHands/pull/13051"
},
{
"name": "https://docs.python.org/3/library/shlex.html#shlex.quote",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.python.org/3/library/shlex.html#shlex.quote"
},
{
"name": "https://docs.python.org/3/library/subprocess.html#security-considerations",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.python.org/3/library/subprocess.html#security-considerations"
},
{
"name": "https://owasp.org/www-community/attacks/Command_Injection",
"tags": [
"x_refsource_MISC"
],
"url": "https://owasp.org/www-community/attacks/Command_Injection"
}
],
"source": {
"advisory": "GHSA-7h8w-hj9j-8rjw",
"discovery": "UNKNOWN"
},
"title": "OpenHands is Vulnerable to Command Injection through its Git Diff Handler"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33718",
"datePublished": "2026-03-27T00:12:24.752Z",
"dateReserved": "2026-03-23T17:06:05.749Z",
"dateUpdated": "2026-03-27T20:04:54.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}