{"metadata": {"vulnerability": "CVE-2026-47429", "count": 28, "kinds": {"milestone": 5, "sighting": 5, "kev": 0, "other": 18}}, "data": [{"timestamp": "2026-05-19T09:24:23Z", "date_only": false, "value": "2026-05-19T09:24:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "e2c1abbd-97b9-4484-ba21-9e557b2923b1", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-05-19T19:37:43.527Z", "date_only": false, "value": "2026-05-19T19:37:43.527Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-47429", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-01T14:09:53Z", "date_only": false, "value": "2026-06-01T14:09:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5XRQ-8626-4RWP", "record": "GHSA-5XRQ-8626-4RWP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-07T23:20:25.452Z", "date_only": false, "value": "2026-06-07T23:20:25.452654Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mnqcloetts2r", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "204828ac-eb7e-4791-aaec-a43350c0128b", "content": "JavaScript \u30c6\u30b9\u30c8\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af Vitest\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027(VE-2026-47428,CVE-2026-47429,CVE\u672a\u63a1\u756a)\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mnqcloetts2r"}, {"timestamp": "2026-06-09T11:00:07Z", "date_only": false, "value": "2026-06-09T11:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cFkqaiLeMF7rcnyy-4alEvGOnwxzqn60V0GjpreyOt3-Yxw", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "70ffff1a-3271-4119-9a47-48c9d5cfb966", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-03T22:08:04.921Z", "date_only": false, "value": "2026-07-03T22:08:04.921396Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprkoe7q362x", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "c9fa1e0f-7970-4e57-a9f4-0d1e07e645a9", "content": "CVE-2026-47429 - @rootio/vitest\nThe Root vitest package had a vulnerability that could allow an attacker to execute unauthorized code. This could have let a malicious user access or modify sensitive data.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootio #Rootnpm #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mprkoe7q362x"}, {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T19:28:08.688Z", "date_only": false, "value": "2026-07-14T19:28:08.688Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-47429", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T19:28:08.688Z", "date_only": false, "value": "2026-07-14T19:28:08.688000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T19:28:08.688Z", "date_only": false, "value": "2026-07-14T19:28:08.688Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-47429", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-14T19:30:19.670Z", "date_only": false, "value": "2026-07-14T19:30:19.670000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-07-14T19:40:05.831Z", "date_only": false, "value": "2026-07-14T19:40:05.831331Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmxjui5ty2t", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "641e59ae-0df8-4a68-a91f-59396d419780", "content": "CVE-2026-47429 - vitest\nIf you're using Vitest UI on Windows and exposing it to the network, or running it on Windows without proper security, an attacker could access and execute arbitrary files.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vitest #GitHubActions #npm #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqmxjui5ty2t"}, {"timestamp": "2026-07-14T20:03:20.665Z", "date_only": false, "value": "2026-07-14T20:03:20.665764+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T20:03:51.551Z", "date_only": false, "value": "2026-07-14T20:03:51.551433+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-07-14T20:17:02Z", "date_only": false, "value": "2026-07-14T20:17:02Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5XRQ-8626-4RWP", "record": "GHSA-5XRQ-8626-4RWP", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-14T20:17:02.460Z", "date_only": false, "value": "2026-07-14T20:17:02.460", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47429", "record": "FKIE_CVE-2026-47429", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-21T15:02:06.439Z", "date_only": false, "value": "2026-07-21T15:02:06.439415Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-47429", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-21T15:02:06.439Z", "date_only": false, "value": "2026-07-21T15:02:06.439415Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47429", "record": "FKIE_CVE-2026-47429", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-21T15:02:17.187Z", "date_only": false, "value": "2026-07-21T15:02:17.187Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-47429", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-21T15:02:17.187Z", "date_only": false, "value": "2026-07-21T15:02:17.187Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-47429", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-13T18:19:29Z", "date_only": false, "value": "2026-08-13T18:19:29Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5XRQ-8626-4RWP", "record": "GHSA-5XRQ-8626-4RWP", "field": "modified"}, {"timestamp": "2026-09-04T00:36:24Z", "date_only": false, "value": "2026-09-04T00:36:24+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-08T00:10:46Z", "date_only": false, "value": "2026-09-08T00:10:46+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-08T00:10:46Z", "date_only": false, "value": "2026-09-08T00:10:46+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-08T00:10:46Z", "date_only": false, "value": "2026-09-08T00:10:46+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-24T21:10:00.130Z", "date_only": false, "value": "2026-10-24T21:10:00.130", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-47429", "record": "FKIE_CVE-2026-47429", "field": "lastModified"}], "metrics": {"as_of": "2026-10-31T03:51:42.343Z", "anchors": {"origin": {"timestamp": "2026-07-14T20:03:20.665Z", "date_only": false, "value": "2026-07-14T20:03:20.665764+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "discovery": {"timestamp": "2026-07-14T20:03:20.665Z", "date_only": false, "value": "2026-07-14T20:03:20.665764+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-01T14:09:53Z", "date_only": false, "value": "2026-06-01T14:09:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5XRQ-8626-4RWP", "record": "GHSA-5XRQ-8626-4RWP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-05-19T09:24:23Z", "date_only": false, "value": "2026-05-19T09:24:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "e2c1abbd-97b9-4484-ba21-9e557b2923b1", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": -1140330.0, "hours": -316.7583333333333, "days": -13.198263888888889, "min_seconds": -1140330.0, "max_seconds": -1140330.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-06-01T14:09:53Z", "date_only": false, "value": "2026-06-01T14:09:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5XRQ-8626-4RWP", "record": "GHSA-5XRQ-8626-4RWP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-05-19T09:24:23Z", "date_only": false, "value": "2026-05-19T09:24:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "e2c1abbd-97b9-4484-ba21-9e557b2923b1", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": -73231.665, "hours": -20.342129166666666, "days": -0.8475887152777777, "min_seconds": -73231.665, "max_seconds": -73231.665, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-07-14T20:03:20.665Z", "date_only": false, "value": "2026-07-14T20:03:20.665764+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "disclosure_to_patch": {"available": true, "seconds": 3663176.0, "hours": 1017.5488888888889, "days": 42.39787037037037, "min_seconds": 3663176.0, "max_seconds": 3663176.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-01T14:09:53Z", "date_only": false, "value": "2026-06-01T14:09:53Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5XRQ-8626-4RWP", "record": "GHSA-5XRQ-8626-4RWP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-07-14T20:03:20.665Z", "date_only": false, "value": "2026-07-14T20:03:20.665764+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 4803506.0, "hours": 1334.3072222222222, "days": 55.59613425925926, "min_seconds": 4803506.0, "max_seconds": 4803506.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-19T09:24:23Z", "date_only": false, "value": "2026-05-19T09:24:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "record": "CVE-2026-47429", "field": "creation_timestamp", "uuid": "e2c1abbd-97b9-4484-ba21-9e557b2923b1", "url": "https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-07-13T23:42:49Z", "date_only": false, "value": "2026-07-13T23:42:49+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:39058", "record": "RHSA-2026:39058", "field": "vulnerabilities.1.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}}}