{"id":"CVE-2026-59728","aliases":["CLSA-2026-1784596299","CLSA-2026-1784943236","CLSA-2026-1792161555","CLSA-2026-1792161559","CLSA-2026-1792161694","CLSA-2026-1792161701","CLSA-2026-1792161786","CLSA-2026-1792161789","CLSA-2026-1792161855","CLSA-2026-1793093746","CLSA-2026-1793093842","EUVD-2026-49584","GHSA-8j5q-mfj2-5q9q"],"status":"published","title":"@astrojs/rss: XML Injection via Unescaped RSS Feed Fields","description":"Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing \u003c/source\u003e can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake \u003clink\u003e pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00322,"percentile":0.25601,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-91"],"published":"2026-07-20T23:21:47Z","modified":"2026-10-30T19:46:02Z","fixes":[{"ecosystem":"npm","package":"@astrojs/rss","fixed_in":["4.0.19"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/rss","fixed_in":["3.6.5-tuxcare.3","2.10.15-tuxcare.5","4.0.1-tuxcare.1","4.0.2-tuxcare.1"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","fixed_in":["3.6.5-tuxcare.3","2.10.15-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/prism","fixed_in":["3.6.5-tuxcare.3","2.10.15-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","fixed_in":["3.6.5-tuxcare.3","2.10.15-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","fixed_in":["3.6.5-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"4.0.19"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.3"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.5"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.3"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.5"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.3"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.5"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.3"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.15-tuxcare.0"},{"fixed":"2.10.15-tuxcare.5"}]}],"versions":["2.10.15","2.10.15-tuxcare.1","2.10.15-tuxcare.2","2.10.15-tuxcare.3","2.10.15-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.6.5-tuxcare.0"},{"fixed":"3.6.5-tuxcare.3"}]}],"versions":["3.6.5","3.6.5-tuxcare.1","3.6.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.1"}]}],"versions":["4.0.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.2-tuxcare.0"},{"fixed":"4.0.2-tuxcare.1"}]}],"versions":["4.0.2"]},{"source":"osv","ecosystem":"npm","package":"@astrojs/rss","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"4.0.19"}]}]}],"products":[{"vendor":"withastro","product":"astro"}],"references":[{"url":"https://github.com/withastro/astro/security/advisories/GHSA-8j5q-mfj2-5q9q","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/withastro/astro/pull/17209","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/withastro/astro/commit/fbcfa039dfe3d700b239f595a6c55ee35e45bd06","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/withastro/astro/releases/tag/@astrojs/rss@4.0.19","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59728","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8j5q-mfj2-5q9q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59728.json","tags":["advisory"]},{"url":"https://github.com/withastro/astro","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-59728","title":"@astrojs/rss: XML Injection via Unescaped RSS Feed Fields","description":"Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing \u003c/source\u003e can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake \u003clink\u003e pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.","status":"published","published":"2026-07-27T19:54:23.009Z","modified":"2026-07-28T14:27:56.334Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-49584","description":"Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing \u003c/source\u003e can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake \u003clink\u003e pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.","status":"published","published":"2026-07-27T19:54:23Z","modified":"2026-07-28T14:27:56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:31.399718Z"}],"ghsa":[{"id":"GHSA-8j5q-mfj2-5q9q","title":"@astrojs/rss: XML Injection via Unescaped RSS Feed Fields","description":"## Summary\n\nIn `@astrojs/rss`, the `source.title` and `enclosure.type` item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by `fast-xml-parser`. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed.\n\n## Details\n\nTwo fields in `packages/astro-rss/src/index.ts` are affected:\n\n### `source.title`\n\n```typescript\nitem.source = parser.parse(\n  `\u003csource url=\"${result.source.url}\"\u003e${result.source.title}\u003c/source\u003e`,\n).source;\n```\n\n`source.title` is validated only as `z.string()`, with no restriction on XML special characters. A value containing `\u003c/source\u003e` followed by arbitrary XML is parsed as real XML elements, merging injected nodes into the RSS item.\n\n### `enclosure.type`\n\n```typescript\nitem.enclosure = parser.parse(\n  `\u003cenclosure url=\"${enclosureURL}\" length=\"${result.enclosure.length}\" type=\"${result.enclosure.type}\"/\u003e`,\n).enclosure;\n```\n\n`enclosure.type` is also `z.string()` and is interpolated into an XML attribute without escaping. A value containing `\"` followed by additional XML can break out of the attribute and inject extra elements.\n\n## Proof of Concept\n\n`source.title` injection:\n\n```javascript\nsource: {\n  url: 'https://legit.example.com',\n  title: '\u003c/source\u003e\u003citem\u003e\u003ctitle\u003eINJECTED\u003c/title\u003e\u003clink\u003ehttps://evil.com\u003c/link\u003e\u003c/item\u003e\u003csource\u003e',\n}\n// Result: RSS feed contains an injected \u003citem\u003e element with an evil.com link\n```\n\n`enclosure.type` injection:\n\n```javascript\nenclosure: {\n  url: 'https://example.com/a.mp3',\n  length: 0,\n  type: 'audio/mpeg\" /\u003e\u003clink\u003ehttps://evil.example.com\u003c/link\u003e\u003cenclosure fake=\"',\n}\n// Result: RSS feed contains an injected \u003clink\u003e element\n```\n\nBoth injections were confirmed with `fast-xml-parser`: the injected `\"link\": \"https://evil.com\"` appears in the parsed output.\n\n## Impact\n\nAn attacker who can control `source.title` or `enclosure.type` values (e.g., via a CMS, database, or user-submitted content that populates `RSSFeedItem`) can inject arbitrary XML into the generated RSS feed. This corrupts feed structure, injects false metadata (e.g., a fake `\u003clink\u003e` pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (`output: 'server'`), the poisoned feed is served on every request to all subscribers.\n\n## Patches\n\nFixed in `@astrojs/rss@4.0.19`.","status":"published","published":"2026-07-20T23:21:47Z","modified":"2026-08-12T20:37:28Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-59728","description":"Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing \u003c/source\u003e can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake \u003clink\u003e pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.","status":"published","published":"2026-07-27T21:17:05.7Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:12:33.249634Z"}],"osv":[{"id":"CVE-2026-59728","title":"@astrojs/rss: XML Injection via Unescaped RSS Feed Fields","description":"Astro is a web framework for content-driven websites. In versions 1.0.0 through 4.0.18, the source.title and enclosure.type item fields in packages/astro-rss/src/index.ts are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. Both fields are validated only as z.string(), placing no restriction on XML special characters. An attacker who controls these values can inject arbitrary XML into the generated RSS feed: a value containing \" can break out of an attribute (as with enclosure.type), and a value containing \u003c/source\u003e can close an element early and inject additional nodes (as with source.title). This corrupts feed structure, injects false metadata (for example, a fake \u003clink\u003e pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (output: 'server'), the poisoned feed is served on every request to all subscribers. This issue has been fixed in version 4.0.19.","status":"published","published":"2026-07-27T19:54:23.009Z","modified":"2026-10-28T02:31:12.0724287Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-8j5q-mfj2-5q9q","title":"@astrojs/rss: XML Injection via Unescaped RSS Feed Fields","description":"## Summary\n\nIn `@astrojs/rss`, the `source.title` and `enclosure.type` item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by `fast-xml-parser`. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS feed.\n\n## Details\n\nTwo fields in `packages/astro-rss/src/index.ts` are affected:\n\n### `source.title`\n\n```typescript\nitem.source = parser.parse(\n  `\u003csource url=\"${result.source.url}\"\u003e${result.source.title}\u003c/source\u003e`,\n).source;\n```\n\n`source.title` is validated only as `z.string()`, with no restriction on XML special characters. A value containing `\u003c/source\u003e` followed by arbitrary XML is parsed as real XML elements, merging injected nodes into the RSS item.\n\n### `enclosure.type`\n\n```typescript\nitem.enclosure = parser.parse(\n  `\u003cenclosure url=\"${enclosureURL}\" length=\"${result.enclosure.length}\" type=\"${result.enclosure.type}\"/\u003e`,\n).enclosure;\n```\n\n`enclosure.type` is also `z.string()` and is interpolated into an XML attribute without escaping. A value containing `\"` followed by additional XML can break out of the attribute and inject extra elements.\n\n## Proof of Concept\n\n`source.title` injection:\n\n```javascript\nsource: {\n  url: 'https://legit.example.com',\n  title: '\u003c/source\u003e\u003citem\u003e\u003ctitle\u003eINJECTED\u003c/title\u003e\u003clink\u003ehttps://evil.com\u003c/link\u003e\u003c/item\u003e\u003csource\u003e',\n}\n// Result: RSS feed contains an injected \u003citem\u003e element with an evil.com link\n```\n\n`enclosure.type` injection:\n\n```javascript\nenclosure: {\n  url: 'https://example.com/a.mp3',\n  length: 0,\n  type: 'audio/mpeg\" /\u003e\u003clink\u003ehttps://evil.example.com\u003c/link\u003e\u003cenclosure fake=\"',\n}\n// Result: RSS feed contains an injected \u003clink\u003e element\n```\n\nBoth injections were confirmed with `fast-xml-parser`: the injected `\"link\": \"https://evil.com\"` appears in the parsed output.\n\n## Impact\n\nAn attacker who can control `source.title` or `enclosure.type` values (e.g., via a CMS, database, or user-submitted content that populates `RSSFeedItem`) can inject arbitrary XML into the generated RSS feed. This corrupts feed structure, injects false metadata (e.g., a fake `\u003clink\u003e` pointing to a malicious URL), and can cause feed readers to misparse or display attacker-controlled content. In SSR mode (`output: 'server'`), the poisoned feed is served on every request to all subscribers.\n\n## Patches\n\nFixed in `@astrojs/rss@4.0.19`.","status":"published","published":"2026-07-20T23:21:47Z","modified":"2026-08-12T20:45:07.738233105Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"CLSA-2026-1784596299","title":"TuxCare security update for @astrojs/rss (1 CVE)","description":"TuxCare rebuilt @astrojs/rss to address 1 CVE. Fixed in 3.6.5-tuxcare.3.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-30T19:45:58.821136028Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784943236","title":"TuxCare security update for @astrojs/rss (1 CVE)","description":"TuxCare rebuilt @astrojs/rss to address 1 CVE. Fixed in 2.10.15-tuxcare.5.","status":"published","published":"2026-08-04T14:52:49Z","modified":"2026-10-30T19:46:02.530801275Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792161555","title":"TuxCare security update for @astrojs/internal-helpers (1 CVE)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 1 CVE. Fixed in 3.6.5-tuxcare.3.","status":"published","published":"2026-10-16T14:39:15Z","modified":"2026-10-16T16:31:27.013156792Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161559","title":"TuxCare security update for @astrojs/internal-helpers (1 CVE)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 1 CVE. Fixed in 2.10.15-tuxcare.5.","status":"published","published":"2026-10-16T14:39:19Z","modified":"2026-10-16T16:31:11.744000343Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161694","title":"TuxCare security update for @astrojs/prism (1 CVE)","description":"TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 3.6.5-tuxcare.3.","status":"published","published":"2026-10-16T14:41:34Z","modified":"2026-10-16T16:31:07.828929014Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161701","title":"TuxCare security update for @astrojs/prism (1 CVE)","description":"TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 2.10.15-tuxcare.5.","status":"published","published":"2026-10-16T14:41:41Z","modified":"2026-10-16T16:31:14.351257442Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161786","title":"TuxCare security update for @astrojs/underscore-redirects (1 CVE)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 3.6.5-tuxcare.3.","status":"published","published":"2026-10-16T14:43:06Z","modified":"2026-10-16T16:30:29.17803581Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161789","title":"TuxCare security update for @astrojs/underscore-redirects (1 CVE)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 2.10.15-tuxcare.5.","status":"published","published":"2026-10-16T14:43:09Z","modified":"2026-10-16T16:30:29.176479678Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161855","title":"TuxCare security update for @astrojs/upgrade (1 CVE)","description":"TuxCare rebuilt @astrojs/upgrade to address 1 CVE. Fixed in 3.6.5-tuxcare.3.","status":"published","published":"2026-10-16T14:44:15Z","modified":"2026-10-16T16:31:15.760295721Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1793093746","title":"TuxCare security update for @astrojs/rss (1 CVE)","description":"TuxCare rebuilt @astrojs/rss to address 1 CVE. Fixed in 4.0.1-tuxcare.1.","status":"published","published":"2026-10-27T09:35:46Z","modified":"2026-10-27T13:30:02.654867582Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793093842","title":"TuxCare security update for @astrojs/rss (1 CVE)","description":"TuxCare rebuilt @astrojs/rss to address 1 CVE. Fixed in 4.0.2-tuxcare.1.","status":"published","published":"2026-10-27T09:37:22Z","modified":"2026-10-27T13:30:02.67156402Z","updated_at":"2026-11-02T15:43:55.34846Z"}]}}