CVE-2026-2741

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-2741
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2741.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-2741
Aliases
Published
2026-03-10T12:08:30.515Z
Modified
2026-08-07T11:50:43.254836040Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/R:U/V:D/RE:L/U:Amber CVSS Calculator
Summary
Zip Slip Path Traversal on Node Unpack
Details

Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2.

Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory.

Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 15.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer.

Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version.

Database specific 
{
    "cna_assigner": "Vaadin",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2741.json",
    "cwe_ids": [
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/vaadin/flow

Affected ranges

Type
GIT
Repo
https://github.com/vaadin/flow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f629e550348397e0b4a976afbbf2594c8d21332d
Introduced
f5bd08834302a4f461b920dea6d0be8808e88a50
Last affected
c376b4e8a9991df767172e3fef4dabe059178a68
Last affected
a7e103f0bca6bca9eefa1039916ef1c1a8156b0a
Introduced
d3e5f6448dd0563cd62137836ea4fd5be69c9067
Last affected
d50248fd4f0d9b50b784db977f72c22edc22e82e
Last affected
9eec2f7d65b74e8593882fce0f134c2503b6a7d6
Introduced
8fd9c0846224fabc22b37124952555f6bf920518
Last affected
02bb22cdab8d90dcfdce70dc05842481d0ed17be
Introduced
4b6ca4330163c4e976b32d03880fe2154a9d1ca7
Last affected
90076b751b26030a271942c3d523b732ced97219
Database specific 
{
    "extracted_events": [
        {
            "introduced": "15.0.0"
        },
        {
            "last_affected": "23.6.6"
        },
        {
            "introduced": "24.0.0"
        },
        {
            "last_affected": "24.9.8"
        },
        {
            "last_affected": "24.9.9"
        },
        {
            "introduced": "25.0.0"
        },
        {
            "last_affected": "25.0.2"
        },
        {
            "last_affected": "25.0.3"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "last_affected": "2.13.0"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "23.6.7"
        }
    ],
    "source": "AFFECTED_FIELD"
}
Type
GIT
Repo
https://github.com/vaadin/platform
Events
Introduced
8d628e5e572caafefd44db574106bd3a10ac48cd
Fixed
ecdbd581aa8f05d30390b791c53a3d61a25fda3c
Introduced
354ad0186b5e61b548adad84de03af297dc6f2a6
Fixed
e576f406b9f7f28cc7df549145e7983cd4efb25c
Introduced
6aea8fa5fdf6b2c7645a54e1bc38978ee40b26df
Fixed
9a278f5fe6b4511aca3f293709c94a9960d1011c
Introduced
f7582b4be60fe9100489237bb8b022783a288766
Fixed
209e5351251276053f1bd071684ff43caaeda378
Database specific 
{
    "extracted_events": [
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.14.1"
        },
        {
            "introduced": "15.0.0"
        },
        {
            "fixed": "23.6.7"
        },
        {
            "introduced": "24.0.0"
        },
        {
            "fixed": "24.9.10"
        },
        {
            "introduced": "25.0.0"
        },
        {
            "fixed": "25.0.4"
        }
    ],
    "cpe": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/vaadin/vaadin
Events
Introduced
87a4778118121215b10f01979996b1ab99cab62a
Fixed
2fb28ea68d4354625468e8d53dd87e892e466057
Introduced
9efda1b1e0a27769eef9292dd7799d8fea77e633
Fixed
220a7e475d06b7442c8f6f45ce4b08c78f19e828
Introduced
a45cc881358732b3d594b20750f1369a65d7237a
Fixed
18118749102f8743c54f2f6f63bc0d66aac6f9a9
Introduced
1bbe0e9e6b57f11d3fbb7b58810f72fbf106ef43
Fixed
e38a47025e60dc6f30dd1cdceddcf943e1cf5ab8
Database specific 
{
    "extracted_events": [
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.14.1"
        },
        {
            "introduced": "15.0.0"
        },
        {
            "fixed": "23.6.7"
        },
        {
            "introduced": "24.0.0"
        },
        {
            "fixed": "24.9.10"
        },
        {
            "introduced": "25.0.0"
        },
        {
            "fixed": "25.0.4"
        }
    ],
    "cpe": "cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

0.*
0.0.1
0.0.10
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2
0.0.20
0.0.21
0.0.22
0.0.23
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.10
0.1.11
0.1.12
0.1.13
0.1.14
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.2
0.1.20
0.1.21
0.1.22
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
1.*
1.0.0
1.0.0.alpha1
1.0.0.alpha10
1.0.0.alpha11
1.0.0.alpha12
1.0.0.alpha13
1.0.0.alpha14
1.0.0.alpha15
1.0.0.alpha16
1.0.0.alpha17
1.0.0.alpha18
1.0.0.alpha19
1.0.0.alpha2
1.0.0.alpha20
1.0.0.alpha21
1.0.0.alpha22
1.0.0.alpha23
1.0.0.alpha3
1.0.0.alpha4
1.0.0.alpha5
1.0.0.alpha6
1.0.0.alpha7
1.0.0.alpha8
1.0.0.alpha9
1.0.0.beta1
1.0.0.beta10
1.0.0.beta11
1.0.0.beta12
1.0.0.beta2
1.0.0.beta3
1.0.0.beta4
1.0.0.beta5
1.0.0.beta6
1.0.0.beta7
1.0.0.beta8
1.0.0.beta9
1.0.0.rc1
1.0.0.rc2
1.0.0.rc3
1.0.0.rc4
1.0.0.rc5
1.1.0
1.1.0.alpha1
1.1.0.alpha2
1.1.0.alpha3
1.1.0.beta1
1.1.0.beta2
1.1.0.beta3
1.1.0.beta4
1.2.0
1.2.0.alpha1
1.2.0.beta1
1.2.0.beta2
1.3.0.alpha2
1.3.0.alpha3
1.5.0.alpha1
1.5.0.alpha2
1.5.0.alpha3
1.5.0.alpha4
10.*
10.0.0.alpha1
10.0.0.alpha2
10.0.0.alpha3
10.0.0.alpha4
10.0.0.alpha5
10.0.0.beta1
14.*
14.10.0
14.10.0.alpha1
14.10.0.alpha2
14.10.0.alpha3
14.10.0.beta1
14.10.1
14.10.2
14.10.3
14.11.0
14.11.0.alpha1
14.11.0.alpha2
14.11.1
14.11.10
14.11.11
14.11.2
14.11.3
14.11.4
14.11.5
14.11.6
14.11.7
14.11.8
14.11.9
14.12.0
14.12.0.alpha1
14.12.0.beta1
14.12.0.rc1
14.12.1
14.12.2
14.12.3
14.12.4
14.12.5
14.12.6
14.12.7
14.12.8
14.13.0
14.13.0.alpha1
14.13.1
14.13.2
14.14.0
14.14.0-beta1
14.2.0
14.3.0
14.3.0.alpha1
14.3.0.beta1
14.3.0.beta2
14.3.0.beta3
14.3.0.rc1
14.4.0
14.4.0.alpha1
14.4.0.beta1
14.4.0.beta2
14.4.0.rc1
14.5.0.alpha1
14.5.0.alpha2
14.5.0.alpha3
14.5.0.beta1
14.5.0.rc1
14.6.0.alpha1
14.6.0.alpha2
14.6.0.beta1
14.6.0.beta2
14.7.0
14.7.0.alpha1
14.7.0.alpha2
14.7.0.alpha3
14.7.0.beta1
14.7.0.rc1
14.8.0
14.8.0.alpha1
14.8.0.beta1
14.8.1
14.8.10
14.8.11
14.8.12
14.8.13
14.8.14
14.8.15
14.8.16
14.8.17
14.8.2
14.8.3
14.8.4
14.8.5
14.8.6
14.8.7
14.8.8
14.8.9
14.9.0
14.9.0.alpha1
14.9.0.beta1
14.9.0.rc1
14.9.1
14.9.2
14.9.3
14.9.4
15.*
15.0.0
15.0.0.rc1
16.*
16.0.0.alpha1
16.0.0.alpha2
16.0.0.alpha3
16.0.1
17.*
17.0.0
17.0.0.alpha2
17.0.0.alpha3
17.0.0.alpha4
17.0.0.alpha5
17.0.0.alpha6
17.0.0.alpha7
17.0.0.beta1
17.0.0.beta2
17.0.0.beta3
17.0.0.rc1
17.0.0.rc2
18.*
18.0.0.alpha1
18.0.0.beta1
18.0.0.beta2
19.*
19.0.0.alpha1
19.0.0.alpha2
19.0.0.alpha3
19.0.0.alpha4
19.0.0.alpha5
19.0.0.beta1
19.0.0.beta2
19.0.0.beta3
19.0.0.beta4
2.*
2.0.0
2.0.0.alpha5
2.0.0.beta1
2.0.0.beta2
2.0.0.rc1
2.0.0.rc2
2.0.0.rc3
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0.alpha1
2.1.0.beta1
2.1.0.beta3
2.10.0
2.10.0.alpha1
2.10.0.alpha2
2.10.0.alpha3
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.11.0
2.11.0.alpha1
2.11.0.beta1
2.11.0.rc1
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.12.0
2.12.0.alpha1
2.12.0.alpha2
2.12.0.alpha3
2.12.1
2.12.2
2.12.3
2.13.0
2.13.0-beta1
2.2.0.alpha1
2.2.0.alpha10
2.2.0.alpha11
2.2.0.alpha12
2.2.0.alpha13
2.2.0.alpha14
2.2.0.alpha15
2.2.0.alpha16
2.2.0.alpha2
2.2.0.alpha3
2.2.0.alpha4
2.2.0.alpha5
2.2.0.alpha6
2.2.0.alpha7
2.2.0.alpha8
2.2.0.alpha9
2.2.0.beta1
2.2.0.beta2
2.2.0.rc1
2.2.alpha14
2.3.0
2.3.0.alpha1
2.3.0.beta1
2.3.0.beta2
2.3.0.beta3
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.0.alpha1
2.4.0.beta1
2.4.0.beta2
2.5.0.alpha1
2.5.0.alpha2
2.6.0.alpha1
2.6.0.beta1
2.6.0.beta2
2.6.0.rc1
2.7.0
2.7.0.alpha1
2.7.0.alpha2
2.7.0.beta1
2.7.0.rc1
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.0.alpha1
2.8.0.beta1
2.8.0.rc1
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.9.0
2.9.0.alpha1
2.9.0.alpha2
2.9.0.beta1
2.9.0.rc1
2.9.1
2.9.2
2.9.3
20.*
20.0.0.alpha3
20.0.0.alpha4
20.0.0.alpha5
20.0.0.alpha6
20.0.0.alpha7
20.0.0.alpha8
21.*
21.0.0.alpha1
21.0.0.alpha10
21.0.0.alpha2
21.0.0.alpha3
21.0.0.alpha4
21.0.0.alpha5
21.0.0.alpha6
21.0.0.alpha7
21.0.0.alpha8
21.0.0.alpha9
22.*
22.0.0.alpha1
22.0.0.alpha2
22.0.0.alpha3
22.0.0.alpha4
22.0.0.alpha5
22.0.0.alpha6
22.0.0.alpha7
22.0.0.alpha8
22.0.0.alpha9
22.0.0.beta1
22.0.0.beta2
22.0.0.beta3
23.*
23.0.0
23.0.0.alpha1
23.0.0.alpha2
23.0.0.alpha3
23.0.0.alpha4
23.0.0.beta1
23.0.0.beta2
23.0.0.beta3
23.0.0.beta4
23.0.0.rc1
23.1.0.alpha1
23.1.0.alpha2
23.1.0.alpha3
23.1.0.alpha4
23.1.0.beta1
23.2.0
23.2.0.alpha1
23.2.0.alpha2
23.2.0.alpha3
23.2.0.beta1
23.2.0.beta2
23.2.0.beta3
23.2.0.beta4
23.2.0.rc1
23.2.0.rc2
23.3.0
23.3.0.alpha1
23.3.0.alpha2
23.3.0.alpha3
23.3.0.beta1
23.3.0.beta2
23.3.0.beta3
23.3.0.beta4
23.3.0.rc1
23.3.0.rc2
23.3.1
23.3.10
23.3.11
23.3.12
23.3.13
23.3.14
23.3.15
23.3.16
23.3.17
23.3.18
23.3.19
23.3.2
23.3.20
23.3.21
23.3.22
23.3.23
23.3.24
23.3.25
23.3.26
23.3.3
23.3.4
23.3.5
23.3.6
23.3.7
23.3.8
23.3.9
23.4.0
23.4.0.alpha1
23.4.0.alpha2
23.4.0.beta1
23.5.0
23.5.0.alpha1
23.5.0.alpha2
23.5.1
23.5.10
23.5.11
23.5.12
23.5.13
23.5.14
23.5.15
23.5.2
23.5.3
23.5.4
23.5.5
23.5.6
23.5.7
23.5.8
23.5.9
23.6.0
23.6.0.alpha1
23.6.0.alpha2
23.6.0.alpha3
23.6.1
23.6.2
23.6.3
23.6.4
23.6.5
23.6.6
23.6.7
24.*
24.0.0.alpha10
24.0.0.alpha11
24.0.0.alpha12
24.0.0.alpha13
24.0.0.alpha14
24.0.0.alpha15
24.0.0.alpha16
24.0.0.alpha17
24.0.0.alpha2
24.0.0.alpha3
24.0.0.alpha4
24.0.0.alpha5
24.0.0.alpha6
24.0.0.alpha7
24.0.0.alpha8
24.0.0.alpha9
24.0.0.beta1
24.1.0.alpha1
24.1.0.alpha2
24.1.0.alpha3
24.1.0.alpha4
24.1.0.alpha5
24.1.0.alpha6
24.1.0.alpha7
24.1.0.alpha8
24.1.0.beta1
24.1.0.beta2
24.1.0.beta3
24.2-SNAPSHOT
24.2.0.alpha1
24.2.0.alpha10
24.2.0.alpha11
24.2.0.alpha2
24.2.0.alpha3
24.2.0.alpha4
24.2.0.alpha5
24.2.0.alpha6
24.2.0.alpha7
24.2.0.alpha8
24.2.0.alpha9
24.2.0.beta1
24.3-SNAPSHOT
24.3.0
24.3.0.alpha1
24.3.0.alpha2
24.3.0.alpha3
24.3.0.alpha4
24.3.0.alpha5
24.3.0.alpha6
24.3.0.alpha7
24.3.0.beta1
24.3.0.rc1
24.4-SNAPSHOT
24.4.0.alpha1
24.4.0.alpha10
24.4.0.alpha11
24.4.0.alpha12
24.4.0.alpha13
24.4.0.alpha14
24.4.0.alpha15
24.4.0.alpha16
24.4.0.alpha17
24.4.0.alpha18
24.4.0.alpha19
24.4.0.alpha2
24.4.0.alpha20
24.4.0.alpha21
24.4.0.alpha22
24.4.0.alpha23
24.4.0.alpha24
24.4.0.alpha25
24.4.0.alpha26
24.4.0.alpha27
24.4.0.alpha28
24.4.0.alpha29
24.4.0.alpha3
24.4.0.alpha30
24.4.0.alpha31
24.4.0.alpha32
24.4.0.alpha4
24.4.0.alpha5
24.4.0.alpha6
24.4.0.alpha7
24.4.0.alpha8
24.4.0.alpha9
24.4.0.beta1
24.4.x.branch
24.5-SNAPSHOT
24.5.0.alpha1
24.5.0.alpha10
24.5.0.alpha11
24.5.0.alpha12
24.5.0.alpha13
24.5.0.alpha14
24.5.0.alpha15
24.5.0.alpha16
24.5.0.alpha17
24.5.0.alpha18
24.5.0.alpha19
24.5.0.alpha2
24.5.0.alpha20
24.5.0.alpha3
24.5.0.alpha4
24.5.0.alpha5
24.5.0.alpha6
24.5.0.alpha7
24.5.0.alpha8
24.5.0.alpha9
24.5.0.beta1
24.5.0.beta2
24.5.0.beta3
24.5.0.beta4
24.5.0.beta5
24.5.0.beta6
24.5.0.rc1
24.6-SNAPSHOT
24.6.0.alpha1
24.6.0.alpha2
24.6.0.alpha3
24.6.0.alpha4
24.6.0.alpha5
24.6.0.alpha6
24.6.0.beta1
24.6.0.beta2
24.6.0.beta3
24.7-SNAPSHOT
24.7.0.alpha1
24.7.0.alpha10
24.7.0.alpha11
24.7.0.alpha12
24.7.0.alpha13
24.7.0.alpha14
24.7.0.alpha15
24.7.0.alpha2
24.7.0.alpha3
24.7.0.alpha4
24.7.0.alpha5
24.7.0.alpha6
24.7.0.alpha7
24.7.0.alpha8
24.7.0.alpha9
24.7.0.beta1
24.8-SNAPSHOT
24.8.0
24.8.0.alpha1
24.8.0.alpha10
24.8.0.alpha11
24.8.0.alpha12
24.8.0.alpha13
24.8.0.alpha14
24.8.0.alpha15
24.8.0.alpha2
24.8.0.alpha3
24.8.0.alpha4
24.8.0.alpha5
24.8.0.alpha6
24.8.0.alpha7
24.8.0.alpha8
24.8.0.alpha9
24.8.0.beta1
24.8.0.beta2
24.8.0.beta3
24.8.0.beta4
24.8.0.rc1
24.8.0.rc2
24.9.0
24.9.0-alpha1
24.9.0-alpha2
24.9.0-alpha3
24.9.0-alpha4
24.9.0-alpha5
24.9.0-alpha6
24.9.0-alpha7
24.9.0-beta1
24.9.0-beta2
24.9.0-beta3
24.9.0-rc1
24.9.0-rc2
24.9.1
24.9.2
24.9.3
24.9.4
24.9.5
24.9.6
24.9.7
24.9.8
24.9.9
25.*
25.0.0
25.0.1
25.0.2
25.0.3
3.*
3.0.0.alpha17
3.0.0.alpha5
3.0.0.beta1
3.0.0.beta2
3.0.0.beta3
3.0.0.beta4
3.2.0.alpha1
3.2.0.alpha2
3.2.0.alpha3
3.2.0.alpha4
3.2.0.alpha5
3.2.0.alpha6
3.2.0.alpha7
4.*
4.0.0.alpha1
4.0.0.alpha2
4.0.0.alpha3
4.0.0.beta1
5.*
5.0.0.alpha1
5.0.0.beta1
6.*
6.0.0.alpha1
6.0.0.alpha2
6.0.0.alpha3
6.0.0.alpha4
6.0.0.alpha5
6.0.0.beta1
7.*
7.0.0.alpha1
7.0.0.alpha2
7.0.0.alpha3
7.0.0.alpha4
7.0.0.alpha5
7.0.0.alpha6
7.0.0.alpha7
7.0.0.beta1
8.*
8.0.0.alpha1
8.0.0.alpha10
8.0.0.alpha2
8.0.0.alpha3
8.0.0.alpha4
8.0.0.alpha5
8.0.0.alpha6
8.0.0.alpha7
8.0.0.alpha8
8.0.0.alpha9
9.*
9.0.0.alpha1
9.0.0.alpha10
9.0.0.alpha11
9.0.0.alpha2
9.0.0.alpha3
9.0.0.alpha4
9.0.0.alpha5
9.0.0.alpha6
9.0.0.alpha7
9.0.0.alpha8
9.0.0.alpha9
9.0.0.beta1
9.0.0.beta2
9.0.0.beta3
9.0.0.beta4
9.0.0.rc1
v14.*
v14.10.0
v14.10.0-alpha1
v14.10.0-alpha2
v14.10.0-alpha3
v14.10.0-beta1
v14.10.1
v14.10.2
v14.10.3
v14.11.0
v14.11.0-alpha1
v14.11.0-alpha2
v14.11.1
v14.11.10
v14.11.11
v14.11.2
v14.11.3
v14.11.4
v14.11.5
v14.11.6
v14.11.7
v14.11.8
v14.11.9
v14.12.0
v14.12.0-alpha1
v14.12.0-beta1
v14.12.0-rc1
v14.12.1
v14.12.2
v14.12.3
v14.12.4
v14.12.5
v14.12.6
v14.12.7
v14.12.8
v14.13.0
v14.13.0-alpha1
v14.13.1
v14.13.2
v14.14.0
v14.14.0-beta1
v14.2.0
v14.3.0
v14.3.0-alpha1
v14.3.0-beta1
v14.3.0-beta2
v14.3.0-beta3
v14.3.0-rc1
v14.4.0
v14.4.0-alpha1
v14.4.0-beta1
v14.4.0-beta2
v14.4.0-rc1
v14.5.0-alpha1
v14.5.0-alpha2
v14.5.0-alpha3
v14.5.0-beta1
v14.5.0-rc1
v14.6.0-alpha1
v14.6.0-alpha2
v14.6.0-beta1
v14.6.0-beta2
v14.7.0-alpha1
v14.7.0-alpha2
v14.7.0-alpha3
v14.7.0-beta1
v14.7.0-rc1
v14.8.0
v14.8.0-alpha1
v14.8.0-beta1
v14.8.1
v14.8.10
v14.8.11
v14.8.12
v14.8.13
v14.8.14
v14.8.15
v14.8.16
v14.8.17
v14.8.2
v14.8.3
v14.8.4
v14.8.5
v14.8.6
v14.8.7
v14.8.8
v14.8.9
v14.9.0
v14.9.0-alpha1
v14.9.0-beta1
v14.9.0-rc1
v14.9.1
v14.9.2
v14.9.3
v14.9.4
v25.*
v25.0.0
v25.0.2
v25.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2741.json"