{"id":"CVE-2026-73546","summary":"Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)","details":"Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plane component such as grpc_stats with stats_for_all_methods enabled can incorporate attacker-controlled path segments into cached dynamic statistic names. When an operator views the HTML stats page, the stored name can execute script with the admin interface's origin and issue privileged same-origin requests. The relevant scope boundary is that the admin interface must be browser-accessible and an enabled component must persist attacker-influenced text in statistic names. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.","aliases":["GHSA-pv9h-4fxf-7vrg"],"modified":"2026-09-23T08:15:45.301946Z","published":"2026-09-21T19:53:21.443Z","related":["openSUSE-SU-2026:11630-1"],"database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73546.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73546.json"},{"type":"ADVISORY","url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-pv9h-4fxf-7vrg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73546"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83"},{"type":"FIX","url":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/envoyproxy/envoy","events":[{"introduced":"0"},{"introduced":"6d9bb7d9a85d616b220d1f8fe67b61f82bbdb8d3"},{"introduced":"f1dd21b16c244bda00edfb5ffce577e12d0d2ec2"},{"introduced":"8eea3285d6bdb89f8ea34632cfe7ce1608a8f374"},{"fixed":"053a8989382dd91542ecf0cef8f379b9cb761cdd"},{"fixed":"cf413bdb37b36d3ffbe570b8a48760abe2b588f5"},{"fixed":"ef2d997c1b022cf8b849a1d3521fbf234d79ca26"},{"fixed":"b579d07d3ad7ee11d32b105e91a5a39ad24718d7"},{"fixed":"11d34660ca0322eb125d045a564d9d87f016397f"},{"fixed":"884d30c56b835d5801733ae1dc38c94a08de23e8"},{"fixed":"9484e17c34353662f9bfd30c74f61fa8c9ee7b83"},{"fixed":"ab63a0e52b5a28472f2ff865b6464ae4004f7593"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.36.10"},{"introduced":"1.37.0"},{"fixed":"1.37.6"},{"introduced":"1.38.0"},{"fixed":"1.38.4"},{"introduced":"1.39.0"},{"fixed":"1.39.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.39.0","v1.36.9","v1.38.3","v1.37.5","v1.38.2","v1.37.4","v1.36.8","v1.38.1","v1.37.3","v1.36.7","v1.38.0","v1.37.2","v1.36.6","v1.37.1","v1.36.5","v1.37.0","v1.36.4","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.2","v1.18.1","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73546.json","vanir_signatures_modified":"2026-09-23T08:15:45Z","vanir_signatures":[{"target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"},"deprecated":false,"digest":{"function_hash":"160350592145831365711251666308524274384","length":778},"id":"CVE-2026-73546-1010acbf","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8"},{"deprecated":false,"digest":{"length":226,"function_hash":"40925790765752179714064355114885406633"},"id":"CVE-2026-73546-27009133","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"}},{"digest":{"threshold":0.9,"line_hashes":["225423053878249789613883670660898459522","185618635558663445783247933289984680258","322464144207284983275066237815936242998"]},"id":"CVE-2026-73546-29f1ba4f","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"test/integration/integration_admin_test.cc"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["7344143724540204436775856847459670750","324325560784914385611407695425538819406","26681545532769656576065024756950960257","124207597191129335219014504303294553394"],"threshold":0.9},"id":"CVE-2026-73546-2dfc1db7","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8","target":{"file":"source/common/html/utility.h"}},{"source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"source/server/admin/stats_html_render.cc"},"deprecated":false,"digest":{"line_hashes":["63077991470917222374351782295614511706","78862228241822612845150789898315178903","166824418994298056148192848505276738582","236049197683773787124897229463857952374","62969750070366263516003946959378401477","35428344902582144292903603199136850023","43810342092700046778905364373203204856","338920150610538392350203675074623880082","306002639174494766881623583475056709447","151817337182147753026192897033234058226","111969858428104117651256840030675920094","96701942915122013348173101155704425765","6873958132923263205494188113038049525","238130594424313750277895162921122413023","188300355559201403285527782986237835601","315105250402055159335897580671205766272"],"threshold":0.9},"id":"CVE-2026-73546-49c18b8e","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["225423053878249789613883670660898459522","185618635558663445783247933289984680258","322464144207284983275066237815936242998"],"threshold":0.9},"id":"CVE-2026-73546-4ada3a7d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"test/integration/integration_admin_test.cc"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["224456272672390633156615590389882379098","58709892761334785194094988673574269648","73338368860929752906106649971588714004","301080298509005572400676178558521643506"],"threshold":0.9},"id":"CVE-2026-73546-4c72bed7","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"source/common/runtime/runtime_features.cc"}},{"deprecated":false,"digest":{"line_hashes":["15222123431120707111586068116883305082","114986854924371435599269048456585929662","301415480407956069960831873928961704043","36686476935240640700247091289760488938","113955886660879385358403473551418261488","187364058811661607475348188998131108133","66486476925605226574916630176801452041","188168907412268112071950255368597868309","115198969575255346617014949862410829389","224850702705157210219014958772003056410","35052079683991052957340920992162311833"],"threshold":0.9},"id":"CVE-2026-73546-4f78f80f","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"source/server/admin/stats_html_render.h"}},{"id":"CVE-2026-73546-50f61895","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"},"deprecated":false,"digest":{"function_hash":"40925790765752179714064355114885406633","length":226}},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"test/server/admin/stats_html_render_test.cc"},"deprecated":false,"digest":{"line_hashes":["309048968502834655882502169263189450360","93579433944702755573216682619877936690","285490378901823441938399202618008136558","163923167295734860787639963662867933454","130172696412516079127427678256368962812"],"threshold":0.9},"id":"CVE-2026-73546-541a8299","signature_type":"Line"},{"digest":{"line_hashes":["187851779296032918696119551811050366984","112571000649524575095014011088360822751","202809079269448522037265862039685969412","160132027007158598465623398975368712457"],"threshold":0.9},"id":"CVE-2026-73546-568b8072","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["187851779296032918696119551811050366984","112571000649524575095014011088360822751","131109903999849515587919161616669874584","37746131892717628569987205232416376761"],"threshold":0.9},"id":"CVE-2026-73546-5f81b671"},{"id":"CVE-2026-73546-68a3c09c","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::StatsHtmlRender"},"deprecated":false,"digest":{"function_hash":"227598132305115197260539703677154877396","length":344}},{"target":{"file":"test/server/admin/stats_html_render_test.cc"},"deprecated":false,"digest":{"line_hashes":["309048968502834655882502169263189450360","93579433944702755573216682619877936690","285490378901823441938399202618008136558","163923167295734860787639963662867933454","130172696412516079127427678256368962812"],"threshold":0.9},"id":"CVE-2026-73546-68ae03df","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8"},{"deprecated":false,"digest":{"line_hashes":["7344143724540204436775856847459670750","324325560784914385611407695425538819406","26681545532769656576065024756950960257","124207597191129335219014504303294553394"],"threshold":0.9},"id":"CVE-2026-73546-6ba13e20","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"source/common/html/utility.h"}},{"deprecated":false,"digest":{"line_hashes":["15222123431120707111586068116883305082","114986854924371435599269048456585929662","301415480407956069960831873928961704043","36686476935240640700247091289760488938","113955886660879385358403473551418261488","187364058811661607475348188998131108133","66486476925605226574916630176801452041","188168907412268112071950255368597868309","115198969575255346617014949862410829389","224850702705157210219014958772003056410","35052079683991052957340920992162311833"],"threshold":0.9},"id":"CVE-2026-73546-6c757ce4","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"source/server/admin/stats_html_render.h"}},{"id":"CVE-2026-73546-7970e442","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8","target":{"file":"source/common/runtime/runtime_features.cc"},"deprecated":false,"digest":{"line_hashes":["187851779296032918696119551811050366984","112571000649524575095014011088360822751","123286438395838848654645289670074406512","60592264329620440235884891871373332618"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["7344143724540204436775856847459670750","324325560784914385611407695425538819406","26681545532769656576065024756950960257","124207597191129335219014504303294553394"],"threshold":0.9},"id":"CVE-2026-73546-83adb365","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"source/common/html/utility.h"}},{"digest":{"function_hash":"160350592145831365711251666308524274384","length":778},"id":"CVE-2026-73546-861ed98a","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"},"deprecated":false},{"id":"CVE-2026-73546-8c4191c5","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8","target":{"file":"source/server/admin/stats_html_render.cc"},"deprecated":false,"digest":{"line_hashes":["63077991470917222374351782295614511706","78862228241822612845150789898315178903","166824418994298056148192848505276738582","236049197683773787124897229463857952374","62969750070366263516003946959378401477","35428344902582144292903603199136850023","43810342092700046778905364373203204856","338920150610538392350203675074623880082","306002639174494766881623583475056709447","151817337182147753026192897033234058226","111969858428104117651256840030675920094","96701942915122013348173101155704425765","6873958132923263205494188113038049525","238130594424313750277895162921122413023","188300355559201403285527782986237835601","315105250402055159335897580671205766272"],"threshold":0.9}},{"id":"CVE-2026-73546-908ddc4d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"source/server/admin/stats_html_render.h"},"deprecated":false,"digest":{"line_hashes":["15222123431120707111586068116883305082","114986854924371435599269048456585929662","301415480407956069960831873928961704043","36686476935240640700247091289760488938","113955886660879385358403473551418261488","187364058811661607475348188998131108133","66486476925605226574916630176801452041","188168907412268112071950255368597868309","115198969575255346617014949862410829389","224850702705157210219014958772003056410","35052079683991052957340920992162311833"],"threshold":0.9}},{"target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"},"deprecated":false,"digest":{"function_hash":"160350592145831365711251666308524274384","length":778},"id":"CVE-2026-73546-9bf84321","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"source/server/admin/stats_html_render.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["63077991470917222374351782295614511706","78862228241822612845150789898315178903","166824418994298056148192848505276738582","236049197683773787124897229463857952374","62969750070366263516003946959378401477","35428344902582144292903603199136850023","43810342092700046778905364373203204856","338920150610538392350203675074623880082","306002639174494766881623583475056709447","151817337182147753026192897033234058226","111969858428104117651256840030675920094","96701942915122013348173101155704425765","6873958132923263205494188113038049525","238130594424313750277895162921122413023","188300355559201403285527782986237835601","315105250402055159335897580671205766272"]},"id":"CVE-2026-73546-a0416ff7"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"source/common/html/utility.h"},"deprecated":false,"digest":{"line_hashes":["7344143724540204436775856847459670750","324325560784914385611407695425538819406","26681545532769656576065024756950960257","124207597191129335219014504303294553394"],"threshold":0.9},"id":"CVE-2026-73546-a68905b0","signature_type":"Line"},{"target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::StatsHtmlRender"},"deprecated":false,"digest":{"function_hash":"227598132305115197260539703677154877396","length":344},"id":"CVE-2026-73546-abfab448","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"source/server/admin/stats_html_render.cc"},"deprecated":false,"digest":{"line_hashes":["63077991470917222374351782295614511706","78862228241822612845150789898315178903","166824418994298056148192848505276738582","236049197683773787124897229463857952374","62969750070366263516003946959378401477","35428344902582144292903603199136850023","43810342092700046778905364373203204856","338920150610538392350203675074623880082","306002639174494766881623583475056709447","151817337182147753026192897033234058226","111969858428104117651256840030675920094","96701942915122013348173101155704425765","6873958132923263205494188113038049525","238130594424313750277895162921122413023","188300355559201403285527782986237835601","315105250402055159335897580671205766272"],"threshold":0.9},"id":"CVE-2026-73546-ace063f5"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["309048968502834655882502169263189450360","93579433944702755573216682619877936690","285490378901823441938399202618008136558","163923167295734860787639963662867933454","130172696412516079127427678256368962812"]},"id":"CVE-2026-73546-ace9814d","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"test/server/admin/stats_html_render_test.cc"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8","target":{"file":"source/server/admin/stats_html_render.h"},"deprecated":false,"digest":{"line_hashes":["15222123431120707111586068116883305082","114986854924371435599269048456585929662","301415480407956069960831873928961704043","36686476935240640700247091289760488938","113955886660879385358403473551418261488","187364058811661607475348188998131108133","66486476925605226574916630176801452041","188168907412268112071950255368597868309","115198969575255346617014949862410829389","224850702705157210219014958772003056410","35052079683991052957340920992162311833"],"threshold":0.9},"id":"CVE-2026-73546-c0e0e302"},{"deprecated":false,"digest":{"line_hashes":["225423053878249789613883670660898459522","185618635558663445783247933289984680258","322464144207284983275066237815936242998"],"threshold":0.9},"id":"CVE-2026-73546-c2a2705c","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/9484e17c34353662f9bfd30c74f61fa8c9ee7b83","target":{"file":"test/integration/integration_admin_test.cc"}},{"id":"CVE-2026-73546-c4f0016e","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8","target":{"file":"test/integration/integration_admin_test.cc"},"deprecated":false,"digest":{"line_hashes":["225423053878249789613883670660898459522","185618635558663445783247933289984680258","322464144207284983275066237815936242998"],"threshold":0.9}},{"target":{"file":"test/server/admin/stats_html_render_test.cc"},"deprecated":false,"digest":{"line_hashes":["309048968502834655882502169263189450360","93579433944702755573216682619877936690","285490378901823441938399202618008136558","163923167295734860787639963662867933454","130172696412516079127427678256368962812"],"threshold":0.9},"id":"CVE-2026-73546-cab4813a","signature_type":"Line","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::StatsHtmlRender"},"deprecated":false,"digest":{"function_hash":"227598132305115197260539703677154877396","length":344},"id":"CVE-2026-73546-d13138e9","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/884d30c56b835d5801733ae1dc38c94a08de23e8","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"},"deprecated":false,"digest":{"function_hash":"40925790765752179714064355114885406633","length":226},"id":"CVE-2026-73546-e6194de2","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"40925790765752179714064355114885406633","length":226},"id":"CVE-2026-73546-f0c59204","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"}},{"digest":{"function_hash":"227598132305115197260539703677154877396","length":344},"id":"CVE-2026-73546-fdad9825","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/ab63a0e52b5a28472f2ff865b6464ae4004f7593","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::StatsHtmlRender"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"160350592145831365711251666308524274384","length":778},"id":"CVE-2026-73546-fe9a8e67","signature_type":"Function","signature_version":"v1","source":"https://github.com/envoyproxy/envoy/commit/11d34660ca0322eb125d045a564d9d87f016397f","target":{"file":"source/server/admin/stats_html_render.cc","function":"StatsHtmlRender::generate"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}