Open_Ultra_SAST/benchmarks/measurements/2026-09-08-model-entailment-ceiling-cpg.json

{
  "flat_ir_baseline": {
    "corroborated_one_hop": 0.239,
    "entailed": 0.022,
    "source": "2026-09-08-model-entailment-ceiling.json"
  },
  "generated": "2026-09-08",
  "overall": {
    "any_verdict_rate": 0.4783,
    "corroborated": 6,
    "distinguished": 24,
    "distinguished_rate": 0.2609,
    "entailed": 38,
    "entailed_rate": 0.413,
    "none": 48,
    "pairs": 92
  },
  "per_family": {
    "access_control": {
      "any_verdict_rate": 0.75,
      "corroborated": 6,
      "distinguished": 3,
      "distinguished_rate": 0.375,
      "entailed": 0,
      "entailed_rate": 0.0,
      "none": 2,
      "pairs": 8
    },
    "config_secrets": {
      "any_verdict_rate": 0.0,
      "corroborated": 0,
      "distinguished": 0,
      "distinguished_rate": 0.0,
      "entailed": 0,
      "entailed_rate": 0.0,
      "none": 10,
      "pairs": 10
    },
    "deserialization": {
      "any_verdict_rate": 0.3333,
      "corroborated": 0,
      "distinguished": 1,
      "distinguished_rate": 0.3333,
      "entailed": 1,
      "entailed_rate": 0.3333,
      "none": 2,
      "pairs": 3
    },
    "injection": {
      "any_verdict_rate": 0.62,
      "corroborated": 0,
      "distinguished": 19,
      "distinguished_rate": 0.38,
      "entailed": 31,
      "entailed_rate": 0.62,
      "none": 19,
      "pairs": 50
    },
    "output_encoding": {
      "any_verdict_rate": 0.0,
      "corroborated": 0,
      "distinguished": 0,
      "distinguished_rate": 0.0,
      "entailed": 0,
      "entailed_rate": 0.0,
      "none": 1,
      "pairs": 1
    },
    "path": {
      "any_verdict_rate": 0.125,
      "corroborated": 0,
      "distinguished": 1,
      "distinguished_rate": 0.125,
      "entailed": 1,
      "entailed_rate": 0.125,
      "none": 7,
      "pairs": 8
    },
    "prototype": {
      "any_verdict_rate": 0.1429,
      "corroborated": 0,
      "distinguished": 0,
      "distinguished_rate": 0.0,
      "entailed": 1,
      "entailed_rate": 0.1429,
      "none": 6,
      "pairs": 7
    },
    "untrusted_destination": {
      "any_verdict_rate": 0.8,
      "corroborated": 0,
      "distinguished": 0,
      "distinguished_rate": 0.0,
      "entailed": 4,
      "entailed_rate": 0.8,
      "none": 1,
      "pairs": 5
    }
  },
  "per_slice": {
    "agent-vfc": {
      "any_verdict_rate": 0.2857,
      "corroborated": 3,
      "distinguished": 0,
      "distinguished_rate": 0.0,
      "entailed": 5,
      "entailed_rate": 0.1786,
      "none": 20,
      "pairs": 28
    },
    "github": {
      "any_verdict_rate": 0.6667,
      "corroborated": 0,
      "distinguished": 2,
      "distinguished_rate": 0.3333,
      "entailed": 4,
      "entailed_rate": 0.6667,
      "none": 2,
      "pairs": 6
    },
    "local": {
      "any_verdict_rate": 1.0,
      "corroborated": 0,
      "distinguished": 0,
      "distinguished_rate": 0.0,
      "entailed": 2,
      "entailed_rate": 1.0,
      "none": 0,
      "pairs": 2
    },
    "sast": {
      "any_verdict_rate": 0.875,
      "corroborated": 0,
      "distinguished": 4,
      "distinguished_rate": 0.5,
      "entailed": 7,
      "entailed_rate": 0.875,
      "none": 1,
      "pairs": 8
    },
    "vfc": {
      "any_verdict_rate": 0.0,
      "corroborated": 0,
      "distinguished": 0,
      "distinguished_rate": 0.0,
      "entailed": 0,
      "entailed_rate": 0.0,
      "none": 1,
      "pairs": 1
    },
    "vfc-js": {
      "any_verdict_rate": 0.6471,
      "corroborated": 0,
      "distinguished": 6,
      "distinguished_rate": 0.3529,
      "entailed": 11,
      "entailed_rate": 0.6471,
      "none": 6,
      "pairs": 17
    },
    "vibe-py": {
      "any_verdict_rate": 0.4,
      "corroborated": 3,
      "distinguished": 12,
      "distinguished_rate": 0.4,
      "entailed": 9,
      "entailed_rate": 0.3,
      "none": 18,
      "pairs": 30
    }
  },
  "rows": [
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "python",
      "pair": "local-python-vulnerable",
      "seconds": 29.4,
      "slice": "local",
      "vuln_rung": "model_entailed",
      "witness": "request.args[\"expr\"] -> eval(request.args[\"expr\"]) (line 28, 1 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "local-javascript-vulnerable",
      "seconds": 30.5,
      "slice": "local",
      "vuln_rung": "model_entailed",
      "witness": "\"make \" + req.query.target -> childProcess.execSync(\"make \" + req.query.target) (line 14, 1 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "python",
      "pair": "sven-cwe-078-os-system",
      "seconds": 29.5,
      "slice": "github",
      "vuln_rung": "model_entailed",
      "witness": "username -> os.system(\"useradd -G docker,wheel -p \" + encPass + \" \" + username) (line 10, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "python",
      "pair": "sven-cwe-078-shell-true",
      "seconds": 29.7,
      "slice": "github",
      "vuln_rung": "model_entailed",
      "witness": "cmd -> _exec_cmd(self, cmd) (line 14, 2 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "sven-cwe-089-execute-percent",
      "seconds": 28.9,
      "slice": "github",
      "vuln_rung": "model_entailed",
      "witness": "game -> cursor.execute(\"SELECT x,y,letter FROM moves WHERE gameID = %d;\" % game) (line 12, 3 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "sven-cwe-089-query-concat",
      "seconds": 30.5,
      "slice": "github",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "path",
      "fixed_rung": "none",
      "language": "java",
      "pair": "hutool-cve-2018-17297",
      "seconds": 31.0,
      "slice": "github",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "node-serialize-cve-2017-5941",
      "seconds": 29.7,
      "slice": "github",
      "vuln_rung": "model_entailed",
      "witness": "obj -> eval(\"(\" + obj + \")\") (line 4, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "python",
      "pair": "owasp-python-codeinj",
      "seconds": 29.4,
      "slice": "sast",
      "vuln_rung": "model_entailed",
      "witness": "urllib.parse.unquote_plus(request.cookies.get(\"BenchmarkTest00074\", \"noCookieValueSupplied\")) -> exec(bar) (line 51, 9 steps)"
    },
    {
      "distinguished": true,
      "family": "deserialization",
      "fixed_rung": "none",
      "language": "python",
      "pair": "owasp-python-deser",
      "seconds": 28.7,
      "slice": "sast",
      "vuln_rung": "model_entailed",
      "witness": "urllib.parse.unquote_plus(request.cookies.get(\"BenchmarkTest00078\", \"noCookieValueSupplied\")) -> pickle.loads(base64.urlsafe_b64decode(bar)) (line 53, 12 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "owasp-python-cmdi",
      "seconds": 28.3,
      "slice": "sast",
      "vuln_rung": "model_entailed",
      "witness": "request.form.get(\"BenchmarkTest00165\") -> subprocess.run(argList, capture_output = True, encoding = \"utf-8\") (line 57, 15 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "owasp-python-sqli",
      "seconds": 28.1,
      "slice": "sast",
      "vuln_rung": "model_entailed",
      "witness": "request.form.get(\"BenchmarkTest00099\") -> cur.execute(sql) (line 49, 14 steps)"
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "python",
      "pair": "owasp-python-hash",
      "seconds": 28.6,
      "slice": "sast",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "java",
      "pair": "owasp-java-cmdi",
      "seconds": 49.6,
      "slice": "sast",
      "vuln_rung": "model_entailed",
      "witness": "getHeader(\"BenchmarkTest00007\") -> r.exec(args, argsEnv) (line 61, 10 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "java",
      "pair": "owasp-java-sqli",
      "seconds": 49.2,
      "slice": "sast",
      "vuln_rung": "model_entailed",
      "witness": "getHeader(\"BenchmarkTest00008\") -> connection.prepareCall(sql) (line 57, 9 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "java",
      "pair": "juliet-java-cwe78-exec",
      "seconds": 49.1,
      "slice": "sast",
      "vuln_rung": "model_entailed",
      "witness": "String data -> Runtime.getRuntime().exec(osCommand + data) (line 8, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "openssl-cve-2022-1292",
      "seconds": 1.1,
      "slice": "vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "damn-vulnerable-graphql-application-views-mutate",
      "seconds": 28.7,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "damn-vulnerable-graphql-application-views-resolve-pastes",
      "seconds": 28.8,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia",
      "seconds": 28.6,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "djangoat-analytics-hits-by-ip",
      "seconds": 27.3,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "deserialization",
      "fixed_rung": "none",
      "language": "python",
      "pair": "djangoat-views-reset-password",
      "seconds": 27.7,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "djangoat-views-user-view",
      "seconds": 27.5,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "request -> User.objects.raw(\"SELECT * FROM %s WHERE user_id='%s' ORDER BY is_admin='0'\" % (table_name,user_id_form)) (line 22, 9 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "dsvpwa-attacks-run",
      "seconds": 28.1,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "python",
      "pair": "dsvpwa-dsvpwa-main",
      "seconds": 28.6,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "dsvpwa-handlers-do-bdr",
      "seconds": 27.4,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "python",
      "pair": "dvpwa-app-init",
      "seconds": 30.5,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "python",
      "pair": "dvpwa-middlewares-session-middleware",
      "seconds": 37.2,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "dvpwa-student-create",
      "seconds": 32.1,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "deserialization",
      "fixed_rung": "none",
      "language": "python",
      "pair": "extremely-vulnerable-flask-app-account-before-request",
      "seconds": 30.0,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "extremely-vulnerable-flask-app-account-search",
      "seconds": 28.6,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "request.args.get('search', '') -> text(f\"text like '%{search_param}%'\") (line 20, 6 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "extremely-vulnerable-flask-app-signup-validate-token",
      "seconds": 28.8,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "session -> session.execute(text(f\"\"\"\n                SELECT id, code FROM {RegistrationCode.__tablename__} WHERE code = '{code}'\n            \"\"\")) (line 15, 2 steps)"
    },
    {
      "distinguished": true,
      "family": "access_control",
      "fixed_rung": "none",
      "language": "python",
      "pair": "threatbyte-api-v1-delete",
      "seconds": 28.2,
      "slice": "vibe-py",
      "vuln_rung": "model_corroborated",
      "witness": "delete line 28: obligated operation with no discharging guard, and no guarded sibling"
    },
    {
      "distinguished": true,
      "family": "access_control",
      "fixed_rung": "none",
      "language": "python",
      "pair": "threatbyte-api-v1-get",
      "seconds": 28.1,
      "slice": "vibe-py",
      "vuln_rung": "model_corroborated",
      "witness": "get line 27: obligated operation with no discharging guard, and no guarded sibling"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "threatbyte-routes-dashboard",
      "seconds": 28.5,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "request.args.get('search', '') -> cursor.execute(s_query) (line 29, 8 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vampi-user-model-get-user",
      "seconds": 27.7,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "access_control",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vampi-users-update-password",
      "seconds": 28.8,
      "slice": "vibe-py",
      "vuln_rung": "model_corroborated",
      "witness": "update_password line 16: obligated operation with no discharging guard, and no guarded sibling"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vfapi-main-delete-user",
      "seconds": 27.9,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vfapi-main-put-user",
      "seconds": 28.1,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vfapi-main-sql-return-users-from-username",
      "seconds": 27.8,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "output_encoding",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vulnerable-python-apps-bad-mvc-do-get",
      "seconds": 29.3,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "path",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vulnerable-python-apps-dir-traversal-do-get",
      "seconds": 28.6,
      "slice": "vibe-py",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vulnpy-cmdi-do-os-system",
      "seconds": 27.7,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "command -> os.system(command) (line 14, 2 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vulnpy-cmdi-do-subprocess-popen",
      "seconds": 28.1,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "command -> subprocess.Popen(command, stdout = subprocess.PIPE, stderr = subprocess.STDOUT, shell = True) (line 14, 2 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vulpy-libuser-create",
      "seconds": 27.8,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "password -> c.execute(\"INSERT INTO users (username, password, failures, mfa_enabled, mfa_secret) VALUES ('%s', '%s', '%d', '%d', '%s')\" % (username,password,0,0,'')) (line 18, 4 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vulpy-libuser-login",
      "seconds": 28.1,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "username -> c.execute(\"SELECT * FROM users WHERE username = '{}' and password = '{}'\".format(username, password)) (line 20, 5 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "vulpy-libuser-password-change",
      "seconds": 27.7,
      "slice": "vibe-py",
      "vuln_rung": "model_entailed",
      "witness": "password -> c.execute(\"UPDATE users SET password = '{}' WHERE username = '{}'\".format(password, username)) (line 20, 5 steps)"
    },
    {
      "distinguished": true,
      "family": "path",
      "fixed_rung": "model_corroborated",
      "language": "javascript",
      "pair": "angular-http-server-1-0-0",
      "seconds": 30.7,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "req.url.split('?')[0] -> fs.readFileSync(possibleFilename) (line 38, 10 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "apex-publish-static-files-2-0-0",
      "seconds": 30.4,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "this -> execSync(\n\t\t\t\t'\"' + opts.sqlclPath + '\"' + // Sqlcl path\n\t\t\t\t' ' + opts.connectString + // Connect string (user/pass@server:port/sid)\n\t\t\t\t' @\"' + path.resolve(__dirname, 'lib/script') + '\"' + // Sql t (line 61, 2 steps)"
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "bestzip-2-1-6",
      "seconds": 31.9,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "options -> cp.exec(command, {\n      stdio: \"inherit\",\n      cwd: options.cwd\n    }) (line 22, 13 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "clamscan-1-2-0",
      "seconds": 46.4,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "this -> execFile(self.settings[self.scanner].path, self._build_clam_args(path), (err, stdout, stderr) => {\n                    const {is_infected, viruses} = self._process_result(stdout, path);\n\n              (line 1401, 46 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "diskusage-ng-0-2-6",
      "seconds": 30.4,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "this -> exec('df -k \"' + path + '\"', function(err, stdout) {\n        if (err) {\n            return cb(err);\n        }\n\n        try {\n            cb(null, parse(stdout));\n        } catch (e) {\n            cb(e (line 19, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "dns-sync-0-1-0",
      "seconds": 30.6,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "hostname -> shell.exec(cmd, {silent: true}) (line 22, 6 steps)"
    },
    {
      "distinguished": false,
      "family": "path",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "glance-3-0-0",
      "seconds": 32.9,
      "slice": "vfc-js",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "hot-formula-parser-3-0-0",
      "seconds": 51.5,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "yytext -> eval(\"[\" + yytext + \"]\") (line 166, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "libnmap-0-4-11",
      "seconds": 32.7,
      "slice": "vfc-js",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "pdf-image-1-0-5",
      "seconds": 32.9,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "this -> exec(getInfoCommand, function (err, stdout, stderr) {\n        if (err) {\n          return reject({\n            message: \"Failed to get PDF'S information\",\n            error: err,\n            stdout: s (line 34, 12 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "pidusage-1-0-0",
      "seconds": 32.8,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "this -> exec(cmd + pid, function(err, stdout, stderr) {\n      if(err)\n        return done(err, null)\n\n      stdout = stdout.split(os.EOL)[1]\n      stdout = stdout.replace(/^\\s+/, '').replace(/\\s\\s+/g, ' ').sp (line 116, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "portprocesses-1-0-4",
      "seconds": 30.4,
      "slice": "vfc-js",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "path",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "serve-here-js-1-1-0",
      "seconds": 29.7,
      "slice": "vfc-js",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "static-eval-1-1-1",
      "seconds": 34.9,
      "slice": "vfc-js",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": true,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "thenify-3-3-0",
      "seconds": 31.7,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "this -> eval(createWrapper($$__fn__$$.name, options)) (line 29, 4 steps)"
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "underscore-1-13-0-0",
      "seconds": 33.0,
      "slice": "vfc-js",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "whereis-0-4-0",
      "seconds": 34.0,
      "slice": "vfc-js",
      "vuln_rung": "model_entailed",
      "witness": "cb -> cp.exec('where ' + name, function (error, stdout, stderr) { //windows\n            if (error || stderr || stdout === '' || stdout.indexOf('\\\\') === -1) {\n              cp.exec('for %i in (' + name + '. (line 21, 3 steps)"
    },
    {
      "distinguished": false,
      "family": "untrusted_destination",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "anastasios-pw-session-14ec1a",
      "seconds": 38.9,
      "slice": "agent-vfc",
      "vuln_rung": "model_entailed",
      "witness": "request: Request -> request.isNavigationRequest (line 14, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "untrusted_destination",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "astroclaw-pw-session-1553a8",
      "seconds": 34.6,
      "slice": "agent-vfc",
      "vuln_rung": "model_entailed",
      "witness": "request: Request -> request.isNavigationRequest (line 14, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "capgo-app-hono-4dadd2",
      "seconds": 10.1,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "path",
      "fixed_rung": "none",
      "language": "python",
      "pair": "dnf-plugin-anyrepo-config-26d19a",
      "seconds": 28.6,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "prototype",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "edutrace-page-ee7ba2",
      "seconds": 35.0,
      "slice": "agent-vfc",
      "vuln_rung": "model_entailed",
      "witness": "this -> setFormData(prevData => {\n      const newData = JSON.parse(JSON.stringify(prevData));\n      let current = newData;\n      for (let i = 0; i < keys.length - 1; i++) {\n        current = current[keys[i]]; (line 65, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "prototype",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "etude-lexical-markdown-editorconfig-c61a8b",
      "seconds": 30.2,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "prototype",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "etude-lexical-markdown-editorconfig-db4f54",
      "seconds": 32.9,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "untrusted_destination",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "market-cap-route-4f8ae9",
      "seconds": 33.6,
      "slice": "agent-vfc",
      "vuln_rung": "model_entailed",
      "witness": "new URL(\"/login?error=confirm\", request.url) -> NextResponse.redirect(new URL(\"/login?error=confirm\", request.url)) (line 27, 2 steps)"
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "melodix-playerprovider-089931",
      "seconds": 12.1,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "mercado-do-vale-news-catalogmetadataservice-9b5fcf",
      "seconds": 11.6,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "prototype",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "money-track-category-icons-4d4a5b",
      "seconds": 31.1,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "prototype",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "nestjs-filter-normalizer-aa0e60",
      "seconds": 30.7,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "new-erp-final-app-6e9644",
      "seconds": 10.4,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "untrusted_destination",
      "fixed_rung": "model_entailed",
      "language": "javascript",
      "pair": "nimestream-route-d17f53",
      "seconds": 32.1,
      "slice": "agent-vfc",
      "vuln_rung": "model_entailed",
      "witness": "new URL(request.url) -> fetch(imageUrl, {\n      headers: {\n        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',\n        'Referer': referer,\n (line 57, 18 steps)"
    },
    {
      "distinguished": false,
      "family": "access_control",
      "fixed_rung": "model_corroborated",
      "language": "python",
      "pair": "openniw-jobs-0fc947",
      "seconds": 27.9,
      "slice": "agent-vfc",
      "vuln_rung": "model_corroborated",
      "witness": "get_job line 16: obligated operation with no discharging guard, and no guarded sibling"
    },
    {
      "distinguished": false,
      "family": "access_control",
      "fixed_rung": "model_corroborated",
      "language": "python",
      "pair": "openniw-jobs-b74de3",
      "seconds": 31.3,
      "slice": "agent-vfc",
      "vuln_rung": "model_corroborated",
      "witness": "get_job line 16: obligated operation with no discharging guard, and no guarded sibling"
    },
    {
      "distinguished": false,
      "family": "access_control",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "overleaf-with-claude-exportscontroller-3980b9",
      "seconds": 1.4,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "prototype",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "popmark-editorconfig-e5ac40",
      "seconds": 35.9,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "prototype",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "rag-pipeline-utils-config-handler-76e5f0",
      "seconds": 44.1,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "registry-proxy-worker-426847",
      "seconds": 17.1,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "access_control",
      "fixed_rung": "model_corroborated",
      "language": "javascript",
      "pair": "supplieradvisor-mvp-route-387bcf",
      "seconds": 43.1,
      "slice": "agent-vfc",
      "vuln_rung": "model_corroborated",
      "witness": "PATCH line 37: obligated operation with no discharging guard, and no guarded sibling"
    },
    {
      "distinguished": false,
      "family": "access_control",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "supplieradvisor-mvp-route-a69e8f",
      "seconds": 53.0,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "python",
      "pair": "tools-cli-tools-a96bc0",
      "seconds": 51.0,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "path",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "trackly-cli-path-diagnostics-1c1aed",
      "seconds": 51.1,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "path",
      "fixed_rung": "none",
      "language": "python",
      "pair": "upstreamdrift-local-server-c3a078",
      "seconds": 43.4,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "untrusted_destination",
      "fixed_rung": "none",
      "language": "python",
      "pair": "waggledance-swarm-ssrf-host-guard-9a4548",
      "seconds": 42.7,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "injection",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "workers-research-utils-209444",
      "seconds": 48.7,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    },
    {
      "distinguished": false,
      "family": "config_secrets",
      "fixed_rung": "none",
      "language": "javascript",
      "pair": "zoonk-origin-bfbf67",
      "seconds": 12.7,
      "slice": "agent-vfc",
      "vuln_rung": "none",
      "witness": ""
    }
  ],
  "task": "model-grounded-detection 4.2 \u2014 entailment ceiling with the full model layer (taint + dominance)"
}