2026-09-05 09:27:22 +02:00
# vibe-py pair slice. Reviewed isolated functions with provenance.
# Honesty dashboard — not the local 100% CI gate.
# Do not add these names to LANGUAGE_MANIFESTS.
# Regenerated by benchmarks/pairs/catalog_gen.py from recipes.toml.
2026-09-05 10:37:53 +02:00
[[ pair ]]
name = "claude-code-seeded-v2-crm-saas-django-partner-console-acct-p"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-22"
commit = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9"
parent = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django/blob/5deee4e20becf5fa4193ce4e68f9e736a3d048c9/crm_project/partner_console.py#L36"
vendored = false
host = "github"
path = "crm_project/partner_console.py"
fix_path = "crm_project/partner_console.py"
mode = "enclosing"
line = 36
fix_line = 19
relpath = "crm_project/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "crm_project/partner_console.py"
function = "acct_packet_pull_002"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-crm-saas-django-partner-console-acct-r"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-639"
commit = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9"
parent = "5deee4e20becf5fa4193ce4e68f9e736a3d048c9"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-crm-saas-django/blob/5deee4e20becf5fa4193ce4e68f9e736a3d048c9/crm_project/partner_console.py#L28"
vendored = false
host = "github"
path = "crm_project/partner_console.py"
fix_path = "crm_project/partner_console.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "crm_project/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "crm_project/partner_console.py"
function = "acct_roster_card_001"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-education-lms-django-course-operati-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-601"
commit = "e4dfb85400f8747ea0418e1f48e65fdef678a96a"
parent = "e4dfb85400f8747ea0418e1f48e65fdef678a96a"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django/blob/e4dfb85400f8747ea0418e1f48e65fdef678a96a/lms/course_operations.py#L63"
vendored = false
host = "github"
path = "lms/course_operations.py"
fix_path = "lms/course_operations.py"
mode = "enclosing"
line = 63
fix_line = 19
relpath = "lms/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "lms/course_operations.py"
function = "course_return_lane_150"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-education-lms-django-course-operations"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-79"
commit = "e4dfb85400f8747ea0418e1f48e65fdef678a96a"
parent = "e4dfb85400f8747ea0418e1f48e65fdef678a96a"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-education-lms-django/blob/e4dfb85400f8747ea0418e1f48e65fdef678a96a/lms/course_operations.py#L28"
vendored = false
host = "github"
path = "lms/course_operations.py"
fix_path = "lms/course_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "lms/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "lms/course_operations.py"
function = "course_blurb_card_004"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-fintech-lending-fastapi-loan-operat-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-502"
commit = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64"
parent = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi/blob/d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64/backend/app/loan_operations.py#L51"
vendored = false
host = "github"
path = "backend/app/loan_operations.py"
fix_path = "backend/app/loan_operations.py"
mode = "enclosing"
line = 51
fix_line = 16
relpath = "backend/app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "backend/app/loan_operations.py"
function = "loan_bundle_thaw_168"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-fintech-lending-fastapi-loan-operation"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-601"
commit = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64"
parent = "d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-fintech-lending-fastapi/blob/d1ba4ae7db0c5a78b7da1aecdfc7457f21b7fa64/backend/app/loan_operations.py#L38"
vendored = false
host = "github"
path = "backend/app/loan_operations.py"
fix_path = "backend/app/loan_operations.py"
mode = "enclosing"
line = 38
fix_line = 16
relpath = "backend/app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/loan_operations.py"
function = "loan_return_lane_009"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-healthcare-clinic-django-patient-op-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-502"
commit = "48c7195d18089f77e3d3d9e197c6a2862c2798e0"
parent = "48c7195d18089f77e3d3d9e197c6a2862c2798e0"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django/blob/48c7195d18089f77e3d3d9e197c6a2862c2798e0/clinic_portal/patient_operations.py#L60"
vendored = false
host = "github"
path = "clinic_portal/patient_operations.py"
fix_path = "clinic_portal/patient_operations.py"
mode = "enclosing"
line = 60
fix_line = 19
relpath = "clinic_portal/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "clinic_portal/patient_operations.py"
function = "patient_bundle_thaw_169"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-healthcare-clinic-django-patient-opera"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-601"
commit = "48c7195d18089f77e3d3d9e197c6a2862c2798e0"
parent = "48c7195d18089f77e3d3d9e197c6a2862c2798e0"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-healthcare-clinic-django/blob/48c7195d18089f77e3d3d9e197c6a2862c2798e0/clinic_portal/patient_operations.py#L54"
vendored = false
host = "github"
path = "clinic_portal/patient_operations.py"
fix_path = "clinic_portal/patient_operations.py"
mode = "enclosing"
line = 54
fix_line = 19
relpath = "clinic_portal/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "clinic_portal/patient_operations.py"
function = "patient_return_lane_145"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-hr-payroll-django-payroll-operation-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-22"
commit = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56"
parent = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django/blob/bdd60d0f8896af0f77a628d8ebe8fa24fa385d56/hr_portal/payroll_operations.py#L36"
vendored = false
host = "github"
path = "hr_portal/payroll_operations.py"
fix_path = "hr_portal/payroll_operations.py"
mode = "enclosing"
line = 36
fix_line = 19
relpath = "hr_portal/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "hr_portal/payroll_operations.py"
function = "payroll_fold_drop_014"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-hr-payroll-django-payroll-operations-p"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-639"
commit = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56"
parent = "bdd60d0f8896af0f77a628d8ebe8fa24fa385d56"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-hr-payroll-django/blob/bdd60d0f8896af0f77a628d8ebe8fa24fa385d56/hr_portal/payroll_operations.py#L28"
vendored = false
host = "github"
path = "hr_portal/payroll_operations.py"
fix_path = "hr_portal/payroll_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "hr_portal/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "hr_portal/payroll_operations.py"
function = "payroll_rollcard_013"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-legal-case-django-case-operations-c-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-502"
commit = "3c38d4caf4386567c26bd136f5baddfeb51fc302"
parent = "3c38d4caf4386567c26bd136f5baddfeb51fc302"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django/blob/3c38d4caf4386567c26bd136f5baddfeb51fc302/legal_firm/case_operations.py#L63"
vendored = false
host = "github"
path = "legal_firm/case_operations.py"
fix_path = "legal_firm/case_operations.py"
mode = "enclosing"
line = 63
fix_line = 19
relpath = "legal_firm/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "legal_firm/case_operations.py"
function = "case_bundle_thaw_171"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-legal-case-django-case-operations-case"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-79"
commit = "3c38d4caf4386567c26bd136f5baddfeb51fc302"
parent = "3c38d4caf4386567c26bd136f5baddfeb51fc302"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-legal-case-django/blob/3c38d4caf4386567c26bd136f5baddfeb51fc302/legal_firm/case_operations.py#L28"
vendored = false
host = "github"
path = "legal_firm/case_operations.py"
fix_path = "legal_firm/case_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "legal_firm/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "legal_firm/case_operations.py"
function = "case_banner_fold_016"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-502"
commit = "047e3a2471ed7c14793c19798c460882cb1d1de1"
parent = "047e3a2471ed7c14793c19798c460882cb1d1de1"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/blob/047e3a2471ed7c14793c19798c460882cb1d1de1/backend/app/dispatch_operations.py#L51"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 51
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "backend/app/dispatch_operations.py"
function = "dispatch_bundle_thaw_172"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-logistics-dispatch-fastapi-dispatch-op"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-601"
commit = "047e3a2471ed7c14793c19798c460882cb1d1de1"
parent = "047e3a2471ed7c14793c19798c460882cb1d1de1"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/blob/047e3a2471ed7c14793c19798c460882cb1d1de1/backend/app/dispatch_operations.py#L38"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 38
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/dispatch_operations.py"
function = "dispatch_afterlane_021"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-79"
commit = "2e8df4229d046364594b69e049f94d95e933e60d"
parent = "2e8df4229d046364594b69e049f94d95e933e60d"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/blob/2e8df4229d046364594b69e049f94d95e933e60d/backend/app/seller_operations.py#L70"
vendored = false
host = "github"
path = "backend/app/seller_operations.py"
fix_path = "backend/app/seller_operations.py"
mode = "enclosing"
line = 70
fix_line = 16
relpath = "backend/app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "backend/app/seller_operations.py"
function = "seller_blurb_tile_321"
mechanism = "source_reaches_sink"
evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-marketplace-commerce-fastapi-seller-op"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-601"
commit = "2e8df4229d046364594b69e049f94d95e933e60d"
parent = "2e8df4229d046364594b69e049f94d95e933e60d"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/blob/2e8df4229d046364594b69e049f94d95e933e60d/backend/app/seller_operations.py#L43"
vendored = false
host = "github"
path = "backend/app/seller_operations.py"
fix_path = "backend/app/seller_operations.py"
mode = "enclosing"
line = 43
fix_line = 16
relpath = "backend/app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/seller_operations.py"
function = "seller_return_lane_146"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-property-management-fastapi-tenant--2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-22"
commit = "001737a4c9f94ab57bec0635509b8a745a3d0482"
parent = "001737a4c9f94ab57bec0635509b8a745a3d0482"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi/blob/001737a4c9f94ab57bec0635509b8a745a3d0482/backend/app/tenant_operations.py#L29"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 29
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "backend/app/tenant_operations.py"
function = "lease_docu_slot_026"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-property-management-fastapi-tenant-ope"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-639"
commit = "001737a4c9f94ab57bec0635509b8a745a3d0482"
parent = "001737a4c9f94ab57bec0635509b8a745a3d0482"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-property-management-fastapi/blob/001737a4c9f94ab57bec0635509b8a745a3d0482/backend/app/tenant_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "backend/app/tenant_operations.py"
function = "tenant_ledger_tile_025"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-support-desk-fastapi-support-operat-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-601"
commit = "837945410ef4cbd1651e4d6d41f30bf61442e174"
parent = "837945410ef4cbd1651e4d6d41f30bf61442e174"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi/blob/837945410ef4cbd1651e4d6d41f30bf61442e174/backend/app/support_operations.py#L41"
vendored = false
host = "github"
path = "backend/app/support_operations.py"
fix_path = "backend/app/support_operations.py"
mode = "enclosing"
line = 41
fix_line = 16
relpath = "backend/app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/support_operations.py"
function = "ticket_return_lane_148"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "claude-code-seeded-v2-support-desk-fastapi-support-operation"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-79"
commit = "837945410ef4cbd1651e4d6d41f30bf61442e174"
parent = "837945410ef4cbd1651e4d6d41f30bf61442e174"
commit_url = "https://github.com/kolega-ai-dev/vc-claude-code-seeded-v2-support-desk-fastapi/blob/837945410ef4cbd1651e4d6d41f30bf61442e174/backend/app/support_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/support_operations.py"
fix_path = "backend/app/support_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "backend/app/support_operations.py"
function = "ticket_copy_badge_028"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-crm-saas-django-partner-console-acct-fo"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-639"
commit = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784"
parent = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django/blob/de186e3d9694f7d39579a6f8d0e40fe7d4d64784/config/partner_console.py#L28"
vendored = false
host = "github"
path = "config/partner_console.py"
fix_path = "config/partner_console.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "config/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "config/partner_console.py"
function = "acct_folio_badge_061"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-crm-saas-django-partner-console-acct-va"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-22"
commit = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784"
parent = "de186e3d9694f7d39579a6f8d0e40fe7d4d64784"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-crm-saas-django/blob/de186e3d9694f7d39579a6f8d0e40fe7d4d64784/config/partner_console.py#L36"
vendored = false
host = "github"
path = "config/partner_console.py"
fix_path = "config/partner_console.py"
mode = "enclosing"
line = 36
fix_line = 19
relpath = "config/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "config/partner_console.py"
function = "acct_vaultlet_pull_062"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-education-lms-django-course-operatio-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-601"
commit = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df"
parent = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django/blob/0a542ba3abbff8c2a8fbc5f9aa4d530d276582df/education_lms/course_operations.py#L63"
vendored = false
host = "github"
path = "education_lms/course_operations.py"
fix_path = "education_lms/course_operations.py"
mode = "enclosing"
line = 63
fix_line = 19
relpath = "education_lms/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "education_lms/course_operations.py"
function = "course_return_lane_162"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-education-lms-django-course-operations-"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-79"
commit = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df"
parent = "0a542ba3abbff8c2a8fbc5f9aa4d530d276582df"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-education-lms-django/blob/0a542ba3abbff8c2a8fbc5f9aa4d530d276582df/education_lms/course_operations.py#L28"
vendored = false
host = "github"
path = "education_lms/course_operations.py"
fix_path = "education_lms/course_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "education_lms/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "education_lms/course_operations.py"
function = "course_memo_badge_064"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-fintech-lending-fastapi-loan-operati-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-502"
commit = "056336c2bf4e00df7864ab36290218fc6ede117d"
parent = "056336c2bf4e00df7864ab36290218fc6ede117d"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi/blob/056336c2bf4e00df7864ab36290218fc6ede117d/app/loan_operations.py#L51"
vendored = false
host = "github"
path = "app/loan_operations.py"
fix_path = "app/loan_operations.py"
mode = "enclosing"
line = 51
fix_line = 16
relpath = "app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "app/loan_operations.py"
function = "loan_bundle_thaw_178"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-fintech-lending-fastapi-loan-operations"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-601"
commit = "056336c2bf4e00df7864ab36290218fc6ede117d"
parent = "056336c2bf4e00df7864ab36290218fc6ede117d"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-fintech-lending-fastapi/blob/056336c2bf4e00df7864ab36290218fc6ede117d/app/loan_operations.py#L38"
vendored = false
host = "github"
path = "app/loan_operations.py"
fix_path = "app/loan_operations.py"
mode = "enclosing"
line = 38
fix_line = 16
relpath = "app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "app/loan_operations.py"
function = "loan_aftercard_069"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-healthcare-clinic-django-patient-ope-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-502"
commit = "83ffa47b05666e0c9f462628540b2146ddf5055a"
parent = "83ffa47b05666e0c9f462628540b2146ddf5055a"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django/blob/83ffa47b05666e0c9f462628540b2146ddf5055a/clinic_portal/patient_operations.py#L60"
vendored = false
host = "github"
path = "clinic_portal/patient_operations.py"
fix_path = "clinic_portal/patient_operations.py"
mode = "enclosing"
line = 60
fix_line = 19
relpath = "clinic_portal/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "clinic_portal/patient_operations.py"
function = "patient_bundle_thaw_179"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-healthcare-clinic-django-patient-operat"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-601"
commit = "83ffa47b05666e0c9f462628540b2146ddf5055a"
parent = "83ffa47b05666e0c9f462628540b2146ddf5055a"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-healthcare-clinic-django/blob/83ffa47b05666e0c9f462628540b2146ddf5055a/clinic_portal/patient_operations.py#L54"
vendored = false
host = "github"
path = "clinic_portal/patient_operations.py"
fix_path = "clinic_portal/patient_operations.py"
mode = "enclosing"
line = 54
fix_line = 19
relpath = "clinic_portal/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "clinic_portal/patient_operations.py"
function = "patient_return_lane_157"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-hr-payroll-django-payroll-operations-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-22"
commit = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9"
parent = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django/blob/df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9/hr_portal/payroll_operations.py#L36"
vendored = false
host = "github"
path = "hr_portal/payroll_operations.py"
fix_path = "hr_portal/payroll_operations.py"
mode = "enclosing"
line = 36
fix_line = 19
relpath = "hr_portal/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "hr_portal/payroll_operations.py"
function = "payroll_zipper_note_074"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-hr-payroll-django-payroll-operations-pa"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-639"
commit = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9"
parent = "df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-hr-payroll-django/blob/df6fdd151c2f4c4811acfeaaddedc2d3f512d5f9/hr_portal/payroll_operations.py#L28"
vendored = false
host = "github"
path = "hr_portal/payroll_operations.py"
fix_path = "hr_portal/payroll_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "hr_portal/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "hr_portal/payroll_operations.py"
function = "payroll_cycle_tile_073"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-legal-case-django-case-operations-ca-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-502"
commit = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f"
parent = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django/blob/de226f147618ddffcc69e5f1a81ae8c7fc83a84f/legalcase/case_operations.py#L63"
vendored = false
host = "github"
path = "legalcase/case_operations.py"
fix_path = "legalcase/case_operations.py"
mode = "enclosing"
line = 63
fix_line = 19
relpath = "legalcase/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "legalcase/case_operations.py"
function = "case_bundle_thaw_181"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-legal-case-django-case-operations-case-"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-79"
commit = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f"
parent = "de226f147618ddffcc69e5f1a81ae8c7fc83a84f"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-legal-case-django/blob/de226f147618ddffcc69e5f1a81ae8c7fc83a84f/legalcase/case_operations.py#L28"
vendored = false
host = "github"
path = "legalcase/case_operations.py"
fix_path = "legalcase/case_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "legalcase/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "legalcase/case_operations.py"
function = "case_caption_fold_076"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch--2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-502"
commit = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c"
parent = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/blob/5bafe528a2a15f3e4dbf87aaa0eae79d3421957c/backend/app/dispatch_operations.py#L51"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 51
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "backend/app/dispatch_operations.py"
function = "dispatch_bundle_thaw_182"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-logistics-dispatch-fastapi-dispatch-ope"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-601"
commit = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c"
parent = "5bafe528a2a15f3e4dbf87aaa0eae79d3421957c"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/blob/5bafe528a2a15f3e4dbf87aaa0eae79d3421957c/backend/app/dispatch_operations.py#L38"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 38
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/dispatch_operations.py"
function = "dispatch_donecard_081"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-marketplace-commerce-fastapi-seller--2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-79"
commit = "f28971a8e0784652f9d9ef0515e38da025a0579b"
parent = "f28971a8e0784652f9d9ef0515e38da025a0579b"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/blob/f28971a8e0784652f9d9ef0515e38da025a0579b/backend/app/seller_operations.py#L73"
vendored = false
host = "github"
path = "backend/app/seller_operations.py"
fix_path = "backend/app/seller_operations.py"
mode = "enclosing"
line = 73
fix_line = 16
relpath = "backend/app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "backend/app/seller_operations.py"
function = "seller_blurb_tile_328"
mechanism = "source_reaches_sink"
evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-marketplace-commerce-fastapi-seller-ope"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-601"
commit = "f28971a8e0784652f9d9ef0515e38da025a0579b"
parent = "f28971a8e0784652f9d9ef0515e38da025a0579b"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/blob/f28971a8e0784652f9d9ef0515e38da025a0579b/backend/app/seller_operations.py#L43"
vendored = false
host = "github"
path = "backend/app/seller_operations.py"
fix_path = "backend/app/seller_operations.py"
mode = "enclosing"
line = 43
fix_line = 16
relpath = "backend/app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/seller_operations.py"
function = "seller_return_lane_158"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-property-management-fastapi-tenant-o-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-22"
commit = "c6a51861f929524350f521407ddcf9683cca5fa8"
parent = "c6a51861f929524350f521407ddcf9683cca5fa8"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi/blob/c6a51861f929524350f521407ddcf9683cca5fa8/backend/app/tenant_operations.py#L29"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 29
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "backend/app/tenant_operations.py"
function = "tenant_boxfile_pull_086"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-property-management-fastapi-tenant-oper"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-639"
commit = "c6a51861f929524350f521407ddcf9683cca5fa8"
parent = "c6a51861f929524350f521407ddcf9683cca5fa8"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-property-management-fastapi/blob/c6a51861f929524350f521407ddcf9683cca5fa8/backend/app/tenant_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "backend/app/tenant_operations.py"
function = "lease_fold_card_085"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-support-desk-fastapi-support-operati-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-601"
commit = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3"
parent = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi/blob/b9839d7a1a4fd1f53366bfb24ec110da4699a8d3/app/support_operations.py#L41"
vendored = false
host = "github"
path = "app/support_operations.py"
fix_path = "app/support_operations.py"
mode = "enclosing"
line = 41
fix_line = 16
relpath = "app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "app/support_operations.py"
function = "ticket_return_lane_160"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-high-seeded-v2-support-desk-fastapi-support-operations"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-79"
commit = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3"
parent = "b9839d7a1a4fd1f53366bfb24ec110da4699a8d3"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-high-seeded-v2-support-desk-fastapi/blob/b9839d7a1a4fd1f53366bfb24ec110da4699a8d3/app/support_operations.py#L23"
vendored = false
host = "github"
path = "app/support_operations.py"
fix_path = "app/support_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "app/support_operations.py"
function = "ticket_bannerlet_088"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-crm-saas-django-partner-console-account-wayb"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-601"
commit = "a9d2999ec12c7eac3176d1702544073d283c51bf"
parent = "a9d2999ec12c7eac3176d1702544073d283c51bf"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django/blob/a9d2999ec12c7eac3176d1702544073d283c51bf/crm_platform/partner_console.py#L46"
vendored = false
host = "github"
path = "crm_platform/partner_console.py"
fix_path = "crm_platform/partner_console.py"
mode = "enclosing"
line = 46
fix_line = 19
relpath = "crm_platform/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "crm_platform/partner_console.py"
function = "account_wayback_card_033"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-crm-saas-django-partner-console-acct-bundle-"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-502"
commit = "a9d2999ec12c7eac3176d1702544073d283c51bf"
parent = "a9d2999ec12c7eac3176d1702544073d283c51bf"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-crm-saas-django/blob/a9d2999ec12c7eac3176d1702544073d283c51bf/crm_platform/partner_console.py#L65"
vendored = false
host = "github"
path = "crm_platform/partner_console.py"
fix_path = "crm_platform/partner_console.py"
mode = "enclosing"
line = 65
fix_line = 19
relpath = "crm_platform/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "crm_platform/partner_console.py"
function = "acct_bundle_thaw_174"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-education-lms-django-course-operations-co-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-502"
commit = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1"
parent = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-education-lms-django/blob/49ca6b6f8fde8bcf3b782fb84afe7553586561e1/config/course_operations.py#L60"
vendored = false
host = "github"
path = "config/course_operations.py"
fix_path = "config/course_operations.py"
mode = "enclosing"
line = 60
fix_line = 19
relpath = "config/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "config/course_operations.py"
function = "course_bundle_thaw_175"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-education-lms-django-course-operations-cours"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-601"
commit = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1"
parent = "49ca6b6f8fde8bcf3b782fb84afe7553586561e1"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-education-lms-django/blob/49ca6b6f8fde8bcf3b782fb84afe7553586561e1/config/course_operations.py#L54"
vendored = false
host = "github"
path = "config/course_operations.py"
fix_path = "config/course_operations.py"
mode = "enclosing"
line = 54
fix_line = 19
relpath = "config/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "config/course_operations.py"
function = "course_return_lane_151"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-fintech-lending-fastapi-loan-operations-l-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-22"
commit = "0c90e57a9f436aab02184b6f056bb4d66cde34f0"
parent = "0c90e57a9f436aab02184b6f056bb4d66cde34f0"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi/blob/0c90e57a9f436aab02184b6f056bb4d66cde34f0/backend/app/loan_operations.py#L29"
vendored = false
host = "github"
path = "backend/app/loan_operations.py"
fix_path = "backend/app/loan_operations.py"
mode = "enclosing"
line = 29
fix_line = 16
relpath = "backend/app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "backend/app/loan_operations.py"
function = "loan_packlet_pull_038"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-fintech-lending-fastapi-loan-operations-loan"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-639"
commit = "0c90e57a9f436aab02184b6f056bb4d66cde34f0"
parent = "0c90e57a9f436aab02184b6f056bb4d66cde34f0"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-fintech-lending-fastapi/blob/0c90e57a9f436aab02184b6f056bb4d66cde34f0/backend/app/loan_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/loan_operations.py"
fix_path = "backend/app/loan_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "backend/app/loan_operations.py"
function = "loan_queue_marker_037"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-healthcare-clinic-django-patient-operatio-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-601"
commit = "8512a7e9297ec9c2655a0969391630fcc23924fe"
parent = "8512a7e9297ec9c2655a0969391630fcc23924fe"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django/blob/8512a7e9297ec9c2655a0969391630fcc23924fe/clinic_project/patient_operations.py#L63"
vendored = false
host = "github"
path = "clinic_project/patient_operations.py"
fix_path = "clinic_project/patient_operations.py"
mode = "enclosing"
line = 63
fix_line = 19
relpath = "clinic_project/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "clinic_project/patient_operations.py"
function = "patient_return_lane_155"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-healthcare-clinic-django-patient-operations-"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-79"
commit = "8512a7e9297ec9c2655a0969391630fcc23924fe"
parent = "8512a7e9297ec9c2655a0969391630fcc23924fe"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-healthcare-clinic-django/blob/8512a7e9297ec9c2655a0969391630fcc23924fe/clinic_project/patient_operations.py#L28"
vendored = false
host = "github"
path = "clinic_project/patient_operations.py"
fix_path = "clinic_project/patient_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "clinic_project/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "clinic_project/patient_operations.py"
function = "patient_notelet_card_040"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-hr-payroll-django-payroll-operations-payr-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-502"
commit = "5726053dc9825b59c7a7dd91c3d13b788e2860c5"
parent = "5726053dc9825b59c7a7dd91c3d13b788e2860c5"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django/blob/5726053dc9825b59c7a7dd91c3d13b788e2860c5/config/payroll_operations.py#L65"
vendored = false
host = "github"
path = "config/payroll_operations.py"
fix_path = "config/payroll_operations.py"
mode = "enclosing"
line = 65
fix_line = 19
relpath = "config/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "config/payroll_operations.py"
function = "payroll_bundle_thaw_176"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-hr-payroll-django-payroll-operations-payroll"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-601"
commit = "5726053dc9825b59c7a7dd91c3d13b788e2860c5"
parent = "5726053dc9825b59c7a7dd91c3d13b788e2860c5"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-hr-payroll-django/blob/5726053dc9825b59c7a7dd91c3d13b788e2860c5/config/payroll_operations.py#L46"
vendored = false
host = "github"
path = "config/payroll_operations.py"
fix_path = "config/payroll_operations.py"
mode = "enclosing"
line = 46
fix_line = 19
relpath = "config/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "config/payroll_operations.py"
function = "payroll_done_lane_045"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-legal-case-django-case-operations-case-bundl"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-502"
commit = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4"
parent = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-legal-case-django/blob/3326f08f6c08f1a086d5a8f818c4dd6fdee947f4/legalcase/case_operations.py#L60"
vendored = false
host = "github"
path = "legalcase/case_operations.py"
fix_path = "legalcase/case_operations.py"
mode = "enclosing"
line = 60
fix_line = 19
relpath = "legalcase/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "legalcase/case_operations.py"
function = "case_bundle_thaw_177"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-legal-case-django-case-operations-case-retur"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-601"
commit = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4"
parent = "3326f08f6c08f1a086d5a8f818c4dd6fdee947f4"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-legal-case-django/blob/3326f08f6c08f1a086d5a8f818c4dd6fdee947f4/legalcase/case_operations.py#L54"
vendored = false
host = "github"
path = "legalcase/case_operations.py"
fix_path = "legalcase/case_operations.py"
mode = "enclosing"
line = 54
fix_line = 19
relpath = "legalcase/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "legalcase/case_operations.py"
function = "case_return_lane_152"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-opera-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-22"
commit = "f4f3d452f8de0f83032fd1a5800eda7ea498231f"
parent = "f4f3d452f8de0f83032fd1a5800eda7ea498231f"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi/blob/f4f3d452f8de0f83032fd1a5800eda7ea498231f/backend/app/dispatch_operations.py#L29"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 29
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "backend/app/dispatch_operations.py"
function = "dispatch_cargo_slot_050"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-logistics-dispatch-fastapi-dispatch-operatio"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-639"
commit = "f4f3d452f8de0f83032fd1a5800eda7ea498231f"
parent = "f4f3d452f8de0f83032fd1a5800eda7ea498231f"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-logistics-dispatch-fastapi/blob/f4f3d452f8de0f83032fd1a5800eda7ea498231f/backend/app/dispatch_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "backend/app/dispatch_operations.py"
function = "dispatch_lane_card_049"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-marketplace-commerce-fastapi-seller-opera-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-79"
commit = "f81299ccd8490514e640c670f48b7af3f4415b48"
parent = "f81299ccd8490514e640c670f48b7af3f4415b48"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi/blob/f81299ccd8490514e640c670f48b7af3f4415b48/app/seller_operations.py#L76"
vendored = false
host = "github"
path = "app/seller_operations.py"
fix_path = "app/seller_operations.py"
mode = "enclosing"
line = 76
fix_line = 16
relpath = "app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "app/seller_operations.py"
function = "seller_blurb_tile_324"
mechanism = "source_reaches_sink"
evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-marketplace-commerce-fastapi-seller-operatio"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-79"
commit = "f81299ccd8490514e640c670f48b7af3f4415b48"
parent = "f81299ccd8490514e640c670f48b7af3f4415b48"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-marketplace-commerce-fastapi/blob/f81299ccd8490514e640c670f48b7af3f4415b48/app/seller_operations.py#L23"
vendored = false
host = "github"
path = "app/seller_operations.py"
fix_path = "app/seller_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "app/seller_operations.py"
function = "seller_pitch_tile_052"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-property-management-fastapi-tenant-operat-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-502"
commit = "1c3dad8c5deeb0be75524b793a4f6bd80515d619"
parent = "1c3dad8c5deeb0be75524b793a4f6bd80515d619"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi/blob/1c3dad8c5deeb0be75524b793a4f6bd80515d619/backend/app/tenant_operations.py#L42"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 42
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "backend/app/tenant_operations.py"
function = "tenant_bundle_thaw_173"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-property-management-fastapi-tenant-operation"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-601"
commit = "1c3dad8c5deeb0be75524b793a4f6bd80515d619"
parent = "1c3dad8c5deeb0be75524b793a4f6bd80515d619"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-property-management-fastapi/blob/1c3dad8c5deeb0be75524b793a4f6bd80515d619/backend/app/tenant_operations.py#L38"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 38
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/tenant_operations.py"
function = "tenant_exit_lane_057"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-support-desk-fastapi-support-operations-t-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-942"
commit = "5b8ce483d02f1fa6af678482972d92a2060491e1"
parent = "5b8ce483d02f1fa6af678482972d92a2060491e1"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi/blob/5b8ce483d02f1fa6af678482972d92a2060491e1/backend/app/support_operations.py#L80"
vendored = false
host = "github"
path = "backend/app/support_operations.py"
fix_path = "backend/app/support_operations.py"
mode = "enclosing"
line = 80
fix_line = 16
relpath = "backend/app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-942"
class = "security_misconfiguration"
path = "backend/app/support_operations.py"
function = "ticket_origin_mirror_465"
mechanism = "permissive_default"
evidence = "Origin mirror reflects arbitrary request origins while allowing credentials. Seeded during v2-campaign-3 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "codex-seeded-v2-support-desk-fastapi-support-operations-tick"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-601"
commit = "5b8ce483d02f1fa6af678482972d92a2060491e1"
parent = "5b8ce483d02f1fa6af678482972d92a2060491e1"
commit_url = "https://github.com/kolega-ai-dev/vc-codex-seeded-v2-support-desk-fastapi/blob/5b8ce483d02f1fa6af678482972d92a2060491e1/backend/app/support_operations.py#L43"
vendored = false
host = "github"
path = "backend/app/support_operations.py"
fix_path = "backend/app/support_operations.py"
mode = "enclosing"
line = 43
fix_line = 16
relpath = "backend/app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/support_operations.py"
function = "ticket_return_lane_153"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
2026-09-05 09:27:22 +02:00
[[ pair ]]
name = "damn-vulnerable-graphql-application-views-mutate"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "dolevf/Damn-Vulnerable-GraphQL-Application"
cve = ""
cwe = "CWE-78"
commit = "a961308c02d1fb462b192681c336b0739e432da7"
parent = "a961308c02d1fb462b192681c336b0739e432da7"
commit_url = "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211"
vuln = "damn-vulnerable-graphql-application-views-mutate/vuln.py"
fixed = "damn-vulnerable-graphql-application-views-mutate/fixed.py"
relpath = "core/views.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-78"
class = "command_injection"
path = "core/views.py"
function = "mutate"
mechanism = "source_reaches_sink"
evidence = "OS command injection in ImportPaste mutation. User-controlled host, port, path, and scheme parameters are used to construct a URL that is passed to os.popen via helpers.run_cmd(f'curl --insecure {url}'). In easy mode, strip_dangerous_charac"
[[ pair ]]
name = "damn-vulnerable-graphql-application-views-resolve-pastes"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "dolevf/Damn-Vulnerable-GraphQL-Application"
cve = ""
cwe = "CWE-89"
commit = "a961308c02d1fb462b192681c336b0739e432da7"
parent = "a961308c02d1fb462b192681c336b0739e432da7"
commit_url = "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320"
vuln = "damn-vulnerable-graphql-application-views-resolve-pastes/vuln.py"
fixed = "damn-vulnerable-graphql-application-views-resolve-pastes/fixed.py"
relpath = "core/views.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "core/views.py"
function = "resolve_pastes"
mechanism = "source_reaches_sink"
evidence = "SQL injection via unsanitized 'filter' GraphQL argument directly interpolated into raw SQL using Python string formatting: result.filter(text(\"title = '%s' or content = '%s'\" % (filter, filter))). An attacker can inject arbitrary SQL via th"
[[ pair ]]
name = "damn-vulnerable-graphql-application-views-resolve-system-dia"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "dolevf/Damn-Vulnerable-GraphQL-Application"
cve = ""
cwe = "CWE-78"
commit = "a961308c02d1fb462b192681c336b0739e432da7"
parent = "a961308c02d1fb462b192681c336b0739e432da7"
commit_url = "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345"
vuln = "damn-vulnerable-graphql-application-views-resolve-system-dia/vuln.py"
fixed = "damn-vulnerable-graphql-application-views-resolve-system-dia/fixed.py"
relpath = "core/views.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-78"
class = "command_injection"
path = "core/views.py"
function = "resolve_system_diagnostics"
mechanism = "source_reaches_sink"
evidence = "OS command injection via the 'cmd' argument in the systemDiagnostics GraphQL query. In easy mode, security.allowed_cmds() always returns True, so user-supplied cmd is passed directly to os.popen via helpers.run_cmd(cmd). Requires valid admi"
[[ pair ]]
name = "djangoat-analytics-hits-by-ip"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "Contrast-Security-OSS/DjanGoat"
cve = ""
cwe = "CWE-89"
commit = "082c88bfefced508ae083b92b459c808f95e905e"
parent = "082c88bfefced508ae083b92b459c808f95e905e"
commit_url = "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57"
vuln = "djangoat-analytics-hits-by-ip/vuln.py"
fixed = "djangoat-analytics-hits-by-ip/fixed.py"
relpath = "app/models/Analytics/analytics.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "app/models/Analytics/analytics.py"
function = "hits_by_ip"
mechanism = "source_reaches_sink"
evidence = "SQL injection via string formatting in raw query. Both ip and col parameters are interpolated directly into SQL: 'SELECT %s FROM %s WHERE ip_address=\\'%s\\' ORDER BY id DESC' % (col, table_name, ip). The ip parameter comes from request.GET['"
[[ pair ]]
name = "djangoat-views-reset-password"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "Contrast-Security-OSS/DjanGoat"
cve = ""
cwe = "CWE-502"
commit = "082c88bfefced508ae083b92b459c808f95e905e"
parent = "082c88bfefced508ae083b92b459c808f95e905e"
commit_url = "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84"
vuln = "djangoat-views-reset-password/vuln.py"
fixed = "djangoat-views-reset-password/fixed.py"
relpath = "app/views/password_resets/views.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "app/views/password_resets/views.py"
function = "reset_password"
mechanism = "source_reaches_sink"
evidence = "Remote code execution via insecure deserialization. User-controlled POST parameter 'user' is base64-decoded and passed to pickle.loads(): user = pickle.loads(base64.b64decode(encoded_user)). An attacker can craft a malicious pickle payload "
[[ pair ]]
name = "djangoat-views-user-view"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "Contrast-Security-OSS/DjanGoat"
cve = ""
cwe = "CWE-89"
commit = "082c88bfefced508ae083b92b459c808f95e905e"
parent = "082c88bfefced508ae083b92b459c808f95e905e"
commit_url = "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74"
vuln = "djangoat-views-user-view/vuln.py"
fixed = "djangoat-views-user-view/fixed.py"
relpath = "app/views/users/views.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "app/views/users/views.py"
function = "user_view"
mechanism = "source_reaches_sink"
evidence = "SQL injection via string formatting in raw query. user_id_form from POST data is interpolated directly into SQL: User.objects.raw('SELECT * FROM %s WHERE user_id=\\'%s\\' ORDER BY is_admin=\\'0\\'' % (table_name, user_id_form)). An attacker can"
[[ pair ]]
name = "dsvpwa-attacks-run"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "sgabe/DSVPWA"
cve = ""
cwe = "CWE-89"
commit = "a06abb306ed3699bb2f073e3f41d3d9c57012819"
parent = "a06abb306ed3699bb2f073e3f41d3d9c57012819"
commit_url = "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39"
vuln = "dsvpwa-attacks-run/vuln.py"
fixed = "dsvpwa-attacks-run/fixed.py"
relpath = "dsvpwa/attacks.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "dsvpwa/attacks.py"
function = "run"
mechanism = "source_reaches_sink"
evidence = "SQL injection via string concatenation in SQLinjection.run(). The 'id' parameter from request is concatenated directly into SQL: cursor.execute(\"SELECT ... WHERE id=\" + id). No parameterization or input validation."
[[ pair ]]
name = "dsvpwa-dsvpwa-main"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "sgabe/DSVPWA"
cve = ""
cwe = "CWE-326"
commit = "a06abb306ed3699bb2f073e3f41d3d9c57012819"
parent = "a06abb306ed3699bb2f073e3f41d3d9c57012819"
commit_url = "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37"
vuln = "dsvpwa-dsvpwa-main/vuln.py"
fixed = "dsvpwa-dsvpwa-main/fixed.py"
relpath = "dsvpwa.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-326"
class = "security_misconfiguration"
path = "dsvpwa.py"
function = "main"
mechanism = "permissive_default"
evidence = "Insecure SSL/TLS configuration in main(). Three dangerous SSL options are explicitly enabled: (1) SSLv3 re-enabled via ctx.options &= ~ssl.OP_NO_SSLv3 (vulnerable to POODLE), (2) TLS compression re-enabled via &= ~ssl.OP_NO_COMPRESSION (vul"
[[ pair ]]
name = "dsvpwa-handlers-do-bdr"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "sgabe/DSVPWA"
cve = ""
cwe = "CWE-78"
commit = "a06abb306ed3699bb2f073e3f41d3d9c57012819"
parent = "a06abb306ed3699bb2f073e3f41d3d9c57012819"
commit_url = "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183"
vuln = "dsvpwa-handlers-do-bdr/vuln.py"
fixed = "dsvpwa-handlers-do-bdr/fixed.py"
relpath = "dsvpwa/handlers.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-78"
class = "command_injection"
path = "dsvpwa/handlers.py"
function = "do_BDR"
mechanism = "source_reaches_sink"
evidence = "Critical command injection via custom HTTP method BDR in do_BDR(). The URL path (self.path[1:]) is passed directly to subprocess.check_output() with shell=True: subprocess.check_output(self.path[1:], shell=True, ...). Any command can be exe"
[[ pair ]]
name = "dsvw-dsvw-do-get"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "Unlicense"
repo = "stamparm/DSVW"
cve = ""
cwe = "CWE-89"
commit = "7d40f4b7939c901610ed9b85724552d60e7d63fa"
parent = "7d40f4b7939c901610ed9b85724552d60e7d63fa"
commit_url = "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30"
vuln = "dsvw-dsvw-do-get/vuln.py"
fixed = "dsvw-dsvw-do-get/fixed.py"
relpath = "dsvw.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "dsvw.py"
function = "do_GET"
mechanism = "source_reaches_sink"
evidence = "SQL injection via id parameter directly concatenated into SELECT query without sanitization"
[[ pair ]]
name = "dvpwa-app-init"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "anxolerd/dvpwa"
cve = ""
cwe = "CWE-16"
commit = "a1d8f89fac2e57093189853c6527c2b01fc1d9c1"
parent = "a1d8f89fac2e57093189853c6527c2b01fc1d9c1"
commit_url = "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35"
vuln = "dvpwa-app-init/vuln.py"
fixed = "dvpwa-app-init/fixed.py"
relpath = "sqli/app.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-16"
class = "security_misconfiguration"
path = "sqli/app.py"
function = "init"
mechanism = "permissive_default"
evidence = "Jinja2 template engine configured with autoescape=False. This disables automatic HTML escaping for all template variables, making every unescaped template expression a potential XSS sink. This is the root cause of all stored XSS vulnerabili"
[[ pair ]]
name = "dvpwa-middlewares-session-middleware"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "anxolerd/dvpwa"
cve = ""
cwe = "CWE-1004"
commit = "a1d8f89fac2e57093189853c6527c2b01fc1d9c1"
parent = "a1d8f89fac2e57093189853c6527c2b01fc1d9c1"
commit_url = "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20"
vuln = "dvpwa-middlewares-session-middleware/vuln.py"
fixed = "dvpwa-middlewares-session-middleware/fixed.py"
relpath = "sqli/middlewares.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-1004"
class = "security_misconfiguration"
path = "sqli/middlewares.py"
function = "session_middleware"
mechanism = "permissive_default"
evidence = "Session cookie created with httponly=False. The RedisStorage is configured with httponly=False, meaning the AIOHTTP_SESSION cookie is accessible to JavaScript via document.cookie. Combined with the stored XSS vulnerabilities, this enables s"
[[ pair ]]
name = "dvpwa-student-create"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "anxolerd/dvpwa"
cve = ""
cwe = "CWE-89"
commit = "a1d8f89fac2e57093189853c6527c2b01fc1d9c1"
parent = "a1d8f89fac2e57093189853c6527c2b01fc1d9c1"
commit_url = "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42"
vuln = "dvpwa-student-create/vuln.py"
fixed = "dvpwa-student-create/fixed.py"
relpath = "sqli/dao/student.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "sqli/dao/student.py"
function = "create"
mechanism = "source_reaches_sink"
evidence = "SQL injection via Python string formatting. The 'name' parameter from user input is interpolated directly into the SQL query using Python's % operator: \"VALUES ('%(name)s')\" % {'name': name}. The resulting string is then passed to cur.execu"
[[ pair ]]
name = "extremely-vulnerable-flask-app-account-before-request"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "GPL-3.0"
repo = "manuelz120/extremely-vulnerable-flask-app"
cve = ""
cwe = "CWE-502"
commit = "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa"
parent = "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa"
commit_url = "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118"
vuln = "extremely-vulnerable-flask-app-account-before-request/vuln.py"
fixed = "extremely-vulnerable-flask-app-account-before-request/fixed.py"
relpath = "routes/account.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "routes/account.py"
function = "before_request"
mechanism = "source_reaches_sink"
evidence = "Remote code execution via insecure deserialization. The 'preferences' cookie is base64-decoded and passed directly to pickle.loads() (imported as 'loads' from pickle). An attacker can craft a malicious pickle payload, base64-encode it, and "
[[ pair ]]
name = "extremely-vulnerable-flask-app-account-search"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "GPL-3.0"
repo = "manuelz120/extremely-vulnerable-flask-app"
cve = ""
cwe = "CWE-89"
commit = "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa"
parent = "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa"
commit_url = "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33"
vuln = "extremely-vulnerable-flask-app-account-search/vuln.py"
fixed = "extremely-vulnerable-flask-app-account-search/fixed.py"
relpath = "routes/account.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "routes/account.py"
function = "search"
mechanism = "source_reaches_sink"
evidence = "SQL injection via f-string interpolation of user-supplied search parameter into a raw SQL text() fragment: text(f\"text like '%{search_param}%'\"). The search_param comes directly from request.args.get('search') with no sanitization."
[[ pair ]]
name = "extremely-vulnerable-flask-app-signup-validate-token"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "GPL-3.0"
repo = "manuelz120/extremely-vulnerable-flask-app"
cve = ""
cwe = "CWE-89"
commit = "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa"
parent = "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa"
commit_url = "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15"
vuln = "extremely-vulnerable-flask-app-signup-validate-token/vuln.py"
fixed = "extremely-vulnerable-flask-app-signup-validate-token/fixed.py"
relpath = "routes/signup.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "routes/signup.py"
function = "validate_token"
mechanism = "source_reaches_sink"
evidence = "SQL injection via f-string interpolation of user-supplied registration code directly into a raw SQL query: text(f\"SELECT id, code FROM ... WHERE code = '{code}'\"). An attacker can inject arbitrary SQL through the registration_code form fiel"
2026-09-05 10:37:53 +02:00
[[ pair ]]
name = "kimi-code-seeded-v2-crm-saas-django-partner-console-account-"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-601"
commit = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38"
parent = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django/blob/3081fae3cb2fda831a3e71dfce4fa9a023bdcc38/crm/core/partner_console.py#L46"
vendored = false
host = "github"
path = "crm/core/partner_console.py"
fix_path = "crm/core/partner_console.py"
mode = "enclosing"
line = 46
fix_line = 19
relpath = "crm/core/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "crm/core/partner_console.py"
function = "account_return_lane_093"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-crm-saas-django-partner-console-acct-bun"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django"
cve = ""
cwe = "CWE-502"
commit = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38"
parent = "3081fae3cb2fda831a3e71dfce4fa9a023bdcc38"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-crm-saas-django/blob/3081fae3cb2fda831a3e71dfce4fa9a023bdcc38/crm/core/partner_console.py#L65"
vendored = false
host = "github"
path = "crm/core/partner_console.py"
fix_path = "crm/core/partner_console.py"
mode = "enclosing"
line = 65
fix_line = 19
relpath = "crm/core/partner_console.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "crm/core/partner_console.py"
function = "acct_bundle_thaw_184"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-education-lms-django-course-operation-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-502"
commit = "877530d71e44a071dd6e203de09fe014c689b443"
parent = "877530d71e44a071dd6e203de09fe014c689b443"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django/blob/877530d71e44a071dd6e203de09fe014c689b443/lms/course_operations.py#L60"
vendored = false
host = "github"
path = "lms/course_operations.py"
fix_path = "lms/course_operations.py"
mode = "enclosing"
line = 60
fix_line = 19
relpath = "lms/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "lms/course_operations.py"
function = "course_bundle_thaw_185"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-education-lms-django-course-operations-c"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django"
cve = ""
cwe = "CWE-601"
commit = "877530d71e44a071dd6e203de09fe014c689b443"
parent = "877530d71e44a071dd6e203de09fe014c689b443"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-education-lms-django/blob/877530d71e44a071dd6e203de09fe014c689b443/lms/course_operations.py#L54"
vendored = false
host = "github"
path = "lms/course_operations.py"
fix_path = "lms/course_operations.py"
mode = "enclosing"
line = 54
fix_line = 19
relpath = "lms/course_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "lms/course_operations.py"
function = "course_return_lane_163"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operatio-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-22"
commit = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6"
parent = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi/blob/50a3098d1779c4fc1c71d5fe5253566f59b6f9f6/backend/app/loan_operations.py#L29"
vendored = false
host = "github"
path = "backend/app/loan_operations.py"
fix_path = "backend/app/loan_operations.py"
mode = "enclosing"
line = 29
fix_line = 16
relpath = "backend/app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "backend/app/loan_operations.py"
function = "loan_stash_card_098"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-fintech-lending-fastapi-loan-operations-"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi"
cve = ""
cwe = "CWE-639"
commit = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6"
parent = "50a3098d1779c4fc1c71d5fe5253566f59b6f9f6"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-fintech-lending-fastapi/blob/50a3098d1779c4fc1c71d5fe5253566f59b6f9f6/backend/app/loan_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/loan_operations.py"
fix_path = "backend/app/loan_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/loan_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "backend/app/loan_operations.py"
function = "lendfolio_marker_097"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-healthcare-clinic-django-patient-oper-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-601"
commit = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc"
parent = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django/blob/f6ac3e39f83fa5b5bab27c5662b658713891e3fc/clinic_portal/patient_operations.py#L63"
vendored = false
host = "github"
path = "clinic_portal/patient_operations.py"
fix_path = "clinic_portal/patient_operations.py"
mode = "enclosing"
line = 63
fix_line = 19
relpath = "clinic_portal/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "clinic_portal/patient_operations.py"
function = "patient_return_lane_167"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-healthcare-clinic-django-patient-operati"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django"
cve = ""
cwe = "CWE-79"
commit = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc"
parent = "f6ac3e39f83fa5b5bab27c5662b658713891e3fc"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-healthcare-clinic-django/blob/f6ac3e39f83fa5b5bab27c5662b658713891e3fc/clinic_portal/patient_operations.py#L28"
vendored = false
host = "github"
path = "clinic_portal/patient_operations.py"
fix_path = "clinic_portal/patient_operations.py"
mode = "enclosing"
line = 28
fix_line = 19
relpath = "clinic_portal/patient_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "clinic_portal/patient_operations.py"
function = "patient_copy_tile_100"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-hr-payroll-django-payroll-operations--2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-502"
commit = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c"
parent = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django/blob/5a2a6d42919c9f991490ffb0bcbe75108371fe2c/hr_payroll/payroll_operations.py#L65"
vendored = false
host = "github"
path = "hr_payroll/payroll_operations.py"
fix_path = "hr_payroll/payroll_operations.py"
mode = "enclosing"
line = 65
fix_line = 19
relpath = "hr_payroll/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "hr_payroll/payroll_operations.py"
function = "payroll_bundle_thaw_186"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-hr-payroll-django-payroll-operations-pay"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django"
cve = ""
cwe = "CWE-601"
commit = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c"
parent = "5a2a6d42919c9f991490ffb0bcbe75108371fe2c"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-hr-payroll-django/blob/5a2a6d42919c9f991490ffb0bcbe75108371fe2c/hr_payroll/payroll_operations.py#L46"
vendored = false
host = "github"
path = "hr_payroll/payroll_operations.py"
fix_path = "hr_payroll/payroll_operations.py"
mode = "enclosing"
line = 46
fix_line = 19
relpath = "hr_payroll/payroll_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "hr_payroll/payroll_operations.py"
function = "payroll_wayback_card_105"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-legal-case-django-case-operations-case-b"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-502"
commit = "e19d28f7519ba75706770e22770fdac537f4a4de"
parent = "e19d28f7519ba75706770e22770fdac537f4a4de"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django/blob/e19d28f7519ba75706770e22770fdac537f4a4de/legalcase/case_operations.py#L60"
vendored = false
host = "github"
path = "legalcase/case_operations.py"
fix_path = "legalcase/case_operations.py"
mode = "enclosing"
line = 60
fix_line = 19
relpath = "legalcase/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "legalcase/case_operations.py"
function = "case_bundle_thaw_187"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-legal-case-django-case-operations-case-r"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django"
cve = ""
cwe = "CWE-601"
commit = "e19d28f7519ba75706770e22770fdac537f4a4de"
parent = "e19d28f7519ba75706770e22770fdac537f4a4de"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-legal-case-django/blob/e19d28f7519ba75706770e22770fdac537f4a4de/legalcase/case_operations.py#L54"
vendored = false
host = "github"
path = "legalcase/case_operations.py"
fix_path = "legalcase/case_operations.py"
mode = "enclosing"
line = 54
fix_line = 19
relpath = "legalcase/case_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "legalcase/case_operations.py"
function = "case_return_lane_164"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-o-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-22"
commit = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb"
parent = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/blob/e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb/backend/app/dispatch_operations.py#L29"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 29
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "backend/app/dispatch_operations.py"
function = "dispatch_manifest_pull_110"
mechanism = "path_join_user_input"
evidence = "Parcel-style route builds a filesystem path from a caller-controlled packet reference. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-logistics-dispatch-fastapi-dispatch-oper"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi"
cve = ""
cwe = "CWE-639"
commit = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb"
parent = "e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/blob/e8db6dd6dc2c5c1917a5263eb80b554af5d33aeb/backend/app/dispatch_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/dispatch_operations.py"
fix_path = "backend/app/dispatch_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/dispatch_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-639"
class = "idor"
path = "backend/app/dispatch_operations.py"
function = "routeband_card_109"
mechanism = "identity_from_request_body"
evidence = "Folio-style route uses a caller-supplied id without checking tenant or owner scope. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-o-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-79"
commit = "065ef1ebaea854b3f2575db9a93f08313729aa09"
parent = "065ef1ebaea854b3f2575db9a93f08313729aa09"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/blob/065ef1ebaea854b3f2575db9a93f08313729aa09/backend/app/seller_operations.py#L79"
vendored = false
host = "github"
path = "backend/app/seller_operations.py"
fix_path = "backend/app/seller_operations.py"
mode = "enclosing"
line = 79
fix_line = 16
relpath = "backend/app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "backend/app/seller_operations.py"
function = "seller_blurb_tile_332"
mechanism = "source_reaches_sink"
evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-marketplace-commerce-fastapi-seller-oper"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi"
cve = ""
cwe = "CWE-79"
commit = "065ef1ebaea854b3f2575db9a93f08313729aa09"
parent = "065ef1ebaea854b3f2575db9a93f08313729aa09"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/blob/065ef1ebaea854b3f2575db9a93f08313729aa09/backend/app/seller_operations.py#L23"
vendored = false
host = "github"
path = "backend/app/seller_operations.py"
fix_path = "backend/app/seller_operations.py"
mode = "enclosing"
line = 23
fix_line = 16
relpath = "backend/app/seller_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "backend/app/seller_operations.py"
function = "seller_blurb_card_112"
mechanism = "source_reaches_sink"
evidence = "Copy-card route concatenates caller-controlled text into HTML without escaping. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-property-management-fastapi-tenant-op-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-502"
commit = "0048d045bc53534d7da5ef1bdf1c25072cfb3374"
parent = "0048d045bc53534d7da5ef1bdf1c25072cfb3374"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi/blob/0048d045bc53534d7da5ef1bdf1c25072cfb3374/backend/app/tenant_operations.py#L42"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 42
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "backend/app/tenant_operations.py"
function = "tenant_bundle_thaw_183"
mechanism = "source_reaches_sink"
evidence = "Bundle restore operation deserializes caller-controlled bytes with an unsafe API. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-property-management-fastapi-tenant-opera"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi"
cve = ""
cwe = "CWE-601"
commit = "0048d045bc53534d7da5ef1bdf1c25072cfb3374"
parent = "0048d045bc53534d7da5ef1bdf1c25072cfb3374"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-property-management-fastapi/blob/0048d045bc53534d7da5ef1bdf1c25072cfb3374/backend/app/tenant_operations.py#L38"
vendored = false
host = "github"
path = "backend/app/tenant_operations.py"
fix_path = "backend/app/tenant_operations.py"
mode = "enclosing"
line = 38
fix_line = 16
relpath = "backend/app/tenant_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/tenant_operations.py"
function = "tenant_afterlane_117"
mechanism = "source_reaches_sink"
evidence = "After-lane route sends the caller to a caller-controlled destination without validation. Seeded during v2-campaign-1 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-support-desk-fastapi-support-operatio-2"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-79"
commit = "76776570d1ff3607277ca2b1af2546b362d6e65b"
parent = "76776570d1ff3607277ca2b1af2546b362d6e65b"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi/blob/76776570d1ff3607277ca2b1af2546b362d6e65b/backend/app/support_operations.py#L68"
vendored = false
host = "github"
path = "backend/app/support_operations.py"
fix_path = "backend/app/support_operations.py"
mode = "enclosing"
line = 68
fix_line = 16
relpath = "backend/app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "holdout"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "backend/app/support_operations.py"
function = "ticket_blurb_tile_329"
mechanism = "source_reaches_sink"
evidence = "Rich-text preview renders caller-controlled markup through a Jinja safe filter. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
[[ pair ]]
name = "kimi-code-seeded-v2-support-desk-fastapi-support-operations-"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "unlicensed"
repo = "kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi"
cve = ""
cwe = "CWE-601"
commit = "76776570d1ff3607277ca2b1af2546b362d6e65b"
parent = "76776570d1ff3607277ca2b1af2546b362d6e65b"
commit_url = "https://github.com/kolega-ai-dev/vc-kimi-code-seeded-v2-support-desk-fastapi/blob/76776570d1ff3607277ca2b1af2546b362d6e65b/backend/app/support_operations.py#L43"
vendored = false
host = "github"
path = "backend/app/support_operations.py"
fix_path = "backend/app/support_operations.py"
mode = "enclosing"
line = 43
fix_line = 16
relpath = "backend/app/support_operations.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "agent"
split = "train"
review_tier = "seeded"
[[ pair . expected ]]
cwe = "CWE-601"
class = "open_redirect"
path = "backend/app/support_operations.py"
function = "ticket_return_lane_165"
mechanism = "source_reaches_sink"
evidence = "Return-lane operation sends the browser to a caller-controlled destination without validation. Seeded during v2-campaign-2 and approved for RealVuln GT enhancement."
2026-09-05 09:27:22 +02:00
[[ pair ]]
name = "python-insecure-app-main-try-hack-me"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "GPL-3.0"
repo = "kolega-ai/realvuln-python-insecure-app"
cve = ""
cwe = "CWE-1336"
commit = "80b894a2f754590747a31c92b2088be086421953"
parent = "80b894a2f754590747a31c92b2088be086421953"
commit_url = "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41"
vuln = "python-insecure-app-main-try-hack-me/vuln.py"
fixed = "python-insecure-app-main-try-hack-me/fixed.py"
relpath = "app/main.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-1336"
class = "ssti"
path = "app/main.py"
function = "try_hack_me"
mechanism = "source_reaches_sink"
evidence = "Server-Side Template Injection via Jinja2. User-controlled 'name' query parameter is interpolated into an f-string on line 38 to build 'content', which is then passed to Template(content).render() on line 41. An attacker can inject Jinja2 t"
[[ pair ]]
name = "pythonssti-main-read-root"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "TheWation/PythonSSTI"
cve = ""
cwe = "CWE-79"
commit = "76339c27d5a870c0a81bad6aee5f9bd516592145"
parent = "76339c27d5a870c0a81bad6aee5f9bd516592145"
commit_url = "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14"
vuln = "pythonssti-main-read-root/vuln.py"
fixed = "pythonssti-main-read-root/fixed.py"
relpath = "main.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "main.py"
function = "read_root"
mechanism = "source_reaches_sink"
evidence = "The Jinja2 Environment is created with default settings (autoescape=False). User input from the 'username' query parameter is concatenated into the template string and the rendered output is returned as HTMLResponse. An attacker can inject "
[[ pair ]]
name = "threatbyte-api-v1-delete"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "anotherik/ThreatByte"
cve = ""
cwe = "CWE-862"
commit = "c4db46f72586c4ecb65859051ea037018dbf0e5e"
parent = "c4db46f72586c4ecb65859051ea037018dbf0e5e"
commit_url = "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223"
vuln = "threatbyte-api-v1-delete/vuln.py"
fixed = "threatbyte-api-v1-delete/fixed.py"
relpath = "server/api/v1/api_v1.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-862"
class = "broken_access_control"
path = "server/api/v1/api_v1.py"
function = "delete"
mechanism = "missing_auth_guard"
evidence = "BFLA (Broken Function Level Authorization) on the delete-user API endpoint. The @token_required decorator is commented out (lines 221-222), so DELETE /api/v1/delete-user/<user_id> can be called by anyone without authentication to delete any"
[[ pair ]]
name = "threatbyte-api-v1-get"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "anotherik/ThreatByte"
cve = ""
cwe = "CWE-639"
commit = "c4db46f72586c4ecb65859051ea037018dbf0e5e"
parent = "c4db46f72586c4ecb65859051ea037018dbf0e5e"
commit_url = "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154"
vuln = "threatbyte-api-v1-get/vuln.py"
fixed = "threatbyte-api-v1-get/fixed.py"
relpath = "server/api/v1/api_v1.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-639"
class = "broken_access_control"
path = "server/api/v1/api_v1.py"
function = "get"
mechanism = "missing_auth_guard"
evidence = "BOLA (Broken Object Level Authorization) on the API profile endpoint. The @token_required decorator is commented out (line 152-153), so /api/v1/profile?user_id=X returns any user's profile (username, email, country, role, permissions, team)"
[[ pair ]]
name = "threatbyte-routes-dashboard"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "anotherik/ThreatByte"
cve = ""
cwe = "CWE-89"
commit = "c4db46f72586c4ecb65859051ea037018dbf0e5e"
parent = "c4db46f72586c4ecb65859051ea037018dbf0e5e"
commit_url = "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137"
vuln = "threatbyte-routes-dashboard/vuln.py"
fixed = "threatbyte-routes-dashboard/fixed.py"
relpath = "server/routes.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "server/routes.py"
function = "dashboard"
mechanism = "source_reaches_sink"
evidence = "SQL injection via f-string interpolation of user-controlled search_query parameter directly into SQL: s_query = f\"SELECT filename FROM files WHERE user_id = {user_id} AND filename LIKE '%{search_query}%'\". The search_query comes from reques"
[[ pair ]]
name = "vampi-books-get-by-title"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "erev0s/VAmPI"
cve = ""
cwe = "CWE-639"
commit = "1713b54b601ad29582581eeda4b31fceb1319874"
parent = "1713b54b601ad29582581eeda4b31fceb1319874"
commit_url = "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51"
vuln = "vampi-books-get-by-title/vuln.py"
fixed = "vampi-books-get-by-title/fixed.py"
relpath = "api_views/books.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-639"
class = "broken_access_control"
path = "api_views/books.py"
function = "get_by_title"
mechanism = "missing_auth_guard"
evidence = "Broken Object Level Authorization (BOLA). When vuln=1, get_by_title queries the book by title only (Book.query.filter_by(book_title=str(book_title)).first()) without verifying the authenticated user is the owner. Any authenticated user can "
[[ pair ]]
name = "vampi-user-model-get-user"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "erev0s/VAmPI"
cve = ""
cwe = "CWE-89"
commit = "1713b54b601ad29582581eeda4b31fceb1319874"
parent = "1713b54b601ad29582581eeda4b31fceb1319874"
commit_url = "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72"
vuln = "vampi-user-model-get-user/vuln.py"
fixed = "vampi-user-model-get-user/fixed.py"
relpath = "models/user_model.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "models/user_model.py"
function = "get_user"
mechanism = "source_reaches_sink"
evidence = "SQL injection via f-string interpolation of unsanitized username path parameter into raw SQL query: user_query = f\"SELECT * FROM users WHERE username = '{username}'\" followed by db.session.execute(text(user_query)). Reachable from GET /user"
[[ pair ]]
name = "vampi-users-update-password"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "erev0s/VAmPI"
cve = ""
cwe = "CWE-639"
commit = "1713b54b601ad29582581eeda4b31fceb1319874"
parent = "1713b54b601ad29582581eeda4b31fceb1319874"
commit_url = "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187"
vuln = "vampi-users-update-password/vuln.py"
fixed = "vampi-users-update-password/fixed.py"
relpath = "api_views/users.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-639"
class = "broken_access_control"
path = "api_views/users.py"
function = "update_password"
mechanism = "missing_auth_guard"
evidence = "Unauthorized password change (IDOR). When vuln=1, the update_password function uses the username from the URL path parameter to look up the user whose password to change, instead of using the authenticated user from the JWT token (resp['sub"
[[ pair ]]
name = "vfapi-main-delete-user"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "naryal2580/vfapi"
cve = ""
cwe = "CWE-89"
commit = "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3"
parent = "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3"
commit_url = "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231"
vuln = "vfapi-main-delete-user/vuln.py"
fixed = "vfapi-main-delete-user/fixed.py"
relpath = "main.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "main.py"
function = "delete_user"
mechanism = "source_reaches_sink"
evidence = "SQL injection via f-string interpolation of username query parameter into DELETE SQL query: f'DELETE FROM users WHERE username = \"{username}\";'. No sanitization or parameterization."
[[ pair ]]
name = "vfapi-main-put-user"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "naryal2580/vfapi"
cve = ""
cwe = "CWE-89"
commit = "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3"
parent = "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3"
commit_url = "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188"
vuln = "vfapi-main-put-user/vuln.py"
fixed = "vfapi-main-put-user/fixed.py"
relpath = "main.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "main.py"
function = "put_user"
mechanism = "source_reaches_sink"
evidence = "SQL injection via f-string interpolation of all user-supplied fields (name, username, password, address, email, contact) into an INSERT SQL query. All fields from the User model body are directly embedded in the query string without paramet"
[[ pair ]]
name = "vfapi-main-sql-return-users-from-username"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "naryal2580/vfapi"
cve = ""
cwe = "CWE-89"
commit = "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3"
parent = "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3"
commit_url = "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182"
vuln = "vfapi-main-sql-return-users-from-username/vuln.py"
fixed = "vfapi-main-sql-return-users-from-username/fixed.py"
relpath = "main.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "main.py"
function = "sql_return_users_from_username"
mechanism = "source_reaches_sink"
evidence = "SQL injection via f-string interpolation of username query parameter directly into SQL query: f'SELECT * FROM users WHERE username = \"{username}\";'. No sanitization or parameterization."
[[ pair ]]
name = "vulnerable-python-apps-bad-mvc-do-get"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "GPL-3.0"
repo = "LinuxUser255/Vulnerable_Python_Apps"
cve = ""
cwe = "CWE-79"
commit = "6336c77e6db523a5df34c4b628dff4159110797a"
parent = "6336c77e6db523a5df34c4b628dff4159110797a"
commit_url = "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37"
vuln = "vulnerable-python-apps-bad-mvc-do-get/vuln.py"
fixed = "vulnerable-python-apps-bad-mvc-do-get/fixed.py"
relpath = "Insecure_Frameworks/bad_mvc.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-79"
class = "reflected_xss"
path = "Insecure_Frameworks/bad_mvc.py"
function = "do_GET"
mechanism = "source_reaches_sink"
evidence = "XSS via unescaped output. The username variable (derived from decrypting a user-supplied cookie at line 26) is rendered into HTML without any escaping: bytes('Hello %s' % username, 'utf-8'). An attacker who controls the encrypted cookie val"
[[ pair ]]
name = "vulnerable-python-apps-dir-traversal-do-get"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "GPL-3.0"
repo = "LinuxUser255/Vulnerable_Python_Apps"
cve = ""
cwe = "CWE-22"
commit = "6336c77e6db523a5df34c4b628dff4159110797a"
parent = "6336c77e6db523a5df34c4b628dff4159110797a"
commit_url = "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22"
vuln = "vulnerable-python-apps-dir-traversal-do-get/vuln.py"
fixed = "vulnerable-python-apps-dir-traversal-do-get/fixed.py"
relpath = "Directory_Traversal/Dir_Traversal.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-22"
class = "path_traversal"
path = "Directory_Traversal/Dir_Traversal.py"
function = "do_GET"
mechanism = "path_join_user_input"
evidence = "Arbitrary file read via path traversal. self.path from the HTTP request is concatenated to cwd at line 14 and opened at line 22 via open(path).read(). The regex filter on line 10-11 (r'/\\.\\.\\/\\.\\./' with re.match) is trivially bypassable — "
[[ pair ]]
name = "vulnpy-cmdi-do-os-system"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "Contrast-Security-OSS/vulnpy"
cve = ""
cwe = "CWE-78"
commit = "d1d0f64c06f038fe59a049e0e6001bfaf9839697"
parent = "d1d0f64c06f038fe59a049e0e6001bfaf9839697"
commit_url = "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6"
vuln = "vulnpy-cmdi-do-os-system/vuln.py"
fixed = "vulnpy-cmdi-do-os-system/fixed.py"
relpath = "src/vulnpy/trigger/cmdi.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-78"
class = "command_injection"
path = "src/vulnpy/trigger/cmdi.py"
function = "do_os_system"
mechanism = "source_reaches_sink"
evidence = "User-controlled command passed directly to os.system(command) with no sanitization, enabling arbitrary OS command execution"
[[ pair ]]
name = "vulnpy-cmdi-do-subprocess-popen"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "Contrast-Security-OSS/vulnpy"
cve = ""
cwe = "CWE-78"
commit = "d1d0f64c06f038fe59a049e0e6001bfaf9839697"
parent = "d1d0f64c06f038fe59a049e0e6001bfaf9839697"
commit_url = "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10"
vuln = "vulnpy-cmdi-do-subprocess-popen/vuln.py"
fixed = "vulnpy-cmdi-do-subprocess-popen/fixed.py"
relpath = "src/vulnpy/trigger/cmdi.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-78"
class = "command_injection"
path = "src/vulnpy/trigger/cmdi.py"
function = "do_subprocess_popen"
mechanism = "source_reaches_sink"
evidence = "User-controlled command passed to subprocess.Popen with shell=True, enabling arbitrary OS command execution"
[[ pair ]]
name = "vulnpy-deserialization-do-pickle-load"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "Contrast-Security-OSS/vulnpy"
cve = ""
cwe = "CWE-502"
commit = "d1d0f64c06f038fe59a049e0e6001bfaf9839697"
parent = "d1d0f64c06f038fe59a049e0e6001bfaf9839697"
commit_url = "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8"
vuln = "vulnpy-deserialization-do-pickle-load/vuln.py"
fixed = "vulnpy-deserialization-do-pickle-load/fixed.py"
relpath = "src/vulnpy/trigger/deserialization.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-502"
class = "insecure_deserialization"
path = "src/vulnpy/trigger/deserialization.py"
function = "do_pickle_load"
mechanism = "source_reaches_sink"
evidence = "User input encoded to bytes and passed to pickle.load(), which can execute arbitrary code via crafted pickle payloads"
[[ pair ]]
name = "vulpy-libuser-create"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "fportantier/vulpy"
cve = ""
cwe = "CWE-89"
commit = "5249cc8b05a1c37f6b2f757b1cf16a509c327122"
parent = "5249cc8b05a1c37f6b2f757b1cf16a509c327122"
commit_url = "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25"
vuln = "vulpy-libuser-create/vuln.py"
fixed = "vulpy-libuser-create/fixed.py"
relpath = "bad/libuser.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "bad/libuser.py"
function = "create"
mechanism = "source_reaches_sink"
evidence = "SQL injection via %-formatting in INSERT statement: c.execute(\"INSERT INTO users ... VALUES ('%s', '%s', ...\" %(username, password, ...)). User-supplied username and password are interpolated via % string formatting into the SQL query."
[[ pair ]]
name = "vulpy-libuser-login"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "fportantier/vulpy"
cve = ""
cwe = "CWE-89"
commit = "5249cc8b05a1c37f6b2f757b1cf16a509c327122"
parent = "5249cc8b05a1c37f6b2f757b1cf16a509c327122"
commit_url = "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12"
vuln = "vulpy-libuser-login/vuln.py"
fixed = "vulpy-libuser-login/fixed.py"
relpath = "bad/libuser.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "train"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "bad/libuser.py"
function = "login"
mechanism = "source_reaches_sink"
evidence = "SQL injection via string format in login query: c.execute(\"SELECT * FROM users WHERE username = '{}' and password = '{}'\".format(username, password)). User-supplied username and password from request.form are directly interpolated into the "
[[ pair ]]
name = "vulpy-libuser-password-change"
slice = "vibe-py"
language = "python"
origin = "real-vuln-benchmark"
license = "MIT"
repo = "fportantier/vulpy"
cve = ""
cwe = "CWE-89"
commit = "5249cc8b05a1c37f6b2f757b1cf16a509c327122"
parent = "5249cc8b05a1c37f6b2f757b1cf16a509c327122"
commit_url = "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53"
vuln = "vulpy-libuser-password-change/vuln.py"
fixed = "vulpy-libuser-password-change/fixed.py"
relpath = "bad/libuser.py"
min_recall = 1.0
fix_policy = "silent"
provenance = "human"
split = "holdout"
2026-09-05 09:55:18 +02:00
review_tier = "seeded"
2026-09-05 09:27:22 +02:00
[[ pair . expected ]]
cwe = "CWE-89"
class = "sql_injection"
path = "bad/libuser.py"
function = "password_change"
mechanism = "source_reaches_sink"
evidence = "SQL injection via string format in UPDATE statement: c.execute(\"UPDATE users SET password = '{}' WHERE username = '{}'\".format(password, username)). The password parameter from user input is directly interpolated into the SQL query."
