Open_Ultra_SAST/benchmarks/pairs/advisory-fixes/catalog.toml

# Advisory-fix pairs (2026-10-01): real fix commits for the families the pair corpus left without negatives.
#
# Every pair is a public fix commit for a published advisory (CVE / GHSA), distinct from its parent, and names the
# advisory's vulnerable function, which is declared on both sides and whose body the fix changes. The positive is the
# function at `parent`, the negative the same function at `commit`. Research and every rejected advisory:
# research-2026-10-01.md. Both sides are pointer pairs (vendored = false): materialize.py reads one file per side from
# a shallow blobless fetch into the pair cache and writes the function excerpts there; nothing upstream is vendored.
# verification.json is that script's per-pair check (declared on both sides, body changed, bytes read).
#
# Schema: the pair catalog's (benchmarks/pairs/README.md). `framework` is informational (the loader ignores it); the
# label family is the expected row's `family`. One pair per repository; `split` alternates train/holdout by fix date
# within each family, so a repository never straddles.

[[pair]]
name = "grav-redirect-2eae104"
slice = "advisory-fixes"
language = "php"
framework = "grav"
origin = "github-advisory"
license = "MIT"
repo = "getgrav/grav"
cve = "CVE-2020-11529 GHSA-wrxc-mr2w-cjpv"
cwe = "CWE-601"
commit = "2eae104c7a4bf32bc26cb8073d5c40464bfda3f7"
parent = "6f2be2a2d225355c50362f716ffc154d711358f6"
commit_url = "https://github.com/getgrav/grav/commit/2eae104c7a4bf32bc26cb8073d5c40464bfda3f7"
vendored = false
host = "github"
path = "system/src/Grav/Common/Grav.php"
mode = "name"
relpath = "system/src/Grav/Common/Grav.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2020-03-18"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "system/src/Grav/Common/Grav.php"
function = "redirect"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-wrxc-mr2w-cjpv: redirect() now collapses leading slash/backslash runs in the route so //host routes can no longer become protocol-relative external redirects"

[[pair]]
name = "cas-plugin-determinetargeturl-8ac536a"
slice = "advisory-fixes"
language = "java"
framework = "jenkins"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/cas-plugin"
cve = "CVE-2021-21673 GHSA-2vvr-5757-qp87"
cwe = "CWE-601"
commit = "8ac536a953156160dbabb61bdb3b9bc75c3d0ef9"
parent = "13c6100f3561715cfd2a9b0d7d24fc4661570b1d"
commit_url = "https://github.com/jenkinsci/cas-plugin/commit/8ac536a953156160dbabb61bdb3b9bc75c3d0ef9"
vendored = false
host = "github"
path = "src/main/java/org/jenkinsci/plugins/cas/spring/security/SessionUrlAuthenticationSuccessHandler.java"
mode = "name"
relpath = "src/main/java/org/jenkinsci/plugins/cas/spring/security/SessionUrlAuthenticationSuccessHandler.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2021-06-29"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "src/main/java/org/jenkinsci/plugins/cas/spring/security/SessionUrlAuthenticationSuccessHandler.java"
function = "determineTargetUrl"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-2vvr-5757-qp87: determineTargetUrl returned the session-stored target URL unchecked; fix falls back to the default target unless Util.isSafeToRedirectTo holds"

[[pair]]
name = "spirit-custom-login-8f32f89"
slice = "advisory-fixes"
language = "python"
framework = "django"
origin = "github-advisory"
license = "MIT"
repo = "nitely/spirit"
cve = "CVE-2022-0869 GHSA-5p9j-w2wx-qx4c"
cwe = "CWE-601"
commit = "8f32f89654d6c30d56e0dd167059d32146fb32ef"
parent = "8b48d18e44f1dbb4b0f0a0a975d0dc14b88f0f41"
commit_url = "https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef"
vendored = false
host = "github"
path = "spirit/user/auth/views.py"
mode = "name"
relpath = "spirit/user/auth/views.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2022-02-23"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "spirit/user/auth/views.py"
function = "custom_login"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-5p9j-w2wx-qx4c: custom_login replaces redirect(request.GET next) with safe_redirect (url_has_allowed_host_and_scheme check)"

[[pair]]
name = "archivy-login-2d8cb29"
slice = "advisory-fixes"
language = "python"
framework = "flask"
origin = "github-advisory"
license = "MIT"
repo = "archivy/archivy"
cve = "CVE-2022-0697 GHSA-28mg-98xm-q493"
cwe = "CWE-601"
commit = "2d8cb29853190d42572b36deb61127e68d6be574"
parent = "fa389e7d59f91980693965830839d6de1f1db45f"
commit_url = "https://github.com/archivy/archivy/commit/2d8cb29853190d42572b36deb61127e68d6be574"
vendored = false
host = "github"
path = "archivy/routes.py"
mode = "name"
relpath = "archivy/routes.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-02-24"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "archivy/routes.py"
function = "login"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-28mg-98xm-q493: login redirects to next only when is_safe_redirect_url (same host, http/https) holds"

[[pair]]
name = "truelayer-dotnet-getpayment-75e436e"
slice = "advisory-fixes"
language = "csharp"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "truelayer/truelayer-dotnet"
cve = "CVE-2024-23838 GHSA-67m4-qxp3-j6hh"
cwe = "CWE-918"
commit = "75e436ed5360faa73d6e7ce3a9903a3c49505e3e"
parent = "9bf4120a355b1da8f2622b5c9bbe6b084b06cb91"
commit_url = "https://github.com/truelayer/truelayer-dotnet/commit/75e436ed5360faa73d6e7ce3a9903a3c49505e3e"
vendored = false
host = "github"
path = "src/TrueLayer/Payments/PaymentsApi.cs"
mode = "name"
relpath = "src/TrueLayer/Payments/PaymentsApi.cs"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-01-22"

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "src/TrueLayer/Payments/PaymentsApi.cs"
function = "GetPayment"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-67m4-qxp3-j6hh: GetPayment built new Uri(_baseUri, id) so an absolute-URL id redirected the authenticated request off-host; fix rejects URL ids (NotAUrl) and appends the id as a path segment"

[[pair]]
name = "koa-back-422c551"
slice = "advisory-fixes"
language = "javascript"
framework = "koa"
origin = "github-advisory"
license = "MIT"
repo = "koajs/koa"
cve = "CVE-2025-8129 GHSA-jgmv-j7ww-jx2x"
cwe = "CWE-601"
commit = "422c551c63d00f24e2bbbdf492f262a5935bb1f0"
parent = "6e51eb15169598be1130e8bbe06e67b1d4907275"
commit_url = "https://github.com/koajs/koa/commit/422c551c63d00f24e2bbbdf492f262a5935bb1f0"
vendored = false
host = "github"
path = "lib/response.js"
mode = "name"
relpath = "lib/response.js"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-07-27"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "lib/response.js"
function = "back"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-jgmv-j7ww-jx2x: back() no longer redirects to the raw Referrer header; it accepts only relative paths or same-host absolute URLs"

[[pair]]
name = "miniflux-checklogin-76df99f"
slice = "advisory-fixes"
language = "go"
framework = "net/http"
origin = "github-advisory"
license = "Apache-2.0"
repo = "miniflux/v2"
cve = "CVE-2025-67713 GHSA-wqv2-4wpg-8hc9"
cwe = "CWE-601"
commit = "76df99f3a3db234cf6b312be5e771485213d03c7"
parent = "57e3eaecd9bd2d9e70c7bda8fe20b2cc90badd9d"
commit_url = "https://github.com/miniflux/v2/commit/76df99f3a3db234cf6b312be5e771485213d03c7"
vendored = false
host = "github"
path = "internal/ui/login_check.go"
mode = "name"
relpath = "internal/ui/login_check.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-10-26"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "internal/ui/login_check.go"
function = "checkLogin"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-wqv2-4wpg-8hc9: checkLogin accepted any non-absolute redirect_url (including //host); fix requires urllib.IsRelativePath (no host, no scheme) before redirecting"

[[pair]]
name = "taguette-go-to-next-67de2d2"
slice = "advisory-fixes"
language = "python"
framework = "tornado"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "remram44/taguette"
cve = "CVE-2025-67502 GHSA-5923-r76v-mprm"
cwe = "CWE-601"
commit = "67de2d2612e7e2572c61cd9627f89c2bfd0f2a36"
parent = "b34e2156a49a313c8af13885d9b0ae6fe3b1b93e"
commit_url = "https://github.com/remram44/taguette/commit/67de2d2612e7e2572c61cd9627f89c2bfd0f2a36"
vendored = false
host = "github"
path = "taguette/web/views.py"
mode = "name"
relpath = "taguette/web/views.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-12-08"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "taguette/web/views.py"
function = "_go_to_next"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-5923-r76v-mprm: _go_to_next now passes the next argument through sanitize_next_url (same-base-path allow-list) before redirect"

[[pair]]
name = "weasyprint-default-url-fetcher-b6a14f0"
slice = "advisory-fixes"
language = "python"
framework = ""
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "kozea/weasyprint"
cve = "CVE-2025-68616 GHSA-983w-rhvv-gwmv"
cwe = "CWE-918"
commit = "b6a14f0f3f4ce9c0c75c1a2d73cb1c5d43f0e565"
parent = "1140eba630ce1c5194872e90122df0e154790d65"
commit_url = "https://github.com/kozea/weasyprint/commit/b6a14f0f3f4ce9c0c75c1a2d73cb1c5d43f0e565"
vendored = false
host = "github"
path = "weasyprint/urls.py"
mode = "name"
relpath = "weasyprint/urls.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-19"

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "weasyprint/urls.py"
function = "default_url_fetcher"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-983w-rhvv-gwmv: default_url_fetcher followed HTTP redirects past custom-fetcher allow-lists; fix builds its URLFetcher with allow_redirects=False"

[[pair]]
name = "feathers-getredirect-ee19a0a"
slice = "advisory-fixes"
language = "typescript"
framework = "feathers"
origin = "github-advisory"
license = "MIT"
repo = "feathersjs/feathers"
cve = "CVE-2026-27191 GHSA-ppf9-4ffw-hh4p"
cwe = "CWE-601"
commit = "ee19a0ae9bc2ebf23b1fe598a1f7361981b65401"
parent = "e4c0dac68b00615c7bc4724871375a14863a2447"
commit_url = "https://github.com/feathersjs/feathers/commit/ee19a0ae9bc2ebf23b1fe598a1f7361981b65401"
vendored = false
host = "github"
path = "packages/authentication-oauth/src/strategy.ts"
mode = "name"
relpath = "packages/authentication-oauth/src/strategy.ts"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-03"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "packages/authentication-oauth/src/strategy.ts"
function = "getRedirect"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-ppf9-4ffw-hh4p: getRedirect now rejects redirect query values containing @, backslash or // before appending them to the allowed origin"

[[pair]]
name = "mailpit-dohead-10ad4df"
slice = "advisory-fixes"
language = "go"
framework = "net/http"
origin = "github-advisory"
license = "MIT"
repo = "axllent/mailpit"
cve = "CVE-2026-27808 GHSA-mpf7-p9x7-96r3"
cwe = "CWE-918"
commit = "10ad4df8cc0cd9e51dea1b4410009545eef7fbf5"
parent = "632113fcc5c953e282d45896c63479a291579fe3"
commit_url = "https://github.com/axllent/mailpit/commit/10ad4df8cc0cd9e51dea1b4410009545eef7fbf5"
vendored = false
host = "github"
path = "internal/linkcheck/status.go"
mode = "name"
relpath = "internal/linkcheck/status.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-24"

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "internal/linkcheck/status.go"
function = "doHead"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-mpf7-p9x7-96r3: doHead now validates the link URL, dials through safeDialContext (blocks internal IPs) and re-validates redirect targets"

[[pair]]
name = "devise-redirect-url-025fe21"
slice = "advisory-fixes"
language = "ruby"
framework = "rails"
origin = "github-advisory"
license = "MIT"
repo = "heartcombo/devise"
cve = "CVE-2026-40295 GHSA-jp94-3292-c3xv"
cwe = "CWE-601"
commit = "025fe2124f9928766fc46520e999633b598d0360"
parent = "7ca7ed9c174525a4d36167441b35af4a0991b6af"
commit_url = "https://github.com/heartcombo/devise/commit/025fe2124f9928766fc46520e999633b598d0360"
vendored = false
host = "github"
path = "lib/devise/failure_app.rb"
mode = "name"
relpath = "lib/devise/failure_app.rb"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-05-08"

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "lib/devise/failure_app.rb"
function = "redirect_url"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-jp94-3292-c3xv: FailureApp#redirect_url returned request.referrer verbatim on non-GET timeouts; fix reduces it to a same-site path via extract_path_from_location"

[[pair]]
name = "koel-createforepisode-8708f07"
slice = "advisory-fixes"
language = "php"
framework = "laravel"
origin = "github-advisory"
license = "MIT"
repo = "koel/koel"
cve = "CVE-2026-47260 GHSA-7j2f-6h2r-6cqc"
cwe = "CWE-918"
commit = "8708f077efd7d8a332b32e954d65bc837f3a413a"
parent = "1f1700743ef5fde0d8d74e1ee2d98fb0b134aae1"
commit_url = "https://github.com/koel/koel/commit/8708f077efd7d8a332b32e954d65bc837f3a413a"
vendored = false
host = "github"
path = "app/Values/Podcast/EpisodePlayable.php"
mode = "name"
relpath = "app/Values/Podcast/EpisodePlayable.php"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-18"

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "app/Values/Podcast/EpisodePlayable.php"
function = "createForEpisode"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-7j2f-6h2r-6cqc: createForEpisode refuses to Http::sink()->get() an episode enclosure URL unless Network::isSafeUrl (public host, http/https)"

[[pair]]
name = "og-image-resolve-243cac2"
slice = "advisory-fixes"
language = "typescript"
framework = "nuxt"
origin = "github-advisory"
license = "MIT"
repo = "nuxt-modules/og-image"
cve = "CVE-2026-61793 GHSA-q8hw-4fvp-9rwv"
cwe = "CWE-918"
commit = "243cac2228671d3711c2bd65e300c278fcdf5a4e"
parent = "5aa6dbf0b3848b578a87144032cfb6b734454b56"
commit_url = "https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e"
vendored = false
host = "github"
path = "src/runtime/server/og-image/bindings/font-assets/node.ts"
mode = "name"
relpath = "src/runtime/server/og-image/bindings/font-assets/node.ts"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-24"

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "src/runtime/server/og-image/bindings/font-assets/node.ts"
function = "resolve"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-q8hw-4fvp-9rwv: resolve() fetched new URL(font path, origin) for attacker-supplied fonts[].path so absolute or //host paths reached arbitrary hosts; fix classifies data:/external URLs and fetches through fetchWithRedirectValidation"

[[pair]]
name = "koillection-fetchwithhttpclient-4d445e2"
slice = "advisory-fixes"
language = "php"
framework = "symfony"
origin = "github-advisory"
license = "MIT"
repo = "benjaminjonard/koillection"
cve = "CVE-2026-50888 GHSA-gmxh-hjfv-qc2w"
cwe = "CWE-918"
commit = "4d445e21c631c26070f19fe8ec086a2939767ae0"
parent = "d2a244068046c65001d429d0d27e58262255cc00"
commit_url = "https://github.com/benjaminjonard/koillection/commit/4d445e21c631c26070f19fe8ec086a2939767ae0"
vendored = false
host = "github"
path = "src/Service/Scraper/HtmlScraper.php"
mode = "name"
relpath = "src/Service/Scraper/HtmlScraper.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-08-05"

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "src/Service/Scraper/HtmlScraper.php"
function = "fetchWithHttpClient"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-gmxh-hjfv-qc2w: fetchWithHttpClient now wraps CurlHttpClient in NoPrivateNetworkHttpClient so user-supplied scrape URLs cannot reach private networks"

[[pair]]
name = "elfinderaspnet-extractasync-675049b"
slice = "advisory-fixes"
language = "csharp"
framework = "aspnet"
origin = "github-advisory"
license = "BSD-2-Clause"
repo = "mguinness/elFinder.AspNet"
cve = "CVE-2021-23415 GHSA-pjxv-w3qj-j8m3"
cwe = "CWE-22"
commit = "675049b39284a9e84f0915c71d688da8ebc7d720"
parent = "8f2690712bd6cf417d897d70f734d6e972cf0071"
commit_url = "https://github.com/mguinness/elFinder.AspNet/commit/675049b39284a9e84f0915c71d688da8ebc7d720"
vendored = false
host = "github"
path = "elFinder.AspNet/Drivers/FileSystem/FileSystemDriver.cs"
mode = "name"
relpath = "elFinder.AspNet/Drivers/FileSystem/FileSystemDriver.cs"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2021-07-10"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "elFinder.AspNet/Drivers/FileSystem/FileSystemDriver.cs"
function = "ExtractAsync"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-pjxv-w3qj-j8m3: FileSystemDriver.ExtractAsync resolves each archive entry with Path.GetFullPath and rejects entries outside the destination root (zip slip)"

[[pair]]
name = "hsweb-framework-createstaticsavepath-8009845"
slice = "advisory-fixes"
language = "java"
framework = "spring"
origin = "github-advisory"
license = "Apache-2.0"
repo = "hs-web/hsweb-framework"
cve = "CVE-2026-11470 GHSA-vjmr-f5fc-vr2w"
cwe = "CWE-22"
commit = "8009845b577d8a2c4bbf4fdd8e8913799a714be6"
parent = "76cb89f56e871c25721a79f2b1eb3b37f4d48570"
commit_url = "https://github.com/hs-web/hsweb-framework/commit/8009845b577d8a2c4bbf4fdd8e8913799a714be6"
vendored = false
host = "github"
path = "hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java"
mode = "name"
relpath = "hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-26"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "hsweb-system/hsweb-system-file/src/main/java/org/hswebframework/web/file/FileUploadProperties.java"
function = "createStaticSavePath"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-vjmr-f5fc-vr2w: createStaticSavePath reduces the upload name to its NFKC-normalised base name, allows original names only when [a-zA-Z0-9._-]+, and normalises the save path"

[[pair]]
name = "changedetectionio-static-content-9d38b45"
slice = "advisory-fixes"
language = "python"
framework = "flask"
origin = "github-advisory"
license = "Apache-2.0"
repo = "dgtlmoon/changedetection.io"
cve = "CVE-2026-25527 GHSA-9jj8-v89v-xjvw"
cwe = "CWE-22"
commit = "9d38b4517364831889b5b0d7b3465fd060403fd4"
parent = "3558e9ee10cfe19cfe9209e469e43e9327c26735"
commit_url = "https://github.com/dgtlmoon/changedetection.io/commit/9d38b4517364831889b5b0d7b3465fd060403fd4"
vendored = false
host = "github"
path = "changedetectionio/flask_app.py"
mode = "name"
relpath = "changedetectionio/flask_app.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-16"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "changedetectionio/flask_app.py"
function = "static_content"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-9jj8-v89v-xjvw: static_content tightens group/filename sanitisation to [a-z0-9_] (no dots) and 404s on empty names"

[[pair]]
name = "rack-check-forbidden-75c5745"
slice = "advisory-fixes"
language = "ruby"
framework = "rack"
origin = "github-advisory"
license = "MIT"
repo = "rack/rack"
cve = "CVE-2026-22860 GHSA-mxw3-3hh2-x2mh"
cwe = "CWE-22"
commit = "75c5745c286637a8f049a33790c71237762069e7"
parent = "f2f225f297b99fbee3d9f51255d41f601fc40aff"
commit_url = "https://github.com/rack/rack/commit/75c5745c286637a8f049a33790c71237762069e7"
vendored = false
host = "github"
path = "lib/rack/directory.rb"
mode = "name"
relpath = "lib/rack/directory.rb"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-16"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "lib/rack/directory.rb"
function = "check_forbidden"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-mxw3-3hh2-x2mh: Rack::Directory#check_forbidden compares the expanded path against root plus a trailing separator, closing the sibling-prefix bypass"

[[pair]]
name = "camaleon-cms-fetch-file-f54a77e"
slice = "advisory-fixes"
language = "ruby"
framework = "rails"
origin = "github-advisory"
license = "MIT"
repo = "owen2345/camaleon-cms"
cve = "CVE-2026-1776 GHSA-jw5g-f64p-6x78"
cwe = "CWE-22"
commit = "f54a77e2a7be601215ea1b396038c589a0cab9af"
parent = "df576a2f80539b847e84768b7cc36f776f1b8dfb"
commit_url = "https://github.com/owen2345/camaleon-cms/commit/f54a77e2a7be601215ea1b396038c589a0cab9af"
vendored = false
host = "github"
path = "app/uploaders/camaleon_cms_aws_uploader.rb"
mode = "name"
relpath = "app/uploaders/camaleon_cms_aws_uploader.rb"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-08"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "app/uploaders/camaleon_cms_aws_uploader.rb"
function = "fetch_file"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-jw5g-f64p-6x78: CamaleonCmsAwsUploader#fetch_file now rejects file names failing valid_folder_path? before reading/downloading to the local path"

[[pair]]
name = "wicket-save-7247098"
slice = "advisory-fixes"
language = "java"
framework = "wicket"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/wicket"
cve = "CVE-2026-43975 GHSA-3gmf-p6r4-q8m6"
cwe = "CWE-22"
commit = "72470983f689c61e6a6c0b7388ef955f23bb1e16"
parent = "db0a3dc6e38948f9e87346ddf71f9337fb1b6dbc"
commit_url = "https://github.com/apache/wicket/commit/72470983f689c61e6a6c0b7388ef955f23bb1e16"
vendored = false
host = "github"
path = "wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/resource/FolderUploadsFileManager.java"
mode = "name"
relpath = "wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/resource/FolderUploadsFileManager.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-27"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "wicket-core/src/main/java/org/apache/wicket/markup/html/form/upload/resource/FolderUploadsFileManager.java"
function = "save"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-3gmf-p6r4-q8m6: FolderUploadsFileManager.save resolves the client file name through a containment-checked resolveTargetFile instead of new File(folder, clientFileName)"

[[pair]]
name = "yii2-renderphpfile-109878b"
slice = "advisory-fixes"
language = "php"
framework = "yii"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "yiisoft/yii2"
cve = "CVE-2026-39850 GHSA-5vpg-rj7q-qpw2"
cwe = "CWE-98"
commit = "109878b491dbffa541032bc99fb5e26d12cd0375"
parent = "f635d552241c348be8a0020f531a3e278e89b6d9"
commit_url = "https://github.com/yiisoft/yii2/commit/109878b491dbffa541032bc99fb5e26d12cd0375"
vendored = false
host = "github"
path = "framework/base/View.php"
mode = "name"
relpath = "framework/base/View.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-05-09"

[[pair.expected]]
cwe = "CWE-98"
class = "file-inclusion"
path = "framework/base/View.php"
function = "renderPhpFile"
mechanism = "source_reaches_sink"
family = "path"
evidence = "GHSA-5vpg-rj7q-qpw2: renderPhpFile moves extract()+require into an isolated closure so view params can no longer overwrite the included file path"

[[pair]]
name = "yard-check-static-cache-f78c19f"
slice = "advisory-fixes"
language = "ruby"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "lsegal/yard"
cve = "CVE-2026-49342 GHSA-pxcc-8665-phx8"
cwe = "CWE-22"
commit = "f78c19f0dd33a407085b4ed181bb60c0aa0078b4"
parent = "d29a77cd5fe7ea2be352e4079c93c5dc216ccefe"
commit_url = "https://github.com/lsegal/yard/commit/f78c19f0dd33a407085b4ed181bb60c0aa0078b4"
vendored = false
host = "github"
path = "lib/yard/server/static_caching.rb"
mode = "name"
relpath = "lib/yard/server/static_caching.rb"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-25"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "lib/yard/server/static_caching.rb"
function = "check_static_cache"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-pxcc-8665-phx8: check_static_cache builds the cache path through cache_path, which rejects .. segments and drive prefixes and cleans the path, instead of joining request.path raw"

[[pair]]
name = "thumbor-load-3b986d1"
slice = "advisory-fixes"
language = "python"
framework = "tornado"
origin = "github-advisory"
license = "MIT"
repo = "thumbor/thumbor"
cve = "CVE-2026-53502 GHSA-cj54-hpcc-gj6h"
cwe = "CWE-22"
commit = "3b986d13677b30fe6651c8c72ebb25957ac0a40d"
parent = "471ef279700e9f79941d451acf88abe1601df875"
commit_url = "https://github.com/thumbor/thumbor/commit/3b986d13677b30fe6651c8c72ebb25957ac0a40d"
vendored = false
host = "github"
path = "thumbor/loaders/file_loader.py"
mode = "name"
relpath = "thumbor/loaders/file_loader.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-05-30"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "thumbor/loaders/file_loader.py"
function = "load"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-cj54-hpcc-gj6h: load decodes the path before joining under FILE_LOADER_ROOT_PATH and re-checks root containment (commonpath) for the literal fallback"

[[pair]]
name = "filebrowser-subtitleshandler-f3f4bbe"
slice = "advisory-fixes"
language = "go"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "gtsteffaniak/filebrowser"
cve = "CVE-2026-54910 GHSA-vvp7-h4fj-m28w"
cwe = "CWE-22"
commit = "f3f4bbe80cb569d664174aea874d7bfa008c3b5a"
parent = "863f8f64a3d055ac8fb712c0e7bfcf3ac7f173f0"
commit_url = "https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a"
vendored = false
host = "github"
path = "backend/http/media.go"
mode = "name"
relpath = "backend/http/media.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-08"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "backend/http/media.go"
function = "subtitlesHandler"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-vvp7-h4fj-m28w: subtitlesHandler only serves a subtitle track found for the video and joins filepath.Base(track.Name) instead of the raw name parameter"

[[pair]]
name = "laravel-mediable-sanitizepath-6d1e7fb"
slice = "advisory-fixes"
language = "php"
framework = "laravel"
origin = "github-advisory"
license = "MIT"
repo = "plank/laravel-mediable"
cve = "CVE-2026-49970 GHSA-xv8g-76mx-2rxc"
cwe = "CWE-22"
commit = "6d1e7fb39922fdfb3b2d120e13f4eb2e653ae082"
parent = "7e9e3000fa05fe16e678f15bfb51a091e60c2cb8"
commit_url = "https://github.com/plank/laravel-mediable/commit/6d1e7fb39922fdfb3b2d120e13f4eb2e653ae082"
vendored = false
host = "github"
path = "src/Helpers/File.php"
mode = "name"
relpath = "src/Helpers/File.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-14"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/Helpers/File.php"
function = "sanitizePath"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-xv8g-76mx-2rxc: sanitizePath now normalises backslashes and drops . and .. segments instead of only stripping characters"

[[pair]]
name = "external-workspace-manager-plugin-computecustompath-2fccbbd"
slice = "advisory-fixes"
language = "java"
framework = "jenkins"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/external-workspace-manager-plugin"
cve = "CVE-2026-57296 GHSA-hrmj-8fm9-cg8x"
cwe = "CWE-22"
commit = "2fccbbd398cf209f5931b48e006659dbee86ddf2"
parent = "265ef4f624a8fefc976b1656d83d9c1ab1a493ae"
commit_url = "https://github.com/jenkinsci/external-workspace-manager-plugin/commit/2fccbbd398cf209f5931b48e006659dbee86ddf2"
vendored = false
host = "github"
path = "src/main/java/org/jenkinsci/plugins/ewm/steps/ExwsAllocateExecution.java"
mode = "name"
relpath = "src/main/java/org/jenkinsci/plugins/ewm/steps/ExwsAllocateExecution.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-16"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/main/java/org/jenkinsci/plugins/ewm/steps/ExwsAllocateExecution.java"
function = "computeCustomPath"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-hrmj-8fm9-cg8x: computeCustomPath rejects '..' segments in the user-supplied custom workspace path before building the FilePath"

[[pair]]
name = "openhop-filepath-c8190fb"
slice = "advisory-fixes"
language = "typescript"
framework = "fastify"
origin = "github-advisory"
license = "MIT"
repo = "naorsabag/openhop"
cve = "CVE-2026-59179 GHSA-g72f-jw3w-mgh7"
cwe = "CWE-22"
commit = "c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4"
parent = "6bde78bf88aafa09a39dfaf45978c73d1c5fedc3"
commit_url = "https://github.com/naorsabag/openhop/commit/c8190fbefa3a50e7b0c16c001d2e05b0e920cfb4"
vendored = false
host = "github"
path = "packages/server/src/store.ts"
mode = "name"
relpath = "packages/server/src/store.ts"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-20"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "packages/server/src/store.ts"
function = "filePath"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-g72f-jw3w-mgh7: FlowStore.filePath asserts the flow id is valid (no separators or dot segments) before joining it under the flows directory"

[[pair]]
name = "handlebarsjava-getresource-61f4342"
slice = "advisory-fixes"
language = "java"
framework = "spring"
origin = "github-advisory"
license = "Apache-2.0"
repo = "jknack/handlebars.java"
cve = "CVE-2026-63490 GHSA-g29j-rwfv-h99w"
cwe = "CWE-22"
commit = "61f43423a337b87db5fec1fe59f0725aaaa38df5"
parent = "c95855064f48f1a66af2a5da5a9c1522d7f57264"
commit_url = "https://github.com/jknack/handlebars.java/commit/61f43423a337b87db5fec1fe59f0725aaaa38df5"
vendored = false
host = "github"
path = "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java"
mode = "name"
relpath = "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-28"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java"
function = "getResource"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-g29j-rwfv-h99w: SpringTemplateLoader.getResource normalises the location and rejects paths escaping the configured prefix, then rejects URLs with query/fragment components"

[[pair]]
name = "fastify-static-pumpsendtoreply-db4276f"
slice = "advisory-fixes"
language = "javascript"
framework = "fastify"
origin = "github-advisory"
license = "MIT"
repo = "fastify/fastify-static"
cve = "CVE-2026-15074 GHSA-83w8-p2f5-377r"
cwe = "CWE-22"
commit = "db4276f846ba56b21f93768cd6636ee5e2fc58b1"
parent = "c68224e3067e18ee4c676cc9db66aae6b30ffb02"
commit_url = "https://github.com/fastify/fastify-static/commit/db4276f846ba56b21f93768cd6636ee5e2fc58b1"
vendored = false
host = "github"
path = "index.js"
mode = "name"
relpath = "index.js"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-07-22"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "index.js"
function = "pumpSendToReply"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-83w8-p2f5-377r: pumpSendToReply now rejects non-leading .. segments with 403 before the allowedPath route guard and send()"

[[pair]]
name = "goshs-upload-f3ef599"
slice = "advisory-fixes"
language = "go"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "goshs-labs/goshs"
cve = "CVE-2026-66064 GHSA-964w-f6gj-5236"
cwe = "CWE-22"
commit = "f3ef599e409151d1380866e47de8b1afb0bb54fa"
parent = "ddd2eb9470237e68f0d6c828dd75173708e60277"
commit_url = "https://github.com/goshs-labs/goshs/commit/f3ef599e409151d1380866e47de8b1afb0bb54fa"
vendored = false
host = "github"
path = "httpserver/updown.go"
mode = "name"
relpath = "httpserver/updown.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-07-27"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "httpserver/updown.go"
function = "upload"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-964w-f6gj-5236: FileServer.upload rejects empty/./.. filenames and checks the joined destination stays inside targetDir via sanitizePath"

[[pair]]
name = "knowns-get-09c5a96"
slice = "advisory-fixes"
language = "go"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "knowns-dev/knowns"
cve = "CVE-2026-86439 GHSA-9gfj-28hw-jchp"
cwe = "CWE-22"
commit = "09c5a96fd5817b941dc86669278c1a17db10ed4e"
parent = "d3989829fb5095666d23d005b2f78a082832a396"
commit_url = "https://github.com/knowns-dev/knowns/commit/09c5a96fd5817b941dc86669278c1a17db10ed4e"
vendored = false
host = "github"
path = "internal/storage/doc_store.go"
mode = "name"
relpath = "internal/storage/doc_store.go"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-08-15"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "internal/storage/doc_store.go"
function = "Get"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-9gfj-28hw-jchp: DocStore.Get resolves the doc path through resolveDocPath/safepath.Resolve (containment) instead of a raw filepath.Join"

[[pair]]
name = "webpack-dev-middleware-getfilenamefromurl-13344e7"
slice = "advisory-fixes"
language = "javascript"
framework = "express"
origin = "github-advisory"
license = "MIT"
repo = "webpack/webpack-dev-middleware"
cve = "CVE-2026-76844 GHSA-g84c-rxfj-3j2c"
cwe = "CWE-22"
commit = "13344e78b26d88fe9b7c8381a3860e248a52359b"
parent = "e58a70ba9c36f6acc10617f338b73269f951de35"
commit_url = "https://github.com/webpack/webpack-dev-middleware/commit/13344e78b26d88fe9b7c8381a3860e248a52359b"
vendored = false
host = "github"
path = "src/middleware.js"
mode = "name"
relpath = "src/middleware.js"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-09-03"

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/middleware.js"
function = "getFilenameFromUrl"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-g84c-rxfj-3j2c: getFilenameFromUrl verifies path.relative(outputPath, filename) stays inside outputPath after the publicPath prefix is stripped"

[[pair]]
name = "template-load-28cff3a"
slice = "advisory-fixes"
language = "go"
framework = "fiber"
origin = "github-advisory"
license = "MIT"
repo = "gofiber/template"
cve = "CVE-2024-22199 GHSA-4mq2-gc4j-cmw6"
cwe = "CWE-79"
commit = "28cff3ac4d4c117ab25b5396954676d624b6cb46"
parent = "fd5a1ab847ebbf537447561827f310ba70fd0998"
commit_url = "https://github.com/gofiber/template/commit/28cff3ac4d4c117ab25b5396954676d624b6cb46"
vendored = false
host = "github"
path = "django/django.go"
mode = "name"
relpath = "django/django.go"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2024-01-11"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "django/django.go"
function = "Load"
mechanism = "other"
family = "output_encoding"
evidence = "GHSA-4mq2-gc4j-cmw6: the Django engine Load() stops forcing pongo2.SetAutoescape(false) and enables autoescaping by default, so template variables are HTML-escaped"

[[pair]]
name = "zeppelin-fromjson-8368579"
slice = "advisory-fixes"
language = "java"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/zeppelin"
cve = "CVE-2024-31868 GHSA-rrvf-5w4r-3x7v"
cwe = "CWE-79"
commit = "83685795e0ec8d3059fd7a3dbcae5c0532b63b79"
parent = "ccf1a992da3556262b0a2d571f8b823a3b33c242"
commit_url = "https://github.com/apache/zeppelin/commit/83685795e0ec8d3059fd7a3dbcae5c0532b63b79"
vendored = false
host = "github"
path = "zeppelin-interpreter/src/main/java/org/apache/zeppelin/helium/HeliumPackage.java"
mode = "name"
relpath = "zeppelin-interpreter/src/main/java/org/apache/zeppelin/helium/HeliumPackage.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-03-10"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "zeppelin-interpreter/src/main/java/org/apache/zeppelin/helium/HeliumPackage.java"
function = "fromJson"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-rrvf-5w4r-3x7v: fromJson now HTML-escapes every string field of the deserialised Helium package (escapeHtml4 via preventXss) before it reaches the UI"

[[pair]]
name = "moonshine-resolvepreview-f108f4e"
slice = "advisory-fixes"
language = "php"
framework = "laravel"
origin = "github-advisory"
license = "MIT"
repo = "moonshine-software/moonshine"
cve = "CVE-2025-51487 GHSA-p632-58pp-c9xg"
cwe = "CWE-79"
commit = "f108f4ea5c0d66e8172c2dc397c1d9a6f466d9c6"
parent = "959e99397fbd3c681cb27afdddcd7fa338248b03"
commit_url = "https://github.com/moonshine-software/moonshine/commit/f108f4ea5c0d66e8172c2dc397c1d9a6f466d9c6"
vendored = false
host = "github"
path = "src/Laravel/src/Fields/Relationships/BelongsTo.php"
mode = "name"
relpath = "src/Laravel/src/Fields/Relationships/BelongsTo.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-05-14"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/Laravel/src/Fields/Relationships/BelongsTo.php"
function = "resolvePreview"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-p632-58pp-c9xg: BelongsTo::resolvePreview now passes the related record preview through escapeValue unless the field is explicitly unescaped"

[[pair]]
name = "chrome-construct-34b2b8d"
slice = "advisory-fixes"
language = "php"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "chrome-php/chrome"
cve = "CVE-2025-48883 GHSA-3432-fmrf-7vmh"
cwe = "CWE-79"
commit = "34b2b8d1691f4e3940b1e1e95d388fffe81169c8"
parent = "e3bd5857914a885e768293fdda135298f866034b"
commit_url = "https://github.com/chrome-php/chrome/commit/34b2b8d1691f4e3940b1e1e95d388fffe81169c8"
vendored = false
host = "github"
path = "src/Dom/Selector/CssSelector.php"
mode = "name"
relpath = "src/Dom/Selector/CssSelector.php"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-05-28"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/Dom/Selector/CssSelector.php"
function = "__construct"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-3432-fmrf-7vmh: the CssSelector constructor now json_encodes the selector expression so it is a safe JS string literal before it is formatted into querySelectorAll scripts"

[[pair]]
name = "prosemirror-to-html-render-opening-tag-4d59f94"
slice = "advisory-fixes"
language = "ruby"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "etaminstudio/prosemirror_to_html"
cve = "CVE-2025-64501 GHSA-52c5-vh7f-26fx"
cwe = "CWE-79"
commit = "4d59f94f550bcabeec30d298791bbdd883298ad8"
parent = "0797c1555aee010606c82f873489716a001903f0"
commit_url = "https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8"
vendored = false
host = "github"
path = "lib/prosemirror_to_html.rb"
mode = "name"
relpath = "lib/prosemirror_to_html.rb"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-11-05"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "lib/prosemirror_to_html.rb"
function = "render_opening_tag"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-52c5-vh7f-26fx: render_opening_tag now CGI.escapeHTML-escapes each node attribute value before writing it into the opening tag"

[[pair]]
name = "algernon-htmllink-cd88320"
slice = "advisory-fixes"
language = "go"
framework = ""
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "xyproto/algernon"
cve = "CVE-2025-65754 GHSA-8jqm-8qm3-qgqm"
cwe = "CWE-79"
commit = "cd8832014a624a9aeab60566434c3344135e23f8"
parent = "ae7772017187d65ddb026c562853013d47de3acc"
commit_url = "https://github.com/xyproto/algernon/commit/cd8832014a624a9aeab60566434c3344135e23f8"
vendored = false
host = "github"
path = "themes/html.go"
mode = "name"
relpath = "themes/html.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-11-13"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "themes/html.go"
function = "HTMLLink"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-8jqm-8qm3-qgqm: HTMLLink now sanitizes the filename-derived link text and URL with a bluemonday UGC policy before building the directory-listing anchor"

[[pair]]
name = "tornado-write-error-9c163ae"
slice = "advisory-fixes"
language = "python"
framework = "tornado"
origin = "github-advisory"
license = "Apache-2.0"
repo = "tornadoweb/tornado"
cve = "CVE-2025-67724 GHSA-pr2v-jx2c-wg9f"
cwe = "CWE-79"
commit = "9c163aebeaad9e6e7d28bac1f33580eb00b0e421"
parent = "771472cfdaeebc0d89a9cc46e249f8891a6b29cd"
commit_url = "https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421"
vendored = false
host = "github"
path = "tornado/web.py"
mode = "name"
relpath = "tornado/web.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-12-10"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "tornado/web.py"
function = "write_error"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-pr2v-jx2c-wg9f: write_error now passes the attacker-influenced reason phrase through escape.xhtml_escape before formatting it into the HTML error page"

[[pair]]
name = "htmlsanitizer-dosanitize-0ac53dc"
slice = "advisory-fixes"
language = "csharp"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "mganss/HtmlSanitizer"
cve = "CVE-2026-25543 GHSA-j92c-7v7g-gj3f"
cwe = "CWE-79"
commit = "0ac53dca30ddad963f2b243669a5066933d82b81"
parent = "ca3931ae6ef305ece676846b99cdc4dd1cae377c"
commit_url = "https://github.com/mganss/HtmlSanitizer/commit/0ac53dca30ddad963f2b243669a5066933d82b81"
vendored = false
host = "github"
path = "src/HtmlSanitizer/HtmlSanitizer.cs"
mode = "name"
relpath = "src/HtmlSanitizer/HtmlSanitizer.cs"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-02"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/HtmlSanitizer/HtmlSanitizer.cs"
function = "DoSanitize"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-j92c-7v7g-gj3f: DoSanitize now recurses into <template> element content fragments so markup hidden in templates is sanitized instead of passed through"

[[pair]]
name = "logging-log4net-formatxml-42a77cb"
slice = "advisory-fixes"
language = "csharp"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/logging-log4net"
cve = "CVE-2026-40021 GHSA-4f7c-pmjv-c25w"
cwe = "CWE-116"
commit = "42a77cb05abfd5b1ad7224f0861a932eac95c7c8"
parent = "10647645458a0ccce9ebbc5b0fa9b6b42b55332d"
commit_url = "https://github.com/apache/logging-log4net/commit/42a77cb05abfd5b1ad7224f0861a932eac95c7c8"
vendored = false
host = "github"
path = "src/log4net/Layout/XmlLayout.cs"
mode = "name"
relpath = "src/log4net/Layout/XmlLayout.cs"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-17"

[[pair.expected]]
cwe = "CWE-116"
class = "improper-encoding"
path = "src/log4net/Layout/XmlLayout.cs"
function = "FormatXml"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-4f7c-pmjv-c25w: FormatXml writes logger, thread, domain, identity, user and property values through WriteAttributeStringSafe, which masks XML-invalid characters instead of emitting them raw"

[[pair]]
name = "mistune-render-admonition-a3cb6e5"
slice = "advisory-fixes"
language = "python"
framework = ""
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "lepture/mistune"
cve = "CVE-2026-59926 GHSA-g97x-gvcm-x72h"
cwe = "CWE-79"
commit = "a3cb6e5655308797e8be021d6c7b5bab13cbace2"
parent = "aa4a81449dd397e384e9b39d1e60ba9be9bf5182"
commit_url = "https://github.com/lepture/mistune/commit/a3cb6e5655308797e8be021d6c7b5bab13cbace2"
vendored = false
host = "github"
path = "src/mistune/directives/admonition.py"
mode = "name"
relpath = "src/mistune/directives/admonition.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-15"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/mistune/directives/admonition.py"
function = "render_admonition"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-g97x-gvcm-x72h: render_admonition now HTML-escapes the user-supplied class option before writing it into the section class attribute"

[[pair]]
name = "slippers-attr-string-16cc4ef"
slice = "advisory-fixes"
language = "python"
framework = "django"
origin = "github-advisory"
license = "MIT"
repo = "mixxorz/slippers"
cve = "CVE-2026-34231 GHSA-w7rv-gfp4-j9j3"
cwe = "CWE-79"
commit = "16cc4ef4fa8ad2f7aee30798f16c3e7b653423b2"
parent = "935613c395cb2efb3731f8d7d6352a05f64988b3"
commit_url = "https://github.com/mixxorz/slippers/commit/16cc4ef4fa8ad2f7aee30798f16c3e7b653423b2"
vendored = false
host = "github"
path = "slippers/templatetags/slippers.py"
mode = "name"
relpath = "slippers/templatetags/slippers.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-30"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "slippers/templatetags/slippers.py"
function = "attr_string"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-w7rv-gfp4-j9j3: attr_string builds the key=\"value\" attribute with django format_html (escaping) instead of a raw f-string"

[[pair]]
name = "schema-org-toscript-be389b4"
slice = "advisory-fixes"
language = "php"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "spatie/schema-org"
cve = "GHSA-hwmc-r6mf-jh83"
cwe = "CWE-79"
commit = "be389b4759214c11cc1364a16e34a929c5af5a88"
parent = "8833f42996208e50488e6547e7102166c0331dd9"
commit_url = "https://github.com/spatie/schema-org/commit/be389b4759214c11cc1364a16e34a929c5af5a88"
vendored = false
host = "github"
path = "src/BaseType.php"
mode = "name"
relpath = "src/BaseType.php"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-20"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/BaseType.php"
function = "toScript"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-hwmc-r6mf-jh83: toScript adds JSON_HEX_TAG to json_encode so < and > in property values are encoded and cannot close the ld+json script element"

[[pair]]
name = "htmlpublisher-plugin-publishreports-1034d47"
slice = "advisory-fixes"
language = "java"
framework = "jenkins"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/htmlpublisher-plugin"
cve = "CVE-2026-42524 GHSA-f8h4-46xv-h7jj"
cwe = "CWE-79"
commit = "1034d4746cc5ca5c82c22d06935a1dac8c430717"
parent = "56062e8986cc1dba6ad0cfaa0d839222c178b62f"
commit_url = "https://github.com/jenkinsci/htmlpublisher-plugin/commit/1034d4746cc5ca5c82c22d06935a1dac8c430717"
vendored = false
host = "github"
path = "src/main/java/htmlpublisher/HtmlPublisher.java"
mode = "name"
relpath = "src/main/java/htmlpublisher/HtmlPublisher.java"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-22"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/main/java/htmlpublisher/HtmlPublisher.java"
function = "publishReports"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-f8h4-46xv-h7jj: publishReports now htmlAttributeEscapes the job name, root URL, job URL and report name written into the legacy wrapper data-* attributes"

[[pair]]
name = "jquery-autocomplete-formatgroup-63ff096"
slice = "advisory-fixes"
language = "typescript"
framework = "jquery"
origin = "github-advisory"
license = "MIT"
repo = "devbridge/jQuery-Autocomplete"
cve = "GHSA-hvqh-jw65-wcpq"
cwe = "CWE-79"
commit = "63ff096ff5b77a90aac7fb5dad7c86e538a59ce0"
parent = "02f58a1810f369550b4b279cb897319fec159126"
commit_url = "https://github.com/devbridge/jQuery-Autocomplete/commit/63ff096ff5b77a90aac7fb5dad7c86e538a59ce0"
vendored = false
host = "github"
path = "src/format.ts"
mode = "name"
relpath = "src/format.ts"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-21"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/format.ts"
function = "formatGroup"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-hvqh-jw65-wcpq: formatGroup sets the category via textContent and returns outerHTML instead of concatenating it raw into the group div"

[[pair]]
name = "view-component-render-in-48e5fd2"
slice = "advisory-fixes"
language = "ruby"
framework = "rails"
origin = "github-advisory"
license = "MIT"
repo = "ViewComponent/view_component"
cve = "CVE-2026-54498 GHSA-97jw-64cj-jc58"
cwe = "CWE-79"
commit = "48e5fd2d602344c7d33019fbc5c8b087e315bb78"
parent = "c35ec3f2b38344ed193cbc113546843a0fb613f4"
commit_url = "https://github.com/ViewComponent/view_component/commit/48e5fd2d602344c7d33019fbc5c8b087e315bb78"
vendored = false
host = "github"
path = "lib/view_component/base.rb"
mode = "name"
relpath = "lib/view_component/base.rb"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-04"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "lib/view_component/base.rb"
function = "render_in"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-97jw-64cj-jc58: render_in no longer trusts the around_render return value; a replaced/wrapped value is HTML-escaped via __vc_safe_around_render_output"

[[pair]]
name = "etherpad-gethtmlfromatext-86c56cf"
slice = "advisory-fixes"
language = "typescript"
framework = "express"
origin = "github-advisory"
license = "Apache-2.0"
repo = "ether/etherpad"
cve = "CVE-2026-55090 GHSA-2jp7-wwpg-3p9w"
cwe = "CWE-79"
commit = "86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1"
parent = "e417bc1047cf9dd1cb90c256c24f12f33a4feb15"
commit_url = "https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1"
vendored = false
host = "github"
path = "src/node/utils/ExportHtml.ts"
mode = "name"
relpath = "src/node/utils/ExportHtml.ts"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-07"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/node/utils/ExportHtml.ts"
function = "getHTMLFromAtext"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-2jp7-wwpg-3p9w: getHTMLFromAtext escapes attribute-pool values with Security.escapeHTMLAttribute and strips the data-* name before building export span tags"

[[pair]]
name = "silverstripe-versioned-getrestoremessage-6e30a2c"
slice = "advisory-fixes"
language = "php"
framework = "silverstripe"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "silverstripe/silverstripe-versioned"
cve = "CVE-2026-55779 GHSA-m4g4-86qc-v8w7"
cwe = "CWE-79"
commit = "6e30a2cf8d4b9233690464da61bd0fc4d3e92952"
parent = "98e2bb9e5f3a42b1e7b677c0347b4660ecdc0b39"
commit_url = "https://github.com/silverstripe/silverstripe-versioned/commit/6e30a2cf8d4b9233690464da61bd0fc4d3e92952"
vendored = false
host = "github"
path = "src/RestoreAction.php"
mode = "name"
relpath = "src/RestoreAction.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-18"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/RestoreAction.php"
function = "getRestoreMessage"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-m4g4-86qc-v8w7: getRestoreMessage now wraps the restored record Title, edit link and URLSegment in Convert::raw2xml before building the HTML restore message"

[[pair]]
name = "dicebear-addrotate-922946d"
slice = "advisory-fixes"
language = "typescript"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "dicebear/dicebear"
cve = "CVE-2026-68921 GHSA-gcr2-9v8m-gq45"
cwe = "CWE-79"
commit = "922946d738c4e77ab6c412e27ede75941fec4b59"
parent = "efe62f2700e9e45b60e40b0e92a22e93d07e237d"
commit_url = "https://github.com/dicebear/dicebear/commit/922946d738c4e77ab6c412e27ede75941fec4b59"
vendored = false
host = "github"
path = "packages/@dicebear/core/src/utils/svg.ts"
mode = "name"
relpath = "packages/@dicebear/core/src/utils/svg.ts"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-07-05"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/@dicebear/core/src/utils/svg.ts"
function = "addRotate"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-gcr2-9v8m-gq45: addRotate XML-escapes the rotate option before interpolating it into the SVG transform attribute"

[[pair]]
name = "tablib-export-book-b0ff39f"
slice = "advisory-fixes"
language = "python"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "jazzband/tablib"
cve = "CVE-2026-9318 GHSA-gqgw-jghv-mxwx"
cwe = "CWE-79"
commit = "b0ff39fb9b2f457e5332249b4cc2ec11eabf46ee"
parent = "ed7cd8fc33480ec6727346deb14e28f465a3d1a5"
commit_url = "https://github.com/jazzband/tablib/commit/b0ff39fb9b2f457e5332249b4cc2ec11eabf46ee"
vendored = false
host = "github"
path = "src/tablib/formats/_html.py"
mode = "name"
relpath = "src/tablib/formats/_html.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-07-31"

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/tablib/formats/_html.py"
function = "export_book"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-gqgw-jghv-mxwx: export_book stops interpolating the dataset title raw into the HTML heading and serialises it through an ElementTree element, which escapes it"

[[pair]]
name = "serialize-to-js-deserialize-1cd4339"
slice = "advisory-fixes"
language = "javascript"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "commenthol/serialize-to-js"
cve = "CVE-2017-5954 GHSA-mm62-wxc8-cf7m"
cwe = "CWE-502"
commit = "1cd433960e5b9db4c0b537afb28366198a319429"
parent = "a1e8140ed1a07013f644b5b76025f4eaab7fb9d8"
commit_url = "https://github.com/commenthol/serialize-to-js/commit/1cd433960e5b9db4c0b537afb28366198a319429"
vendored = false
host = "github"
path = "lib/deserialize.js"
mode = "name"
relpath = "lib/deserialize.js"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2017-02-09"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "lib/deserialize.js"
function = "deserialize"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-mm62-wxc8-cf7m: deserialize sanitizes the input (strips function/eval/new Function IIFE payloads) before new Function evaluation unless unsafe is set"

[[pair]]
name = "jmespath-rb-search-e884128"
slice = "advisory-fixes"
language = "ruby"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "jmespath/jmespath.rb"
cve = "CVE-2022-32511 GHSA-5c5f-7vfq-3732"
cwe = "CWE-502"
commit = "e8841280053a9d9a0c90f36223f926c8b9e4ec49"
parent = "754bf30fa6b43308a6b8ffd78a502619e7fb38f7"
commit_url = "https://github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49"
vendored = false
host = "github"
path = "lib/jmespath.rb"
mode = "name"
relpath = "lib/jmespath.rb"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-03-07"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "lib/jmespath.rb"
function = "search"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-5c5f-7vfq-3732: JMESPath.search reads IO/StringIO input with JSON.parse instead of JSON.load (no json_class object creation)"

[[pair]]
name = "opensearch-ruby-verify-open-search-d74a98b"
slice = "advisory-fixes"
language = "ruby"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "opensearch-project/opensearch-ruby"
cve = "CVE-2022-31115 GHSA-977c-63xq-cgw3"
cwe = "CWE-502"
commit = "d74a98b45c037671e8819fa87f6a6423458ab08a"
parent = "f1a0d40f6f8f6de2b59b67f8582e4122d20dc8ba"
commit_url = "https://github.com/opensearch-project/opensearch-ruby/commit/d74a98b45c037671e8819fa87f6a6423458ab08a"
vendored = false
host = "github"
path = "opensearch/lib/opensearch.rb"
mode = "name"
relpath = "opensearch/lib/opensearch.rb"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2022-06-30"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "opensearch/lib/opensearch.rb"
function = "verify_open_search"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-977c-63xq-cgw3: verify_open_search parses a YAML server response with YAML.safe_load instead of YAML.load"

[[pair]]
name = "c1-cms-foundation-bindtotype-af856ab"
slice = "advisory-fixes"
language = "csharp"
framework = "asp.net"
origin = "github-advisory"
license = "MPL-1.1"
repo = "Orckestra/C1-CMS-Foundation"
cve = "CVE-2022-39256 GHSA-gfhp-jgp6-838j"
cwe = "CWE-502"
commit = "af856ab5a62d19acf6aea1b1f4c6c3c4985c9446"
parent = "07dae80b1646abce552b197fa8c7f5c45074e5a7"
commit_url = "https://github.com/Orckestra/C1-CMS-Foundation/commit/af856ab5a62d19acf6aea1b1f4c6c3c4985c9446"
vendored = false
host = "github"
path = "Composite/Core/Serialization/CompositeSerializationBinder.cs"
mode = "name"
relpath = "Composite/Core/Serialization/CompositeSerializationBinder.cs"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-09-27"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "Composite/Core/Serialization/CompositeSerializationBinder.cs"
function = "BindToType"
mechanism = "validation_strength"
family = "deserialization"
evidence = "GHSA-gfhp-jgp6-838j: the TypeNameHandling binder BindToType now verifies assembly and type via a stricter VerityTypeIsSupported allow-list check before returning the type"

[[pair]]
name = "litedb-deserialize-4382ff4"
slice = "advisory-fixes"
language = "csharp"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "litedb-org/LiteDB"
cve = "CVE-2022-23535 GHSA-3x49-g6rc-c284"
cwe = "CWE-502"
commit = "4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f"
parent = "6d9ac6237ff8cae104a3c57a8de4ec55b4506e87"
commit_url = "https://github.com/litedb-org/LiteDB/commit/4382ff4dd0dd8b8b16a4e37dfd29727c5f70f93f"
vendored = false
host = "github"
path = "LiteDB/Client/Mapper/BsonMapper.Deserialize.cs"
mode = "name"
relpath = "LiteDB/Client/Mapper/BsonMapper.Deserialize.cs"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2022-12-08"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "LiteDB/Client/Mapper/BsonMapper.Deserialize.cs"
function = "Deserialize"
mechanism = "validation_strength"
family = "deserialization"
evidence = "GHSA-3x49-g6rc-c284: BsonMapper.Deserialize rejects _type values that are not assignable to the target type (d72c677) and refuses System.Diagnostics.Process (4382ff4) before instantiation"

[[pair]]
name = "kredis-cast-value-d576b7a"
slice = "advisory-fixes"
language = "ruby"
framework = "rails"
origin = "github-advisory"
license = "MIT"
repo = "rails/kredis"
cve = "CVE-2023-27531 GHSA-h2wm-p2vg-6pw4"
cwe = "CWE-502"
commit = "d576b7ae5c8d3d74eeb4bd84cad0aa64ffc299fa"
parent = "1c2e3a637bcbb60e3fe5965972193c3abc4eef3f"
commit_url = "https://github.com/rails/kredis/commit/d576b7ae5c8d3d74eeb4bd84cad0aa64ffc299fa"
vendored = false
host = "github"
path = "lib/kredis/type/json.rb"
mode = "name"
relpath = "lib/kredis/type/json.rb"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-03-13"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "lib/kredis/type/json.rb"
function = "cast_value"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-h2wm-p2vg-6pw4: Kredis::Type::Json#cast_value replaces JSON.load (json_class object creation) with JSON.parse"

[[pair]]
name = "redisson-resolveclass-fe6a257"
slice = "advisory-fixes"
language = "java"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "redisson/redisson"
cve = "CVE-2023-42809 GHSA-4hvc-qwr2-f8rv"
cwe = "CWE-502"
commit = "fe6a2571801656ff1599ef87bdee20f519a5d1fe"
parent = "c70943b27ea46fe691cc387e35177364b93d54a0"
commit_url = "https://github.com/redisson/redisson/commit/fe6a2571801656ff1599ef87bdee20f519a5d1fe"
vendored = false
host = "github"
path = "redisson/src/main/java/org/redisson/codec/CustomObjectInputStream.java"
mode = "name"
relpath = "redisson/src/main/java/org/redisson/codec/CustomObjectInputStream.java"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2023-06-01"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "redisson/src/main/java/org/redisson/codec/CustomObjectInputStream.java"
function = "resolveClass"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-4hvc-qwr2-f8rv: CustomObjectInputStream.resolveClass now rejects classes outside the codec allowedClasses set before loading"

[[pair]]
name = "activemq-nms-openwire-bindtotype-8944c41"
slice = "advisory-fixes"
language = "csharp"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/activemq-nms-openwire"
cve = "CVE-2025-29953 GHSA-9g64-r942-fvmp"
cwe = "CWE-502"
commit = "8944c4126dfafee61ffcb4c99d21920cf4b5740b"
parent = "c458814843d9a137ce9a315365f26cbe0ef5a2e6"
commit_url = "https://github.com/apache/activemq-nms-openwire/commit/8944c4126dfafee61ffcb4c99d21920cf4b5740b"
vendored = false
host = "github"
path = "src/Commands/TrustedClassFilter.cs"
mode = "name"
relpath = "src/Commands/TrustedClassFilter.cs"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-02-03"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "src/Commands/TrustedClassFilter.cs"
function = "BindToType"
mechanism = "validation_strength"
family = "deserialization"
evidence = "GHSA-9g64-r942-fvmp: the BinaryFormatter binder BindToType now throws when the type cannot be resolved instead of passing a null type to the allow/deny policy (binder bypass)"

[[pair]]
name = "jooby-strtoobject-3e13562"
slice = "advisory-fixes"
language = "java"
framework = "jooby"
origin = "github-advisory"
license = "Apache-2.0"
repo = "jooby-project/jooby"
cve = "CVE-2025-31129 GHSA-7c5v-895v-w4q5"
cwe = "CWE-502"
commit = "3e13562cf36d7407813eae464e0f4b598de15692"
parent = "3be43441aced9ff41e9d1ae387cf90d604c01800"
commit_url = "https://github.com/jooby-project/jooby/commit/3e13562cf36d7407813eae464e0f4b598de15692"
vendored = false
host = "github"
path = "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
mode = "name"
relpath = "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-03-31"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "modules/jooby-pac4j/src/main/java/io/jooby/internal/pac4j/SessionStoreImpl.java"
function = "strToObject"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-7c5v-895v-w4q5: strToObject no longer ObjectInputStream.readObject()s base64 session values; it uses the configured pac4j Serializer and flags untrusted data"

[[pair]]
name = "powsybl-core-read-8ed16ce"
slice = "advisory-fixes"
language = "java"
framework = ""
origin = "github-advisory"
license = "MPL-2.0"
repo = "powsybl/powsybl-core"
cve = "CVE-2025-47771 GHSA-f5cx-h789-j959"
cwe = "CWE-502"
commit = "8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd"
parent = "d8398f689a5ccd505bd62eee2bd6670a29133110"
commit_url = "https://github.com/powsybl/powsybl-core/commit/8ed16ce41683c4aef5f6aa1dd5ae8642aa5ed2bd"
vendored = false
host = "github"
path = "math/src/main/java/com/powsybl/math/matrix/SparseMatrix.java"
mode = "name"
relpath = "math/src/main/java/com/powsybl/math/matrix/SparseMatrix.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-06-19"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "math/src/main/java/com/powsybl/math/matrix/SparseMatrix.java"
function = "read"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-f5cx-h789-j959: SparseMatrix.read sets an ObjectInputFilter allow-list on the ObjectInputStream before readObject()"

[[pair]]
name = "docling-core-load-from-yaml-3e8d628"
slice = "advisory-fixes"
language = "python"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "docling-project/docling-core"
cve = "CVE-2026-24009 GHSA-vqxf-v2gg-x3hc"
cwe = "CWE-502"
commit = "3e8d628eeeae50f0f8f239c8c7fea773d065d80c"
parent = "ec0978652ff0f19356d8661f7e59a0f98a5b248d"
commit_url = "https://github.com/docling-project/docling-core/commit/3e8d628eeeae50f0f8f239c8c7fea773d065d80c"
vendored = false
host = "github"
path = "docling_core/types/doc/document.py"
mode = "name"
relpath = "docling_core/types/doc/document.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-10-01"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "docling_core/types/doc/document.py"
function = "load_from_yaml"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-vqxf-v2gg-x3hc: load_from_yaml switches yaml.load Loader from FullLoader to SafeLoader"

[[pair]]
name = "karaf-decanter-loggingeventobjectinputstream-9d7058d"
slice = "advisory-fixes"
language = "java"
framework = "karaf"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/karaf-decanter"
cve = "CVE-2026-24656 GHSA-jmw5-58c7-587h"
cwe = "CWE-502"
commit = "9d7058d37160a16aaad34b488170adf277351e8b"
parent = "103566ed868f0ecb385fef18e3b9819885e0d019"
commit_url = "https://github.com/apache/karaf-decanter/commit/9d7058d37160a16aaad34b488170adf277351e8b"
vendored = false
host = "github"
path = "collector/log4j-socket/src/main/java/org/apache/karaf/decanter/collector/log/socket/SocketCollector.java"
mode = "name"
relpath = "collector/log4j-socket/src/main/java/org/apache/karaf/decanter/collector/log/socket/SocketCollector.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-11-09"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "collector/log4j-socket/src/main/java/org/apache/karaf/decanter/collector/log/socket/SocketCollector.java"
function = "LoggingEventObjectInputStream"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-jmw5-58c7-587h: the socket ObjectInputStream subclass replaces its prefix-based resolveClass check with a JEP 290 ObjectInputFilter allow-list for log events"

[[pair]]
name = "mailqueue-fromfile-0f7a137"
slice = "advisory-fixes"
language = "php"
framework = "typo3"
origin = "github-advisory"
license = "GPL-2.0"
repo = "CPS-IT/mailqueue"
cve = "CVE-2026-1323 GHSA-2pm6-9fhx-vvg3"
cwe = "CWE-502"
commit = "0f7a1376bbbd8c7658030d02e51c10a85b1dfdf7"
parent = "921274db99c900801060ddf78ff40b19108260d9"
commit_url = "https://github.com/CPS-IT/mailqueue/commit/0f7a1376bbbd8c7658030d02e51c10a85b1dfdf7"
vendored = false
host = "github"
path = "Classes/Mail/TransportFailure.php"
mode = "name"
relpath = "Classes/Mail/TransportFailure.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-01-22"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "Classes/Mail/TransportFailure.php"
function = "fromFile"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-2pm6-9fhx-vvg3: fromFile unserialize() used the misspelled allowedClasses option (no restriction); fix uses allowed_classes allow-list"

[[pair]]
name = "epyt-flow-my-load-from-json-3fff915"
slice = "advisory-fixes"
language = "python"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "WaterFutures/EPyT-Flow"
cve = "CVE-2026-25632 GHSA-74vm-8frp-7w68"
cwe = "CWE-502"
commit = "3fff9151494c7dbc72073830b734f0a7e550e385"
parent = "0491aa2e07b8886f0345cc8e8ddbcf3d13c486be"
commit_url = "https://github.com/WaterFutures/EPyT-Flow/commit/3fff9151494c7dbc72073830b734f0a7e550e385"
vendored = false
host = "github"
path = "epyt_flow/serialization.py"
mode = "name"
relpath = "epyt_flow/serialization.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-04"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "epyt_flow/serialization.py"
function = "my_load_from_json"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-74vm-8frp-7w68: my_load_from_json object hook no longer imports an arbitrary __type__ module/class; only registered JsonSerializable classes are instantiated"

[[pair]]
name = "laravel-magiclink-getactionattribute-19fa820"
slice = "advisory-fixes"
language = "php"
framework = "laravel"
origin = "github-advisory"
license = "MIT"
repo = "cesargb/laravel-magiclink"
cve = "GHSA-r33w-fg8j-9c94"
cwe = "CWE-502"
commit = "19fa820a49ea9b3984e9a91b4bf4bf0cf8375183"
parent = "0c3b486d4baea56a78cf09fe94d9c9991cf499b3"
commit_url = "https://github.com/cesargb/laravel-magiclink/commit/19fa820a49ea9b3984e9a91b4bf4bf0cf8375183"
vendored = false
host = "github"
path = "src/MagicLink.php"
mode = "name"
relpath = "src/MagicLink.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-12"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "src/MagicLink.php"
function = "getActionAttribute"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-r33w-fg8j-9c94: getActionAttribute no longer falls back to legacyGetAction unserialize() of the stored action; failures now throw"

[[pair]]
name = "json-serializer-unserializeobject-bf26227"
slice = "advisory-fixes"
language = "php"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "zumba/json-serializer"
cve = "CVE-2026-27206 GHSA-v7m3-fpcr-h7m2"
cwe = "CWE-502"
commit = "bf26227879adefce75eb9651040d8982be97b881"
parent = "1b1b2302d46692f317021ee4b9cc06b1311b7333"
commit_url = "https://github.com/zumba/json-serializer/commit/bf26227879adefce75eb9651040d8982be97b881"
vendored = false
host = "github"
path = "src/JsonSerializer/JsonSerializer.php"
mode = "name"
relpath = "src/JsonSerializer/JsonSerializer.php"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-19"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "src/JsonSerializer/JsonSerializer.php"
function = "unserializeObject"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-v7m3-fpcr-h7m2: unserializeObject now rejects @type classes outside the configured allowedClasses list before instantiation"

[[pair]]
name = "aiohttp-load-dcf40f3"
slice = "advisory-fixes"
language = "python"
framework = "aiohttp"
origin = "github-advisory"
license = "Apache-2.0"
repo = "aio-libs/aiohttp"
cve = "CVE-2026-34993 GHSA-jg22-mg44-37j8"
cwe = "CWE-502"
commit = "dcf40f30637e8752c76781cf6703b5a236749a00"
parent = "4f12a6641e3db60aa35c60c9db61b45c89176c00"
commit_url = "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"
vendored = false
host = "github"
path = "aiohttp/cookiejar.py"
mode = "name"
relpath = "aiohttp/cookiejar.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-22"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "aiohttp/cookiejar.py"
function = "load"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-jg22-mg44-37j8: CookieJar.load replaces pickle.load with JSON first and a restricted Unpickler allow-listing cookie types"

[[pair]]
name = "datapizza-ai-get-e83beeb"
slice = "advisory-fixes"
language = "python"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "datapizza-labs/datapizza-ai"
cve = "CVE-2026-2970 GHSA-hg58-x52p-859c"
cwe = "CWE-502"
commit = "e83beeb122f16748b553b4d4be9e814a7595d97d"
parent = "67f51a3701100ac96058edd0c7c26cbdfa00ce2a"
commit_url = "https://github.com/datapizza-labs/datapizza-ai/commit/e83beeb122f16748b553b4d4be9e814a7595d97d"
vendored = false
host = "github"
path = "datapizza-ai-cache/redis/datapizza/cache/redis/cache.py"
mode = "name"
relpath = "datapizza-ai-cache/redis/datapizza/cache/redis/cache.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-13"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "datapizza-ai-cache/redis/datapizza/cache/redis/cache.py"
function = "get"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-hg58-x52p-859c: RedisCache.get pickle.loads of the cached value replaced by a versioned JSON codec"

[[pair]]
name = "react-router-hydrate-5981192"
slice = "advisory-fixes"
language = "typescript"
framework = "react-router"
origin = "github-advisory"
license = "MIT"
repo = "remix-run/react-router"
cve = "CVE-2026-42211 GHSA-49rj-9fvp-4h2h"
cwe = "CWE-502"
commit = "59811921d3c7d599077b8cadccdcd65a233165e0"
parent = "f9fd874939759d51231ff5c8270dce38af3f5169"
commit_url = "https://github.com/remix-run/react-router/commit/59811921d3c7d599077b8cadccdcd65a233165e0"
vendored = false
host = "github"
path = "packages/react-router/vendor/turbo-stream-v2/unflatten.ts"
mode = "name"
relpath = "packages/react-router/vendor/turbo-stream-v2/unflatten.ts"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-20"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "packages/react-router/vendor/turbo-stream-v2/unflatten.ts"
function = "hydrate"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-49rj-9fvp-4h2h: turbo-stream hydrate no longer invokes globalObj[errorType] as a constructor for TYPE_ERROR entries; it always builds a plain Error"

[[pair]]
name = "vcrpy-deserialize-045acb1"
slice = "advisory-fixes"
language = "python"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "kevin1024/vcrpy"
cve = "GHSA-rpj2-4hq8-938g"
cwe = "CWE-502"
commit = "045acb1b5f8940f82adbb3faafd13e43e46289d6"
parent = "de43f46247e763c2e36dc8dd9c36173be3069f81"
commit_url = "https://github.com/kevin1024/vcrpy/commit/045acb1b5f8940f82adbb3faafd13e43e46289d6"
vendored = false
host = "github"
path = "vcr/serializers/yamlserializer.py"
mode = "name"
relpath = "vcr/serializers/yamlserializer.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-16"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "vcr/serializers/yamlserializer.py"
function = "deserialize"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-rpj2-4hq8-938g: deserialize yaml.load with full (C)Loader replaced by a SafeLoader subclass that only constructs benign cassette tags"

[[pair]]
name = "crawler-fetchurlcontents-be7dbe7"
slice = "advisory-fixes"
language = "php"
framework = "typo3"
origin = "github-advisory"
license = "GPL-3.0"
repo = "tomasnorre/crawler"
cve = "CVE-2026-8727 GHSA-jr8m-x4p7-p3v5"
cwe = "CWE-502"
commit = "be7dbe77c567b4c0572981c26dd647c24e23c2fa"
parent = "baa6ffe8736a0d3a646c44473790573e2516d923"
commit_url = "https://github.com/tomasnorre/crawler/commit/be7dbe77c567b4c0572981c26dd647c24e23c2fa"
vendored = false
host = "github"
path = "Classes/CrawlStrategy/GuzzleExecutionStrategy.php"
mode = "name"
relpath = "Classes/CrawlStrategy/GuzzleExecutionStrategy.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-07-28"

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "Classes/CrawlStrategy/GuzzleExecutionStrategy.php"
function = "fetchUrlContents"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-jr8m-x4p7-p3v5: fetchUrlContents unserialize() of the crawled response X-T3Crawler-Meta header replaced by json_decode"

[[pair]]
name = "aedes-finish-ffbc170"
slice = "advisory-fixes"
language = "javascript"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "moscajs/aedes"
cve = "CVE-2018-3778 GHSA-4cmx-hrq9-c23p"
cwe = "CWE-285"
commit = "ffbc1702bb24b596afbb96407cc6db234a4044a8"
parent = "1189ffe7b1cd41247f1f857aad4a81275a00700e"
commit_url = "https://github.com/moscajs/aedes/commit/ffbc1702bb24b596afbb96407cc6db234a4044a8"
vendored = false
host = "github"
path = "lib/client.js"
mode = "name"
relpath = "lib/client.js"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2018-08-07"

[[pair.expected]]
cwe = "CWE-285"
class = "missing-authorization"
path = "lib/client.js"
function = "finish"
mechanism = "unguarded_privileged_action"
family = "access_control"
evidence = "GHSA-4cmx-hrq9-c23p: the close-time finish() now runs broker.authorizePublish on the Last Will before publishing it"

[[pair]]
name = "publify-update-c0aba87"
slice = "advisory-fixes"
language = "ruby"
framework = "rails"
origin = "github-advisory"
license = "MIT"
repo = "publify/publify"
cve = "CVE-2022-1810 GHSA-c273-c6vg-4pv5"
cwe = "CWE-639"
commit = "c0aba87844d1e47da50c0d99a3465164a4d244ce"
parent = "d254b06983335eae40d31653ed2f1472edd85099"
commit_url = "https://github.com/publify/publify/commit/c0aba87844d1e47da50c0d99a3465164a4d244ce"
vendored = false
host = "github"
path = "publify_core/app/controllers/admin/content_controller.rb"
mode = "name"
relpath = "publify_core/app/controllers/admin/content_controller.rb"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-05-22"

[[pair.expected]]
cwe = "CWE-639"
class = "idor"
path = "publify_core/app/controllers/admin/content_controller.rb"
function = "update"
mechanism = "identity_from_request_body"
family = "access_control"
evidence = "GHSA-c273-c6vg-4pv5: update stops taking the article id from params[:article][:id] (checked id differed from the edited id) and uses the access-checked params[:id]"

[[pair]]
name = "xblock-lti-consumer-publish-grade-on-score-update-252f94b"
slice = "advisory-fixes"
language = "python"
framework = "django"
origin = "github-advisory"
license = "AGPL-3.0"
repo = "openedx/xblock-lti-consumer"
cve = "CVE-2023-23611 GHSA-7j9p-67mm-5g87"
cwe = "CWE-862"
commit = "252f94bd182cd0962af9251015930cb55ec515d7"
parent = "8da48aa3fc3614e61d2e2ded26234cc475a4805b"
commit_url = "https://github.com/openedx/xblock-lti-consumer/commit/252f94bd182cd0962af9251015930cb55ec515d7"
vendored = false
host = "github"
path = "lti_consumer/signals/signals.py"
mode = "name"
relpath = "lti_consumer/signals/signals.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2023-01-24"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "lti_consumer/signals/signals.py"
function = "publish_grade_on_score_update"
mechanism = "unconstrained_protected_write"
family = "access_control"
evidence = "GHSA-7j9p-67mm-5g87: publish_grade_on_score_update now refuses scores whose line item resource_link_id differs from the LTI configuration's block location"

[[pair]]
name = "oqtaneframework-isauthorized-e83399a"
slice = "advisory-fixes"
language = "csharp"
framework = "aspnetcore"
origin = "github-advisory"
license = "MIT"
repo = "oqtane/oqtane.framework"
cve = "CVE-2024-55186 GHSA-2hr5-cvwp-jr5w"
cwe = "CWE-639"
commit = "e83399acb19da9c29726a966e3898116e00d6f6a"
parent = "f71a3a1ce3b899962a60d3c58f4b8a644f0d18e7"
commit_url = "https://github.com/oqtane/oqtane.framework/commit/e83399acb19da9c29726a966e3898116e00d6f6a"
vendored = false
host = "github"
path = "Oqtane.Server/Controllers/NotificationController.cs"
mode = "name"
relpath = "Oqtane.Server/Controllers/NotificationController.cs"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-11-26"

[[pair.expected]]
cwe = "CWE-639"
class = "idor"
path = "Oqtane.Server/Controllers/NotificationController.cs"
function = "IsAuthorized"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-2hr5-cvwp-jr5w: NotificationController.IsAuthorized fails closed (authorized=false) so notifications with a null user id are no longer readable by other users"

[[pair]]
name = "apollo-get-362735d"
slice = "advisory-fixes"
language = "java"
framework = "spring"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apolloconfig/apollo"
cve = "CVE-2025-32781 GHSA-jxpj-9j24-w337"
cwe = "CWE-639"
commit = "362735ded4f13b62f6ab9df135d7096066e8e291"
parent = "33318b0f951870afb534f75d39e2a9328a1c2024"
commit_url = "https://github.com/apolloconfig/apollo/commit/362735ded4f13b62f6ab9df135d7096066e8e291"
vendored = false
host = "github"
path = "apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/ReleaseController.java"
mode = "name"
relpath = "apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/ReleaseController.java"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2025-04-11"

[[pair.expected]]
cwe = "CWE-639"
class = "idor"
path = "apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/ReleaseController.java"
function = "get"
mechanism = "unconstrained_protected_read"
family = "access_control"
evidence = "GHSA-jxpj-9j24-w337: ReleaseController.get now throws AccessDeniedException when shouldHideConfigToCurrentUser for the release's app/cluster/namespace"

[[pair]]
name = "payload-puck-createdeletehandler-9148201"
slice = "advisory-fixes"
language = "typescript"
framework = "payload"
origin = "github-advisory"
license = "MIT"
repo = "delmaredigital/payload-puck"
cve = "CVE-2026-39397 GHSA-65w6-pf7x-5g85"
cwe = "CWE-862"
commit = "9148201c6bbfa140d44546438027a2f8a70f79a4"
parent = "7abe44499cf11c4d007e686a4c8cc7ed35cbf0e4"
commit_url = "https://github.com/delmaredigital/payload-puck/commit/9148201c6bbfa140d44546438027a2f8a70f79a4"
vendored = false
host = "github"
path = "src/endpoints/index.ts"
mode = "name"
relpath = "src/endpoints/index.ts"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-06"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "src/endpoints/index.ts"
function = "createDeleteHandler"
mechanism = "unconstrained_protected_write"
family = "access_control"
evidence = "GHSA-65w6-pf7x-5g85: the delete handler now calls payload.delete with req and overrideAccess: false so collection access rules apply (was default overrideAccess: true)"

[[pair]]
name = "sqladmin-ajax-lookup-b0d3a19"
slice = "advisory-fixes"
language = "python"
framework = "starlette"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "smithyhq/sqladmin"
cve = "CVE-2026-46645 GHSA-54mc-gghv-4cfj"
cwe = "CWE-862"
commit = "b0d3a19fb9b074a9ed243de46930108375dfbb98"
parent = "984b7458c10fccd1379f8bc876e985bcc4461634"
commit_url = "https://github.com/smithyhq/sqladmin/commit/b0d3a19fb9b074a9ed243de46930108375dfbb98"
vendored = false
host = "github"
path = "sqladmin/application.py"
mode = "name"
relpath = "sqladmin/application.py"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-29"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authentication"
path = "sqladmin/application.py"
function = "ajax_lookup"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-54mc-gghv-4cfj: ajax_lookup now authenticates the request via authentication_backend and redirects to login when it fails"

[[pair]]
name = "nebula-mesh-handlegetauditlog-8baaace"
slice = "advisory-fixes"
language = "go"
framework = ""
origin = "github-advisory"
license = "MIT"
repo = "forgekeep/nebula-mesh"
cve = "CVE-2026-47726 GHSA-qm33-p5p9-f8vg"
cwe = "CWE-285"
commit = "8baaace54c2a23e7c351b3efab5a31ab07b125dc"
parent = "da2f3cde2ce2efc80609ea26b745706dadb4eead"
commit_url = "https://github.com/forgekeep/nebula-mesh/commit/8baaace54c2a23e7c351b3efab5a31ab07b125dc"
vendored = false
host = "github"
path = "internal/api/audit.go"
mode = "name"
relpath = "internal/api/audit.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-20"

[[pair.expected]]
cwe = "CWE-285"
class = "missing-authorization"
path = "internal/api/audit.go"
function = "handleGetAuditLog"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-qm33-p5p9-f8vg: handleGetAuditLog gains an actorIsAdmin gate (403) before listing audit entries"

[[pair]]
name = "gittensory-getcontributorprofile-811ef5f"
slice = "advisory-fixes"
language = "typescript"
framework = "hono"
origin = "github-advisory"
license = "AGPL-3.0"
repo = "jsonbored/gittensory"
cve = "GHSA-382c-vx95-w3p5"
cwe = "CWE-284"
commit = "811ef5fb9d748170011f8854d88c64627ad666a0"
parent = "0fb238021991ac9f1cb033f311078b9e5643f239"
commit_url = "https://github.com/jsonbored/gittensory/commit/811ef5fb9d748170011f8854d88c64627ad666a0"
vendored = false
host = "github"
path = "src/mcp/server.ts"
mode = "name"
relpath = "src/mcp/server.ts"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-02"

[[pair.expected]]
cwe = "CWE-284"
class = "missing-authorization"
path = "src/mcp/server.ts"
function = "getContributorProfile"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-382c-vx95-w3p5: getContributorProfile now calls requireContributorAccess(login) before assembling the contributor profile"

[[pair]]
name = "filebrowser-resourcedeletehandler-0231b7e"
slice = "advisory-fixes"
language = "go"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "filebrowser/filebrowser"
cve = "CVE-2026-54097 GHSA-5ww9-jg6q-38r7"
cwe = "CWE-639"
commit = "0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d"
parent = "e07c59df0b850f5924d5b1683e8609661ddcf534"
commit_url = "https://github.com/filebrowser/filebrowser/commit/0231b7ebdfbe77a6c54027d30c4856c3fd81ee4d"
vendored = false
host = "github"
path = "http/resource.go"
mode = "name"
relpath = "http/resource.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-03"

[[pair.expected]]
cwe = "CWE-639"
class = "idor"
path = "http/resource.go"
function = "resourceDeleteHandler"
mechanism = "unconstrained_protected_write"
family = "access_control"
evidence = "GHSA-5ww9-jg6q-38r7: resourceDeleteHandler now deletes associated share links only for the requesting user (DeleteWithPathPrefix gets d.user.ID)"

[[pair]]
name = "winter-getfilerecord-9cb0ae5"
slice = "advisory-fixes"
language = "php"
framework = "winter"
origin = "github-advisory"
license = "MIT"
repo = "wintercms/winter"
cve = "CVE-2026-54256 GHSA-3277-h8g9-qj5f"
cwe = "CWE-639"
commit = "9cb0ae5f9d837db141ab111c6a7de8eed9603d25"
parent = "b86679a41da45124399a33fdff57b502f21c0eb5"
commit_url = "https://github.com/wintercms/winter/commit/9cb0ae5f9d837db141ab111c6a7de8eed9603d25"
vendored = false
host = "github"
path = "modules/backend/formwidgets/FileUpload.php"
mode = "name"
relpath = "modules/backend/formwidgets/FileUpload.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-03"

[[pair.expected]]
cwe = "CWE-639"
class = "idor"
path = "modules/backend/formwidgets/FileUpload.php"
function = "getFileRecord"
mechanism = "unconstrained_protected_read"
family = "access_control"
evidence = "GHSA-3277-h8g9-qj5f: getFileRecord resolves the posted file_id through the widget's own relation (withDeferred) instead of the global File model"

[[pair]]
name = "migration-planner-getsourcedownloadurl-ec47a33"
slice = "advisory-fixes"
language = "go"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "kubev2v/migration-planner"
cve = "CVE-2026-53470 GHSA-v5m8-5455-qw2x"
cwe = "CWE-639"
commit = "ec47a336a620f4a995f29c1c53e4e4bd70a26e00"
parent = "88a042a02abac99dc05201eba013b2d4052c9ea5"
commit_url = "https://github.com/kubev2v/migration-planner/commit/ec47a336a620f4a995f29c1c53e4e4bd70a26e00"
vendored = false
host = "github"
path = "internal/handlers/v1alpha1/source.go"
mode = "name"
relpath = "internal/handlers/v1alpha1/source.go"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-07"

[[pair.expected]]
cwe = "CWE-639"
class = "idor"
path = "internal/handlers/v1alpha1/source.go"
function = "GetSourceDownloadURL"
mechanism = "unconstrained_protected_read"
family = "access_control"
evidence = "GHSA-v5m8-5455-qw2x: GetSourceDownloadURL loads the source and returns 403 unless its username/org match the caller before issuing the download URL"

[[pair]]
name = "mcp-server-plugin-getreplayscripts-ffe5ae7"
slice = "advisory-fixes"
language = "java"
framework = "jenkins"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/mcp-server-plugin"
cve = "CVE-2026-57300 GHSA-mpff-xhg4-vr45"
cwe = "CWE-862"
commit = "ffe5ae770f3bd7e88c99aea3018263af0b2f9cc4"
parent = "629fdb2557fe7c88b0eac3259d0ff27ec653f390"
commit_url = "https://github.com/jenkinsci/mcp-server-plugin/commit/ffe5ae770f3bd7e88c99aea3018263af0b2f9cc4"
vendored = false
host = "github"
path = "src/main/java/io/jenkins/plugins/mcp/server/extensions/DefaultMcpServer.java"
mode = "name"
relpath = "src/main/java/io/jenkins/plugins/mcp/server/extensions/DefaultMcpServer.java"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-12"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "src/main/java/io/jenkins/plugins/mcp/server/extensions/DefaultMcpServer.java"
function = "getReplayScripts"
mechanism = "unconstrained_protected_read"
family = "access_control"
evidence = "GHSA-mpff-xhg4-vr45: getReplayScripts now returns the pipeline source only when the job grants Item.EXTENDED_READ"

[[pair]]
name = "openwisp-ipam-export-view-04a2ef9"
slice = "advisory-fixes"
language = "python"
framework = "django"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "openwisp/openwisp-ipam"
cve = "GHSA-x287-5c68-36wp"
cwe = "CWE-862"
commit = "04a2ef949498c6591f9ac35713d7451fb9f75362"
parent = "8b082134d60deb7d2410fe8fd44da71ef4cfd2f1"
commit_url = "https://github.com/openwisp/openwisp-ipam/commit/04a2ef949498c6591f9ac35713d7451fb9f75362"
vendored = false
host = "github"
path = "openwisp_ipam/admin.py"
mode = "name"
relpath = "openwisp_ipam/admin.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-15"

[[pair.expected]]
cwe = "CWE-862"
class = "idor"
path = "openwisp_ipam/admin.py"
function = "export_view"
mechanism = "unconstrained_protected_read"
family = "access_control"
evidence = "GHSA-x287-5c68-36wp: export_view now resolves the subnet through the org-scoped admin queryset (get_object_or_404) before exporting"

[[pair]]
name = "alchemy-cms-nested-8417a2e"
slice = "advisory-fixes"
language = "ruby"
framework = "rails"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "AlchemyCMS/alchemy_cms"
cve = "GHSA-mqq5-j7w8-2hgh"
cwe = "CWE-862"
commit = "8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
parent = "4599a60bb1561264c9afff16b376e14439b21dd6"
commit_url = "https://github.com/AlchemyCMS/alchemy_cms/commit/8417a2e9dcb00653c8b238f8a040b09532dd4c0f"
vendored = false
host = "github"
path = "app/controllers/alchemy/api/pages_controller.rb"
mode = "name"
relpath = "app/controllers/alchemy/api/pages_controller.rb"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-18"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "app/controllers/alchemy/api/pages_controller.rb"
function = "nested"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-mqq5-j7w8-2hgh: Api::PagesController#nested gains authorize! :show and ability-scoped tree preload"

[[pair]]
name = "django-cms-render-object-structure-9c82abf"
slice = "advisory-fixes"
language = "python"
framework = "django"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "django-cms/django-cms"
cve = "CVE-2026-61663 GHSA-8qj2-c6q4-f399"
cwe = "CWE-862"
commit = "9c82abfeb25471583e23906ea1ebef9202527b04"
parent = "2b5de9f19b698005f55f57a90019412f99ce1a07"
commit_url = "https://github.com/django-cms/django-cms/commit/9c82abfeb25471583e23906ea1ebef9202527b04"
vendored = false
host = "github"
path = "cms/views.py"
mode = "name"
relpath = "cms/views.py"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-29"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "cms/views.py"
function = "render_object_structure"
mechanism = "unconstrained_protected_read"
family = "access_control"
evidence = "GHSA-8qj2-c6q4-f399: render_object_structure now raises Http404 unless user_can_view_placeholder_source for non-PageContent objects"

[[pair]]
name = "perses-proxyunsavedglobaldatasource-2368c9e"
slice = "advisory-fixes"
language = "go"
framework = "echo"
origin = "github-advisory"
license = "Apache-2.0"
repo = "perses/perses"
cve = "CVE-2026-63199 GHSA-4227-9989-jrhx"
cwe = "CWE-862"
commit = "2368c9ef4eb0a70fbca5df69aa20e595821ab625"
parent = "51b7c0bba66fd2a725de9dc885808c68fbd79091"
commit_url = "https://github.com/perses/perses/commit/2368c9ef4eb0a70fbca5df69aa20e595821ab625"
vendored = false
host = "github"
path = "internal/api/impl/proxy/globaldatasource.go"
mode = "name"
relpath = "internal/api/impl/proxy/globaldatasource.go"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-07-15"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "internal/api/impl/proxy/globaldatasource.go"
function = "proxyUnsavedGlobalDatasource"
mechanism = "unconstrained_protected_read"
family = "access_control"
evidence = "GHSA-4227-9989-jrhx: proxyUnsavedGlobalDatasource now checks GlobalSecret read permission before resolving global secrets for the proxied datasource"

[[pair]]
name = "moquette-publishwill-e23df01"
slice = "advisory-fixes"
language = "java"
framework = ""
origin = "github-advisory"
license = "Apache-2.0"
repo = "moquette-io/moquette"
cve = "CVE-2026-85058 GHSA-9jjc-fw8x-fmwx"
cwe = "CWE-862"
commit = "e23df019f6a11e22c7d2047d4f86d07095466c97"
parent = "3f2e023913f0febc72181ffd39aa46fbaa15d47b"
commit_url = "https://github.com/moquette-io/moquette/commit/e23df019f6a11e22c7d2047d4f86d07095466c97"
vendored = false
host = "github"
path = "broker/src/main/java/io/moquette/broker/PostOffice.java"
mode = "name"
relpath = "broker/src/main/java/io/moquette/broker/PostOffice.java"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-07-17"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "broker/src/main/java/io/moquette/broker/PostOffice.java"
function = "publishWill"
mechanism = "unguarded_privileged_action"
family = "access_control"
evidence = "GHSA-9jjc-fw8x-fmwx: publishWill now checks authorizator.canWrite on the Last Will topic before publishing to subscribers"

[[pair]]
name = "easyadminbundle-getsymfonycontrollerfqcn-03be45c"
slice = "advisory-fixes"
language = "php"
framework = "symfony"
origin = "github-advisory"
license = "MIT"
repo = "EasyCorp/EasyAdminBundle"
cve = "CVE-2026-81892 GHSA-g2fm-8hr4-j82h"
cwe = "CWE-862"
commit = "03be45c6b7213c4c984a1d0542b7ec60359329f8"
parent = "7c34cdd39ddac59bde9deb8811452a6164717d07"
commit_url = "https://github.com/EasyCorp/EasyAdminBundle/commit/03be45c6b7213c4c984a1d0542b7ec60359329f8"
vendored = false
host = "github"
path = "src/EventListener/AdminRouterSubscriber.php"
mode = "name"
relpath = "src/EventListener/AdminRouterSubscriber.php"
provenance = "human"
split = "train"
review_tier = "advisory"
fix_date = "2026-08-11"

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "src/EventListener/AdminRouterSubscriber.php"
function = "getSymfonyControllerFqcn"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-g2fm-8hr4-j82h: getSymfonyControllerFqcn now re-validates access_control for the custom-action target route before resolving its controller"

[[pair]]
name = "jellyfin-assertcancontrol-420d44f"
slice = "advisory-fixes"
language = "csharp"
framework = "aspnetcore"
origin = "github-advisory"
license = "GPL-2.0"
repo = "jellyfin/jellyfin"
cve = "GHSA-4vx8-xhc9-qg6x"
cwe = "CWE-639"
commit = "420d44f638c44b942b43303c3165c2e8795b9020"
parent = "9fe5a53e47526ae84b246ec3ae8f861056b52eca"
commit_url = "https://github.com/jellyfin/jellyfin/commit/420d44f638c44b942b43303c3165c2e8795b9020"
vendored = false
host = "github"
path = "Emby.Server.Implementations/Session/SessionManager.cs"
mode = "name"
relpath = "Emby.Server.Implementations/Session/SessionManager.cs"
provenance = "human"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-08-30"

[[pair.expected]]
cwe = "CWE-639"
class = "idor"
path = "Emby.Server.Implementations/Session/SessionManager.cs"
function = "AssertCanControl"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-4vx8-xhc9-qg6x: AssertCanControl now requires session ownership or EnableRemoteControlOfOtherUsers instead of only null-checking its arguments"