diff --git a/benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json b/benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json new file mode 100644 index 0000000..bc22133 --- /dev/null +++ b/benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json @@ -0,0 +1,326 @@ +{ + "created": "2026-10-04", + "note": "COUNTS ONLY. Batch 3 of real (vulnerable function, fixed function) pairs whose function survives the fix, mined at zero model cost from reviewed GitHub advisories (pip, npm, maven, composer) and added as pointer-pair corpus benchmarks/pairs/advisory-fixes-3 (source `advisory-fixes-3` in learn/sources.toml); labelled, given static feature records, built into the memory store and embedded. No chat-model call, no Docker, no Joern. Candidate, path, function and repository names stay in the catalog; the pairs the reserved-population guard flagged are withheld (found by bisection with the test output discarded; names never printed).", + "method": { + "enumeration": "gh api /advisories?type=reviewed&ecosystem=&cwes=&published=>2023-01-01 per ecosystem (pip, npm, maven, composer) x six compiled families; Go, Ruby and C# not enumerated; newest first", + "advisories_enumerated": 8531, + "advisories_published_after_2026_06_01": 1855, + "automated_screen": "as batch 2 (single family by CWE; linked fix commit, at most 3, one repository; repository not named anywhere under benchmarks/ incl. batches 1-2; excluded v3 file names never opened; no WordPress plugin; one pair per repository; SPDX licence permissive; one-parent commit; the function holding most changed code lines inside its own matcher span, declared once on both sides, body changed, >= 25% of the file's changed code lines) plus three widenings: (a) an advisory linking only a merged pull request uses its single commit or its squash/rebase merge commit; (b) commits of up to 6 non-test source files / 240 changed lines (batch 2: 4 / 120); (c) a second pass over advisories whose CWEs span two families, the family then chosen from the function's diff on review", + "file_reads": "commit metadata and the two versions of each changed source file through the contents API into scratch (no clone, no scanner, engine, plane Run or model on these repositories); scratch deleted after", + "manual_review": "every automated candidate's in-function diff read (agent, no model call); kept only when the named function itself holds the fix; a weak inline check replaced by a stronger helper call counts as the fix, a function that only forwards a flag or calls a fix made elsewhere does not", + "reserved_population_guard": "pytest -q tests/ -k 'reserved or v3' with output discarded, bisected over catalog subsets (18 runs; baseline with an empty batch green); final catalog green", + "rename_check": "canonical full_name of every kept repository from the API: no two kept pairs share a repository, none renamed into a name the benchmarks use", + "mechanism": "family default as batch 2 (injection/output_encoding/deserialization source_reaches_sink, path path_join_user_input, access_control missing_auth_guard, untrusted_destination validation_strength for CWE-601 else source_reaches_sink); provenance = agent" + }, + "screened": { + "advisories_examined": 8805, + "outcomes": { + "no fix commit linked": 3480, + "repository already in benchmarks/ (populations v1/v2 or a pair corpus)": 1993, + "licence not permissive or unrecorded": 1249, + "repository already kept (one pair per repository)": 657, + "kept": 398, + "CWEs span several families": 274, + "no function declared on both sides with a changed body": 191, + "large commit (refactor or release, not the fix)": 173, + "fix spread over several commits or repositories": 167, + "merge or root commit": 115, + "no source file changed": 42, + "language outside the feature vocabulary (go/ruby/c#/...)": 32, + "manual review: the chosen function does not hold the fix (comment-only, misattributed, partial or family mismatch)": 19, + "repository unavailable": 9, + "WordPress plugin (population v3 safety)": 4, + "fix commit unavailable": 2 + }, + "outcomes_note": "single-family pass (screen 2, every advisory examined, no quota met) plus the two-family pass; `kept` = automated candidates; `manual review: the chosen function does not hold the fix (comment-only, misattributed, partial or family mismatch)` = the screen re-meeting a function the 2026-10-03 review had dropped", + "candidates_manually_reviewed": 412, + "kept_after_review": 255, + "review_drops": { + "total": 157, + "change in the function unrelated to the advisory (refactor, rename, formatting, another advisory)": 33, + "function misattributed (matcher span overrun or an undetected enclosing declaration)": 33, + "partial: the function only calls or configures the real fix": 29, + "function diff not small (rewrite or refactor around the fix)": 28, + "unsure": 17, + "family mismatch": 11, + "same fix as a kept pair in a fork or sibling repository (would leak across repository folds)": 3, + "WordPress plugin (population v3 safety; missed by the automated screen)": 2, + "reserved-population guard (flagged by the 2026-10-03 guard run; name not printed)": 1 + }, + "one_pair_per_repository_drops": 3, + "reserved_population_drops": 2, + "kept": 251 + }, + "kept": { + "total": 251, + "by_family": { + "access_control": 20, + "deserialization": 9, + "injection": 56, + "output_encoding": 69, + "path": 71, + "untrusted_destination": 26 + }, + "post_cutoff_by_family": { + "injection": 5, + "output_encoding": 5, + "path": 2 + }, + "post_cutoff_total": 12, + "by_language": { + "java": 37, + "javascript": 37, + "php": 46, + "python": 83, + "typescript": 48 + }, + "post_cutoff_by_language": { + "python": 6, + "typescript": 6 + }, + "by_family_language": { + "access_control:java": 5, + "access_control:javascript": 3, + "access_control:php": 7, + "access_control:python": 2, + "access_control:typescript": 3, + "deserialization:java": 2, + "deserialization:php": 1, + "deserialization:python": 6, + "injection:java": 5, + "injection:javascript": 7, + "injection:php": 9, + "injection:python": 24, + "injection:typescript": 11, + "output_encoding:java": 7, + "output_encoding:javascript": 20, + "output_encoding:php": 12, + "output_encoding:python": 14, + "output_encoding:typescript": 16, + "path:java": 10, + "path:javascript": 4, + "path:php": 10, + "path:python": 34, + "path:typescript": 13, + "untrusted_destination:java": 8, + "untrusted_destination:javascript": 3, + "untrusted_destination:php": 7, + "untrusted_destination:python": 3, + "untrusted_destination:typescript": 5 + }, + "by_ecosystem": { + "composer": 46, + "maven": 37, + "npm": 81, + "pip": 87 + }, + "licences": { + "Apache-2.0": 80, + "BSD-2-Clause": 3, + "BSD-3-Clause": 18, + "ISC": 1, + "MIT": 147, + "MPL-2.0": 1, + "Unlicense": 1 + }, + "split": { + "holdout": 124, + "train": 127 + }, + "published_by_year": { + "2023": 50, + "2024": 52, + "2025": 66, + "2026": 83 + }, + "published_range": [ + "2023-01-04", + "2026-10-01" + ], + "via_pull_request": 13, + "commit_over_120_source_lines": 10, + "two_family_advisory_family_chosen_on_review": 3, + "verification": { + "verified": 251, + "excerpt_bytes_read": 1297516 + }, + "targets": { + "asked": "injection and untrusted_destination >= 60 each; path, access_control, output_encoding, deserialization >= 30 where advisories allow; >= 250 total", + "met": { + "access_control": false, + "deserialization": false, + "injection": false, + "output_encoding": true, + "path": true, + "untrusted_destination": false + }, + "limit": "the reviewed-advisory pool, not the review: every advisory since 2023-01-01 in the four ecosystems was examined; the post-cutoff pool was largely spent by batch 2 (its repositories are now excluded), and untrusted_destination/access_control/deserialization advisories mostly lack a linked single fix commit or sit in repositories the benchmarks already use" + } + }, + "labels": { + "command": "ousast learn labels --root . --out --snapshot ", + "rows": [ + 6981, + 7985 + ], + "pairs_rows": [ + 1936, + 2940 + ], + "new_pair_rows": 1004 + }, + "features": { + "command": "benchmarks/learn/build_features.py --labels --units --catalog benchmarks/pairs/advisory-fixes-3/catalog.toml --kinds pairs", + "records": { + "plane:access_control": 40, + "plane:deserialization": 18, + "plane:injection": 112, + "plane:output_encoding": 138, + "plane:path": 142, + "plane:untrusted_destination": 52, + "static:access_control": 40, + "static:deserialization": 18, + "static:injection": 112, + "static:output_encoding": 138, + "static:path": 142, + "static:untrusted_destination": 52 + }, + "instrument_states_plane_all_families": { + "agree:missing": 164, + "agree:none": 338, + "delta:not_applicable": 502, + "engine:missing": 406, + "engine:none": 96, + "entry_points:not_applicable": 502, + "facts:not_applicable": 502, + "language:ran": 502, + "model_sinks:missing": 502, + "quick:ran": 502, + "roles:ran": 502, + "source:ran": 502, + "verify:missing": 164, + "verify:none": 338 + }, + "note": "quick rules and deterministic roles ran on each side; engine, verify, agree and model sinks never ran for these pairs (missing/none: null features, never zeros)" + }, + "memory_build": { + "command": "ousast learn memory build --labels --units --profile static --root . (exit 2: adjudications 9 of 43 anonymous functions, unchanged since 2026-10-01; rows kept)", + "examples": [ + 1133, + 1635 + ], + "pairs_examples": [ + 968, + 1470 + ], + "pairs_counts_after": { + "absent_fixed_side": 0, + "examples": 1470, + "labels": 2940, + "no_excerpt": 0, + "no_record": 1470, + "recorded": 1470, + "unread": 0 + } + }, + "complete_pairs": { + "how": "store example rows (profile static) keyed as learn.experiments.freeze_units pairs them: (repo, candidate, family) holding both labels; whole memory, every family", + "before": 459, + "after": 710, + "by_family": { + "access_control": [ + 37, + 57 + ], + "config_secrets": [ + 12, + 12 + ], + "deserialization": [ + 32, + 41 + ], + "injection": [ + 68, + 124 + ], + "memory": [ + 149, + 149 + ], + "output_encoding": [ + 77, + 146 + ], + "path": [ + 38, + 109 + ], + "unknown": [ + 2, + 2 + ], + "untrusted_destination": [ + 44, + 70 + ] + }, + "exp_004_005_units": "195 complete pairs inside exp-004/005's frozen 501 units (six families, evaluation folds); those units are frozen and were not regenerated here" + }, + "positives_only_groups": { + "before": 99, + "after": 99, + "groups_both_by_family": { + "access_control": [ + 37, + 57 + ], + "config_secrets": [ + 2, + 2 + ], + "deserialization": [ + 32, + 41 + ], + "injection": [ + 53, + 109 + ], + "memory": [ + 5, + 5 + ], + "output_encoding": [ + 38, + 107 + ], + "path": [ + 38, + 109 + ], + "unknown": [ + 2, + 2 + ], + "untrusted_destination": [ + 42, + 68 + ] + } + }, + "embeddings": { + "command": "ousast learn memory embed --budget-usd 0.20 (dry run first: 144,806 estimated tokens, $0.0029)", + "requested": 1479, + "cached": 1004, + "embedded": 475, + "calls": 15, + "tokens": 150339, + "usd": 0.003007 + }, + "spend": { + "chat_model_calls": 0, + "embedding_usd": 0.003007, + "github_api": "metadata and raw contents only" + } +} diff --git a/benchmarks/pairs/advisory-fixes-3/catalog.toml b/benchmarks/pairs/advisory-fixes-3/catalog.toml new file mode 100644 index 0000000..00cf6a0 --- /dev/null +++ b/benchmarks/pairs/advisory-fixes-3/catalog.toml @@ -0,0 +1,9057 @@ +# Advisory-fix pairs, batch 3 (2026-10-04): more (vulnerable function, fixed function) pairs where the function +# SURVIVES the fix, to roughly double the decision engine's paired data. +# +# Same rules as batch 2 (benchmarks/pairs/advisory-fixes-2/catalog.toml): a reviewed GHSA advisory (pip, npm, maven, +# composer) whose single fix commit (one parent) is linked from the advisory -- or, new here, the single commit of a +# merged pull request the advisory links (its only commit, or its squash/rebase merge commit); at most 4 non-test source +# files and 120 changed source lines, or up to 6 files / 240 lines in a second pass (`fix_lines.source_total` records +# the size, and the function's diff was read either way); the function holding the changed code lines is declared +# exactly once on both sides (the label builder's matcher, learn.excerpt.function_bounds) and its body differs. The positive is that function at `parent`, +# the negative the same function at `commit`. The function is chosen by changed lines, then its diff was read and +# kept only when the named function itself holds the fix: `provenance = "agent"`, `fix_lines` records the counts. +# Advisories whose CWEs span two families (second pass) carry the family the function's diff shows (agent-chosen). +# Weighted toward the weak families (injection, untrusted_destination); enumeration reached back to 2023 for them, +# newest first, so `post_cutoff` (published on or after 2026-06-01) is recorded per pair. +# Repositories: permissive licences only (SPDX from the API), none named anywhere else under benchmarks/ (populations +# v1/v2, every pair corpus including batches 1 and 2), no WordPress plugin, and the reserved-population test passes. +# +# Pointer pairs (vendored = false), the advisory-fixes slice and cache layout: materialize.py --catalog +# verifies the cached excerpts (verification.json beside this file). Screening record: +# benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json. `split` alternates train/holdout by fix +# date within each family; one pair per repository. + +[[pair]] +name = "fosuserbundle-refreshuser-5a36e29" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "friendsofsymfony/fosuserbundle" +cve = "GHSA-8wx3-8m4x-g5h4" +cwe = "CWE-285" +ecosystem = "composer" +published_at = "2024-05-15T21:43:23Z" +post_cutoff = false +commit = "5a36e2958068d1e6501dc8cf39bbae3ebb859d9f" +parent = "b3dc5faf0017a621537dd5ec44047be5ad5bb82e" +commit_url = "https://github.com/friendsofsymfony/fosuserbundle/commit/5a36e2958068d1e6501dc8cf39bbae3ebb859d9f" +vendored = false +host = "github" +path = "Model/UserManager.php" +mode = "name" +relpath = "Model/UserManager.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2012-07-10" +fix_lines = { in_function = 9, in_file = 9, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "Model/UserManager.php" +function = "refreshUser" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-8wx3-8m4x-g5h4: FOSUserBundle User Identity Validation Vulnerability" + +[[pair]] +name = "security-getresolvedindexpattern-f7cc569" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "opensearch-project/security" +cve = "CVE-2022-41918 GHSA-wmx7-x4jp-9jgg" +cwe = "CWE-863" +ecosystem = "maven" +published_at = "2023-03-07T20:04:42Z" +post_cutoff = false +commit = "f7cc569c9d3fa5d5432c76c854eed280d45ce6f4" +parent = "f75be3edaf900df6f42aec2fd41175e66af06f3b" +commit_url = "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4" +vendored = false +host = "github" +path = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java" +mode = "name" +relpath = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-11-07" +fix_lines = { in_function = 14, in_file = 9, source_total = 15 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java" +function = "getResolvedIndexPattern" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-wmx7-x4jp-9jgg: OpenSearch has issue with fine-grained access control of indices backing data streams" + +[[pair]] +name = "orocalendarbundle-checkpermissions-460a8ff" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "oroinc/orocalendarbundle" +cve = "CVE-2023-32062 GHSA-x2xm-p6vq-482g" +cwe = "CWE-284" +ecosystem = "composer" +published_at = "2023-11-27T23:29:11Z" +post_cutoff = false +commit = "460a8ffb63b10c76f2fa26d53512164851c4909b" +parent = "fa001c6b6dfbd4bd0ef7e72bd168bc978226e90a" +commit_url = "https://github.com/oroinc/orocalendarbundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b" +vendored = false +host = "github" +path = "Controller/SystemCalendarEventController.php" +mode = "name" +relpath = "Controller/SystemCalendarEventController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-06-01" +fix_lines = { in_function = 6, in_file = 7, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "Controller/SystemCalendarEventController.php" +function = "checkPermissions" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-x2xm-p6vq-482g: OroCalendarBundle has incorrect system calendar events visibility" + +[[pair]] +name = "remult-doonid-6892ae9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "remult/remult" +cve = "CVE-2023-35167 GHSA-7hh3-3x64-v2g9" +cwe = "CWE-284" +ecosystem = "npm" +published_at = "2023-06-20T18:50:15Z" +post_cutoff = false +commit = "6892ae97134126d8710ef7302bb2fc37730994c5" +parent = "5341348ebc7b65859bfd02baf750bd999778e155" +commit_url = "https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5" +vendored = false +host = "github" +path = "projects/core/src/data-api.ts" +mode = "name" +relpath = "projects/core/src/data-api.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-19" +fix_lines = { in_function = 9, in_file = 8, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "projects/core/src/data-api.ts" +function = "doOnId" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-7hh3-3x64-v2g9: When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id" + +[[pair]] +name = "micronaut-security-parseaudiences-9728b92" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "micronaut-projects/micronaut-security" +cve = "CVE-2023-36820 GHSA-qw22-8w9r-864h" +cwe = "CWE-284" +ecosystem = "maven" +published_at = "2023-10-05T20:55:14Z" +post_cutoff = false +commit = "9728b925221a0d87798ccf250657a3c214b7e980" +parent = "c3eeb1957a1e3d5a6b60042a349bbc93cd0809fc" +commit_url = "https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980" +vendored = false +host = "github" +path = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java" +mode = "name" +relpath = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-06-23" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java" +function = "parseAudiences" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-qw22-8w9r-864h: io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud" + +[[pair]] +name = "servicenow-devops-plugin-dochecktoolid-67192e2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/servicenow-devops-plugin" +cve = "CVE-2023-3442 GHSA-cj2x-r74q-vcx9" +cwe = "CWE-862" +ecosystem = "maven" +published_at = "2023-07-26T21:30:19Z" +post_cutoff = false +commit = "67192e24099787ad732b41d581f20714d4253921" +parent = "d7d2422b016995402dd245d9c9c5c2f4cf00c691" +commit_url = "https://github.com/jenkinsci/servicenow-devops-plugin/commit/67192e24099787ad732b41d581f20714d4253921" +vendored = false +host = "github" +path = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java" +mode = "name" +relpath = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-30" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java" +function = "doCheckToolId" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-cj2x-r74q-vcx9: Missing authorization in Jenkins Plug-in for ServiceNow " + +[[pair]] +name = "synapse-received-remote-receipt-63d28a8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "matrix-org/synapse" +cve = "CVE-2023-42453 GHSA-7565-cq32-vx2x" +cwe = "CWE-285" +ecosystem = "pip" +published_at = "2023-09-26T19:20:38Z" +post_cutoff = false +commit = "63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881" +parent = "4663d555021ce53c57e418eb1ee4445eab276bc4" +commit_url = "https://github.com/matrix-org/synapse/commit/63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881" +vendored = false +host = "github" +path = "synapse/handlers/receipts.py" +mode = "name" +relpath = "synapse/handlers/receipts.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-09-18" +fix_lines = { in_function = 10, in_file = 24, source_total = 30 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "synapse/handlers/receipts.py" +function = "_received_remote_receipt" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-7565-cq32-vx2x: matrix-synapse vulnerable to improper validation of receipts allows forged read receipts" + +[[pair]] +name = "strapi-plugin-protected-populate-protectpopulate-0544106" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "strapi-community/strapi-plugin-protected-populate" +cve = "CVE-2023-48218 GHSA-6h67-934r-82g7" +cwe = "CWE-863" +ecosystem = "npm" +published_at = "2023-11-20T21:01:43Z" +post_cutoff = false +commit = "05441066d64e09dd55937d9f089962e9ebe2fb39" +parent = "14f392f4d07bfaa7c28c63153a0f369d563f7360" +commit_url = "https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39" +vendored = false +host = "github" +path = "server/middlewares/helpers/protect-route.js" +mode = "name" +relpath = "server/middlewares/helpers/protect-route.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-11-13" +fix_lines = { in_function = 8, in_file = 6, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "server/middlewares/helpers/protect-route.js" +function = "protectPopulate" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-6h67-934r-82g7: Bypass of field access control in strapi-plugin-protected-populate" + +[[pair]] +name = "scriptler-plugin-doshowscript-5addb5f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/scriptler-plugin" +cve = "CVE-2023-50765 GHSA-4j42-6xfx-h754" +cwe = "CWE-862" +ecosystem = "maven" +published_at = "2023-12-13T18:31:04Z" +post_cutoff = false +commit = "5addb5f9e68596abdba216e61cf714c2767b874b" +parent = "bfa9b3085865d1cb9dce714770e87c4f2651fbf6" +commit_url = "https://github.com/jenkinsci/scriptler-plugin/commit/5addb5f9e68596abdba216e61cf714c2767b874b" +vendored = false +host = "github" +path = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java" +mode = "name" +relpath = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-12-12" +fix_lines = { in_function = 5, in_file = 8, source_total = 46 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java" +function = "doShowScript" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-4j42-6xfx-h754: Missing permission check in Jenkins Scriptler Plugin" + +[[pair]] +name = "undici-shouldremoveheader-6805746" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "nodejs/undici" +cve = "CVE-2024-30260 GHSA-m4v8-wqvr-p9f7" +cwe = "CWE-285" +ecosystem = "npm" +published_at = "2024-04-04T14:20:39Z" +post_cutoff = false +commit = "6805746680d27a5369d7fb67bc05f95a28247d75" +parent = "ee5f892f3955eaca37730ed30349153ba203e9cd" +commit_url = "https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75" +vendored = false +host = "github" +path = "lib/handler/redirect-handler.js" +mode = "name" +relpath = "lib/handler/redirect-handler.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-04-02" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "lib/handler/redirect-handler.js" +function = "shouldRemoveHeader" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-m4v8-wqvr-p9f7: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline" + +[[pair]] +name = "silverstripe-reports-handleaction-0351106" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "silverstripe/silverstripe-reports" +cve = "CVE-2024-29885 GHSA-89q6-98xx-4ffw" +cwe = "CWE-863" +ecosystem = "composer" +published_at = "2024-07-17T14:26:31Z" +post_cutoff = false +commit = "0351106c18ad4246d983b5f4e082c09c382121f4" +parent = "2b55d91bb307ee6b542136d5cc7c9524e2385cc4" +commit_url = "https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4" +vendored = false +host = "github" +path = "code/ReportAdmin.php" +mode = "name" +relpath = "code/ReportAdmin.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-16" +fix_lines = { in_function = 3, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "code/ReportAdmin.php" +function = "handleAction" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-89q6-98xx-4ffw: Silverstripe Reports are still accessible even when `canView()` returns false" + +[[pair]] +name = "flask-cors-get-cors-headers-7ae310c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "corydolphin/flask-cors" +cve = "CVE-2024-6221 GHSA-hxwh-jpp2-84pm" +cwe = "CWE-284" +ecosystem = "pip" +published_at = "2024-08-18T21:31:07Z" +post_cutoff = false +commit = "7ae310c56ac30e0b94fb42129aa377bf633256ec" +parent = "f25c6b2ed243457a64567a8fe40e5df6da0cb3dc" +commit_url = "https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec" +vendored = false +host = "github" +path = "flask_cors/core.py" +mode = "name" +relpath = "flask_cors/core.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-08-30" +fix_lines = { in_function = 3, in_file = 5, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "flask_cors/core.py" +function = "get_cors_headers" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-hxwh-jpp2-84pm: Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default" + +[[pair]] +name = "matrix-js-sdk-getvisiblerooms-43c72d5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "matrix-org/matrix-js-sdk" +cve = "CVE-2025-59160 GHSA-mp7c-m3rh-r56v" +cwe = "CWE-862" +ecosystem = "npm" +published_at = "2025-09-16T20:18:57Z" +post_cutoff = false +commit = "43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4" +parent = "ff89c9ec426939530a9df3bc8112ecca4b3f4e52" +commit_url = "https://github.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4" +vendored = false +host = "github" +path = "src/client.ts" +mode = "name" +relpath = "src/client.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-16" +fix_lines = { in_function = 18, in_file = 14, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/client.ts" +function = "getVisibleRooms" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-mp7c-m3rh-r56v: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another" + +[[pair]] +name = "strimzi-kafka-operator-generaterolebindingforrole-c8a1493" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "strimzi/strimzi-kafka-operator" +cve = "CVE-2025-66623 GHSA-xrhh-hx36-485q" +cwe = "CWE-863" +ecosystem = "maven" +published_at = "2025-12-05T22:02:37Z" +post_cutoff = false +commit = "c8a14935e99c91eb0dd865431f46515da9f82ccc" +parent = "e90f2b08c4ff711b2d90581b6bcdf0f59af28d98" +commit_url = "https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc" +vendored = false +host = "github" +path = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java" +mode = "name" +relpath = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-12-02" +fix_lines = { in_function = 26, in_file = 48, source_total = 90 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java" +function = "generateRoleBindingForRole" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-xrhh-hx36-485q: Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands" + +[[pair]] +name = "bagisto-reorder-b2b1cf6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "bagisto/bagisto" +cve = "CVE-2026-21447 GHSA-x5rw-qvvp-5cgm" +cwe = "CWE-284" +ecosystem = "composer" +published_at = "2026-01-02T22:50:47Z" +post_cutoff = false +commit = "b2b1cf62577245d03a68532478cffbe321df74d3" +parent = "349062ce772d8ac79bc2cd817c43d626efa71907" +commit_url = "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3" +vendored = false +host = "github" +path = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php" +mode = "name" +relpath = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-23" +fix_lines = { in_function = 6, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-284" +class = "access-control" +path = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php" +function = "reorder" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-x5rw-qvvp-5cgm: Bagisto has IDOR in Customer Order Reorder Functionality" + +[[pair]] +name = "froshplatformadminer-index-c4dd6c3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "friendsofshopware/froshplatformadminer" +cve = "CVE-2026-25878 GHSA-f339-246p-wwjp" +cwe = "CWE-306" +ecosystem = "composer" +published_at = "2026-02-10T00:22:05Z" +post_cutoff = false +commit = "c4dd6c3462af178b3a7d146d3c651c2c253e902b" +parent = "b1d5b0e41b4bef17171b11f05379cac002b4dc77" +commit_url = "https://github.com/friendsofshopware/froshplatformadminer/commit/c4dd6c3462af178b3a7d146d3c651c2c253e902b" +vendored = false +host = "github" +path = "src/Controller/AdminerController.php" +mode = "name" +relpath = "src/Controller/AdminerController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-07" +fix_lines = { in_function = 8, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-306" +class = "missing-authentication" +path = "src/Controller/AdminerController.php" +function = "index" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-f339-246p-wwjp: FroshAdminer Adminer UI is accessible without admin session" + +[[pair]] +name = "azure-blob-actionloadcontainerdata-cf69db4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "craftcms/azure-blob" +cve = "CVE-2026-32268 GHSA-q6fm-p73f-x862" +cwe = "CWE-862" +ecosystem = "composer" +published_at = "2026-03-16T18:44:38Z" +post_cutoff = false +commit = "cf69db45f393b3508a32f89ac8235554a2f026ff" +parent = "5f21c2694cb10f791ac5bf2834b122053d856020" +commit_url = "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff" +vendored = false +host = "github" +path = "src/controllers/DefaultController.php" +mode = "name" +relpath = "src/controllers/DefaultController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-18" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-862" +class = "missing-authorization" +path = "src/controllers/DefaultController.php" +function = "actionLoadContainerData" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-q6fm-p73f-x862: Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability" + +[[pair]] +name = "connect-cms-update-7c99517" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "opensource-workshop/connect-cms" +cve = "CVE-2026-32300 GHSA-qr6x-wvxr-8hm9" +cwe = "CWE-285" +ecosystem = "composer" +published_at = "2026-03-23T20:39:10Z" +post_cutoff = false +commit = "7c9951738c62a1d51b91e9956d1eb756c5d52cce" +parent = "c04dc40f814eff891915752ef1ec00ba6612441c" +commit_url = "https://github.com/opensource-workshop/connect-cms/commit/7c9951738c62a1d51b91e9956d1eb756c5d52cce" +vendored = false +host = "github" +path = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php" +mode = "name" +relpath = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-20" +fix_lines = { in_function = 9, in_file = 9, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php" +function = "update" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-qr6x-wvxr-8hm9: Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information" + +[[pair]] +name = "parse-server-gethandler-053109b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "parse-community/parse-server" +cve = "CVE-2026-34784 GHSA-hpm8-9qx6-jvwv" +cwe = "CWE-285" +ecosystem = "npm" +published_at = "2026-04-01T23:09:14Z" +post_cutoff = false +commit = "053109b3ee71815bc39ed84116c108ff9edbf337" +parent = "83e794919635ff8b6c86bed8b640222d1c973e03" +commit_url = "https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337" +vendored = false +host = "github" +path = "src/Routers/FilesRouter.js" +mode = "name" +relpath = "src/Routers/FilesRouter.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-30" +fix_lines = { in_function = 14, in_file = 32, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-285" +class = "missing-authorization" +path = "src/Routers/FilesRouter.js" +function = "getHandler" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-hpm8-9qx6-jvwv: Parser Server's streaming file download bypasses afterFind file trigger authorization" + +[[pair]] +name = "openclaw-resolvecommandauthorization-2aa93d4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "openclaw/openclaw" +cve = "GHSA-p3pv-c954-9m6f" +cwe = "CWE-863" +ecosystem = "npm" +published_at = "2026-05-11T18:31:46Z" +post_cutoff = false +commit = "2aa93d44a1b2c7058c371f261fda2b5d4de4a882" +parent = "4fdd005b88967a2eca5e20b600b8ffae3ce57b39" +commit_url = "https://github.com/openclaw/openclaw/commit/2aa93d44a1b2c7058c371f261fda2b5d4de4a882" +vendored = false +host = "github" +path = "src/auto-reply/command-auth.ts" +mode = "name" +relpath = "src/auto-reply/command-auth.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-21" +fix_lines = { in_function = 4, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-863" +class = "incorrect-authorization" +path = "src/auto-reply/command-auth.ts" +function = "resolveCommandAuthorization" +mechanism = "missing_auth_guard" +family = "access_control" +evidence = "GHSA-p3pv-c954-9m6f: Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners" + +[[pair]] +name = "snappy-prepareoutput-1ee6360" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "knplabs/snappy" +cve = "CVE-2023-28115 GHSA-gq6w-q6wh-jggc" +cwe = "CWE-502" +ecosystem = "composer" +published_at = "2023-03-17T18:24:24Z" +post_cutoff = false +commit = "1ee6360cbdbea5d09705909a150df7963a88efd6" +parent = "cef6d3fd349236312e822e99957a0fbbac3f2cba" +commit_url = "https://github.com/knplabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6" +vendored = false +host = "github" +path = "src/Knp/Snappy/AbstractGenerator.php" +mode = "name" +relpath = "src/Knp/Snappy/AbstractGenerator.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-03-17" +fix_lines = { in_function = 3, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "src/Knp/Snappy/AbstractGenerator.php" +function = "prepareOutput" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-gq6w-q6wh-jggc: PHAR deserialization allowing remote code execution" + +[[pair]] +name = "llama-hub-init-c01416e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "run-llama/llama-hub" +cve = "CVE-2024-23730 GHSA-297x-2qf3-jrj3" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2024-01-21T18:30:34Z" +post_cutoff = false +commit = "c01416e737c7747a213a79881b8308c41d043515" +parent = "2247b1b14cd2f4f54c7d95e46bada2d51371e786" +commit_url = "https://github.com/run-llama/llama-hub/commit/c01416e737c7747a213a79881b8308c41d043515" +vendored = false +host = "github" +path = "llama_hub/tools/openapi/base.py" +mode = "name" +relpath = "llama_hub/tools/openapi/base.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-01-07" +fix_lines = { in_function = 2, in_file = 1, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "llama_hub/tools/openapi/base.py" +function = "__init__" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-297x-2qf3-jrj3: Unsafe yaml deserialization in llama-hub" + +[[pair]] +name = "ngrinder-read-85efa4a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "naver/ngrinder" +cve = "CVE-2024-28213 GHSA-j7jm-8gf5-frcm" +cwe = "CWE-502" +ecosystem = "maven" +published_at = "2024-03-07T06:30:31Z" +post_cutoff = false +commit = "85efa4a075354e077a700262ef78e2e9119881bf" +parent = "1c6ba7ca5d9d2976cca7829f69c7d2b3e8ab3d51" +commit_url = "https://github.com/naver/ngrinder/commit/85efa4a075354e077a700262ef78e2e9119881bf" +vendored = false +host = "github" +path = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java" +mode = "name" +relpath = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-02-23" +fix_lines = { in_function = 14, in_file = 20, source_total = 29 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java" +function = "read" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-j7jm-8gf5-frcm: nGrinder vulnerable to unsafe Java objects deserialization" + +[[pair]] +name = "qiskit-ibm-runtime-object-hook-b78fca1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "qiskit/qiskit-ibm-runtime" +cve = "CVE-2024-29032 GHSA-x4x5-jv3x-9c7m" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2024-03-20T15:44:22Z" +post_cutoff = false +commit = "b78fca114133051805d00043a404b25a33835f4d" +parent = "1cba6967e7af156e9d9f610db7753419138c732a" +commit_url = "https://github.com/qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d" +vendored = false +host = "github" +path = "qiskit_ibm_runtime/utils/json.py" +mode = "name" +relpath = "qiskit_ibm_runtime/utils/json.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-03-18" +fix_lines = { in_function = 4, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "qiskit_ibm_runtime/utils/json.py" +function = "object_hook" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-x4x5-jv3x-9c7m: `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code" + +[[pair]] +name = "invokeai-torch-load-file-756008d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "invoke-ai/invokeai" +cve = "CVE-2024-12029 GHSA-mcrp-whpw-jp68" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2025-03-21T15:32:15Z" +post_cutoff = false +commit = "756008dc5899081c5aa51e5bd8f24c1b3975a59e" +parent = "965cd76e338e1959efd0eea3d760846e86c6e1e5" +commit_url = "https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e" +vendored = false +host = "github" +path = "invokeai/app/services/model_load/model_load_default.py" +mode = "name" +relpath = "invokeai/app/services/model_load/model_load_default.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-11-26" +fix_lines = { in_function = 2, in_file = 1, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "invokeai/app/services/model_load/model_load_default.py" +function = "torch_load_file" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-mcrp-whpw-jp68: InvokeAI Deserialization of Untrusted Data vulnerability" + +[[pair]] +name = "jackrabbit-getrepository-7a31909" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/jackrabbit" +cve = "CVE-2025-58782 GHSA-cxvc-g8f2-4gmm" +cwe = "CWE-502" +ecosystem = "maven" +published_at = "2025-09-08T09:31:09Z" +post_cutoff = false +commit = "7a319093c9864111bb86c9895148e580e0f8259a" +parent = "5fb875247f2c859ca72114c0ecd22a70192045a3" +commit_url = "https://github.com/apache/jackrabbit/commit/7a319093c9864111bb86c9895148e580e0f8259a" +vendored = false +host = "github" +path = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java" +mode = "name" +relpath = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-08" +fix_lines = { in_function = 35, in_file = 34, source_total = 138 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java" +function = "getRepository" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-cxvc-g8f2-4gmm: Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data" + +[[pair]] +name = "inspiremusic-load-784cbf8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "funaudiollm/inspiremusic" +cve = "CVE-2025-5148 GHSA-pgp9-g5q8-j3wp" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2025-05-25T12:30:24Z" +post_cutoff = false +commit = "784cbf8dde2cf1456ff808aeba23177e1810e7a9" +parent = "bf32364bcb0d136497ca69f9db622e9216b029dd" +commit_url = "https://github.com/funaudiollm/inspiremusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9" +vendored = false +host = "github" +path = "inspiremusic/cli/model.py" +mode = "name" +relpath = "inspiremusic/cli/model.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-05-09" +fix_lines = { in_function = 4, in_file = 3, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "inspiremusic/cli/model.py" +function = "load" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-pgp9-g5q8-j3wp: FunAudioLLM InspireMusic deserialization vulnerability" + +[[pair]] +name = "datachain-deserialize-914b956" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "iterative/datachain" +cve = "CVE-2025-61677 GHSA-6px8-mr29-cj4r" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2025-10-02T16:24:46Z" +post_cutoff = false +commit = "914b95610620d50c8d9bee506ccbfa7d4d57fdc0" +parent = "de34d6cb19b3c0a17fff03318d2c6dd53ec960bf" +commit_url = "https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0" +vendored = false +host = "github" +path = "src/datachain/data_storage/serializer.py" +mode = "name" +relpath = "src/datachain/data_storage/serializer.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-10-01" +fix_lines = { in_function = 30, in_file = 106, source_total = 169 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "src/datachain/data_storage/serializer.py" +function = "deserialize" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-6px8-mr29-cj4r: DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables" + +[[pair]] +name = "ray-deserialize-with-fallback-c02bd31" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "ray-project/ray" +cve = "CVE-2026-41486 GHSA-mw35-8rx3-xf9r" +cwe = "CWE-502" +ecosystem = "pip" +published_at = "2026-04-24T16:15:00Z" +post_cutoff = false +commit = "c02bd31ae31996805868baa446a131a8d304525f" +parent = "ba6fbf1c8328b56d454ed1b875abe1c197afefd7" +commit_url = "https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f" +vendored = false +host = "github" +path = "python/ray/data/_internal/tensor_extensions/arrow.py" +mode = "name" +relpath = "python/ray/data/_internal/tensor_extensions/arrow.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-27" +fix_lines = { in_function = 20, in_file = 30, source_total = 47 } + +[[pair.expected]] +cwe = "CWE-502" +class = "insecure-deserialization" +path = "python/ray/data/_internal/tensor_extensions/arrow.py" +function = "_deserialize_with_fallback" +mechanism = "source_reaches_sink" +family = "deserialization" +evidence = "GHSA-mw35-8rx3-xf9r: Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization" + +[[pair]] +name = "yii2-jqgrid-widget-addsearchoptionsrecursively-a117e0f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "himiklab/yii2-jqgrid-widget" +cve = "CVE-2014-125051 GHSA-7mg5-rw39-q67f" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2023-01-06T18:30:19Z" +post_cutoff = false +commit = "a117e0f2df729e3ff726968794d9a5ac40e660b9" +parent = "55460df283454951c257411d563b2b8118d6b299" +commit_url = "https://github.com/himiklab/yii2-jqgrid-widget/commit/a117e0f2df729e3ff726968794d9a5ac40e660b9" +vendored = false +host = "github" +path = "JqGridAction.php" +mode = "name" +relpath = "JqGridAction.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2014-10-06" +fix_lines = { in_function = 3, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "JqGridAction.php" +function = "addSearchOptionsRecursively" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7mg5-rw39-q67f: himiklab yii2-jqgrid-widget vulnerable to SQL Injection" + +[[pair]] +name = "postgraas-server-create-postgres-db-7cd8d01" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "blue-yonder/postgraas_server" +cve = "CVE-2018-25088 GHSA-vghm-8cjp-hjw6" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2023-07-18T15:30:36Z" +post_cutoff = false +commit = "7cd8d016edc74a78af0d81c948bfafbcc93c937c" +parent = "bd4f1b88e7008a3abd4dbe05c26e7b20bbb99649" +commit_url = "https://github.com/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c" +vendored = false +host = "github" +path = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py" +mode = "name" +relpath = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2018-02-01" +fix_lines = { in_function = 26, in_file = 26, source_total = 33 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py" +function = "create_postgres_db" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-vghm-8cjp-hjw6: postgraas-server vulnerable to SQL injection" + +[[pair]] +name = "xmlseclibs-processrefnode-6490326" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "robrichards/xmlseclibs" +cve = "GHSA-2g98-f9jv-w8c5" +cwe = "CWE-91" +ecosystem = "composer" +published_at = "2024-05-20T18:06:52Z" +post_cutoff = false +commit = "649032643f7aac493e91ca318da0339aec72aa4a" +parent = "222303db07bef97b948f4882d98294d9facaddb4" +commit_url = "https://github.com/robrichards/xmlseclibs/commit/649032643f7aac493e91ca318da0339aec72aa4a" +vendored = false +host = "github" +path = "src/XMLSecurityDSig.php" +mode = "name" +relpath = "src/XMLSecurityDSig.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2018-02-15" +fix_lines = { in_function = 4, in_file = 3, source_total = 40 } + +[[pair.expected]] +cwe = "CWE-91" +class = "xml-injection" +path = "src/XMLSecurityDSig.php" +function = "processRefNode" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-2g98-f9jv-w8c5: robrichards/xmlseclibs XPath injection" + +[[pair]] +name = "propel2-applylimit-cd23d73" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "propelorm/propel2" +cve = "GHSA-7vw7-qx38-37vr" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2024-05-20T17:34:33Z" +post_cutoff = false +commit = "cd23d7384a15cfe203e23b3a835c8ab1d81d9246" +parent = "c64c0d61a36544c8f7cb9073c039715ba9cc343a" +commit_url = "https://github.com/propelorm/propel2/commit/cd23d7384a15cfe203e23b3a835c8ab1d81d9246" +vendored = false +host = "github" +path = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php" +mode = "name" +relpath = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2018-02-16" +fix_lines = { in_function = 2, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php" +function = "applyLimit" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7vw7-qx38-37vr: Propel2 SQL injection possible with limit() on MySQL" + +[[pair]] +name = "propel-applylimit-b720932" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "propelorm/propel" +cve = "GHSA-7g7c-qhf3-x59p" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2024-05-20T17:36:28Z" +post_cutoff = false +commit = "b72093201f8e225410f62a246653ac039e31c90a" +parent = "3f7a284906ce3e402bcb101938270842fdad71fa" +commit_url = "https://github.com/propelorm/propel/commit/b72093201f8e225410f62a246653ac039e31c90a" +vendored = false +host = "github" +path = "runtime/lib/adapter/DBMySQL.php" +mode = "name" +relpath = "runtime/lib/adapter/DBMySQL.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2019-11-04" +fix_lines = { in_function = 2, in_file = 3, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "runtime/lib/adapter/DBMySQL.php" +function = "applyLimit" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7g7c-qhf3-x59p: propel/propel1 SQL injection possible with limit() on MySQL" + +[[pair]] +name = "node-gry-exec-5108446" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ionicabizau/node-gry" +cve = "CVE-2020-36650 GHSA-w5mw-f2hq-5fw8" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-01-11T18:30:27Z" +post_cutoff = false +commit = "5108446c1e23960d65e8b973f1d9486f9f9dbd6c" +parent = "e6eea8e6ef0a72e144d3ce3eb883bd5940be0886" +commit_url = "https://github.com/ionicabizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c" +vendored = false +host = "github" +path = "lib/index.js" +mode = "name" +relpath = "lib/index.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2020-04-03" +fix_lines = { in_function = 8, in_file = 17, source_total = 25 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "lib/index.js" +function = "exec" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-w5mw-f2hq-5fw8: gry vulnerable to Command Injection" + +[[pair]] +name = "json-logic-js-arrayunique-c1dd82f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "jwadhams/json-logic-js" +cve = "CVE-2021-4329 GHSA-67j4-2mh6-8627" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-03-05T21:30:15Z" +post_cutoff = false +commit = "c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227" +parent = "17e9fedcd6864aa94d5ae48eca259a9677d4dfe2" +commit_url = "https://github.com/jwadhams/json-logic-js/commit/c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227" +vendored = false +host = "github" +path = "logic.js" +mode = "name" +relpath = "logic.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2021-03-30" +fix_lines = { in_function = 6, in_file = 6, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "logic.js" +function = "arrayUnique" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-67j4-2mh6-8627: json-logic-js Command Injection vulnerability" + +[[pair]] +name = "yii2-gii-validatemessagecategory-ed61e0d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "yiisoft/yii2-gii" +cve = "CVE-2020-36655 GHSA-3mpg-q26j-83j5" +cwe = "CWE-94" +ecosystem = "composer" +published_at = "2023-01-21T03:30:28Z" +post_cutoff = false +commit = "ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b" +parent = "94f9c6d24c42137ca53f51bb023b19c1fd19bedf" +commit_url = "https://github.com/yiisoft/yii2-gii/commit/ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b" +vendored = false +host = "github" +path = "src/Generator.php" +mode = "name" +relpath = "src/Generator.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2021-05-06" +fix_lines = { in_function = 8, in_file = 6, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/Generator.php" +function = "validateMessageCategory" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-3mpg-q26j-83j5: Command injection in yiisoft/yii2-gii" + +[[pair]] +name = "contao-tablelookupwizard-preparewhere-a5e723a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "terminal42/contao-tablelookupwizard" +cve = "GHSA-7fpj-wc8v-9cgc" +cwe = "CWE-89" +ecosystem = "composer" +published_at = "2024-05-30T13:12:13Z" +post_cutoff = false +commit = "a5e723a28f110b7df8ffc4175cef9b061d3cc717" +parent = "ae6c82f10b0f1e87226079ebaa78ac630b05279a" +commit_url = "https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717" +vendored = false +host = "github" +path = "TableLookupWizard.php" +mode = "name" +relpath = "TableLookupWizard.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2022-02-04" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "TableLookupWizard.php" +function = "prepareWhere" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7fpj-wc8v-9cgc: Duplicate Advisory: terminal42/contao-tablelookupwizard possible SQL injection in widget field value" + +[[pair]] +name = "spring-module-core-getschema-d374a5f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "folio-org/spring-module-core" +cve = "CVE-2022-4963 GHSA-4h5h-p23f-hjqf" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2024-03-21T03:36:44Z" +post_cutoff = false +commit = "d374a5f77e6b58e36f0e0e4419be18b95edcd7ff" +parent = "e93b5ddd3022b81abf8ae81da8d3a740186f456e" +commit_url = "https://github.com/folio-org/spring-module-core/commit/d374a5f77e6b58e36f0e0e4419be18b95edcd7ff" +vendored = false +host = "github" +path = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java" +mode = "name" +relpath = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-11-21" +fix_lines = { in_function = 6, in_file = 8, source_total = 19 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java" +function = "getSchema" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-4h5h-p23f-hjqf: SQL injection in Folio Spring Module Core" + +[[pair]] +name = "window-control-sendkeys-075c854" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "bruno-robert/window-control" +cve = "CVE-2022-25926 GHSA-9mjx-wfqp-j5ph" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-01-04T18:30:59Z" +post_cutoff = false +commit = "075c854534a749d887655a906759f5a7eee95173" +parent = "3954822ef3f0307745cdbff21a965278dd0a357b" +commit_url = "https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-01-02" +fix_lines = { in_function = 6, in_file = 10, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "index.js" +function = "sendKeys" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-9mjx-wfqp-j5ph: window-control vulnerable to Command Injection due to improper input sanitization" + +[[pair]] +name = "snowflake-connector-nodejs-convertrawvariant-0c9622a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "snowflakedb/snowflake-connector-nodejs" +cve = "CVE-2023-34232 GHSA-h53w-7qw7-vh5c" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-06-09T22:53:51Z" +post_cutoff = false +commit = "0c9622ae12cd7d627df404b73a783b4a5f60728a" +parent = "ca2f5e6e49caeafb1f882ab873c3dbab5dde67dc" +commit_url = "https://github.com/snowflakedb/snowflake-connector-nodejs/commit/0c9622ae12cd7d627df404b73a783b4a5f60728a" +vendored = false +host = "github" +path = "lib/connection/result/column.js" +mode = "name" +relpath = "lib/connection/result/column.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-04-17" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "lib/connection/result/column.js" +function = "convertRawVariant" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-h53w-7qw7-vh5c: Snowflake NodeJS Driver vulnerable to Command Injection" + +[[pair]] +name = "node-git-commit-info-gitcommitinfo-f7c491e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "jpeer264/node-git-commit-info" +cve = "CVE-2023-26134 GHSA-h42j-mrmp-9369" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2023-06-28T06:30:22Z" +post_cutoff = false +commit = "f7c491ede51f886a988af9b266797cb24591d18c" +parent = "8b456acbc919e98a9f04b399c1581bbf213d83bd" +commit_url = "https://github.com/jpeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18c" +vendored = false +host = "github" +path = "index.ts" +mode = "name" +relpath = "index.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-06-08" +fix_lines = { in_function = 3, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "index.ts" +function = "gitCommitInfo" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-h42j-mrmp-9369: git-commit-info vulnerable to Command Injection" + +[[pair]] +name = "numexpr-stringtoexpression-4b2d89c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pydata/numexpr" +cve = "CVE-2023-39631 GHSA-f73w-4m7g-ch9x" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2023-09-01T18:30:41Z" +post_cutoff = false +commit = "4b2d89cf14e75030d27629925b9998e1e91d23c7" +parent = "74d597398ba3c379c196e469d40f516de110eaa5" +commit_url = "https://github.com/pydata/numexpr/commit/4b2d89cf14e75030d27629925b9998e1e91d23c7" +vendored = false +host = "github" +path = "numexpr/necompiler.py" +mode = "name" +relpath = "numexpr/necompiler.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-07-22" +fix_lines = { in_function = 2, in_file = 22, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "numexpr/necompiler.py" +function = "stringToExpression" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-f73w-4m7g-ch9x: Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library" + +[[pair]] +name = "scancode-io-fetch-docker-image-07ec0de" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "nexb/scancode.io" +cve = "CVE-2023-39523 GHSA-2ggp-cmvm-f62f" +cwe = "CWE-77" +ecosystem = "pip" +published_at = "2023-08-09T14:41:23Z" +post_cutoff = false +commit = "07ec0de1964b14bf085a1c9a27ece2b61ab6105c" +parent = "2f5a6cce23058684633326fc27b0f052a218b64e" +commit_url = "https://github.com/nexb/scancode.io/commit/07ec0de1964b14bf085a1c9a27ece2b61ab6105c" +vendored = false +host = "github" +path = "scanpipe/pipes/fetch.py" +mode = "name" +relpath = "scanpipe/pipes/fetch.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-08-07" +fix_lines = { in_function = 3, in_file = 6, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "scanpipe/pipes/fetch.py" +function = "fetch_docker_image" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-2ggp-cmvm-f62f: ScanCode.io command injection in docker image fetch process" + +[[pair]] +name = "dcnnt-py-main-b4021d7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "cyanomiko/dcnnt-py" +cve = "CVE-2023-1000 GHSA-8p42-7597-p2f6" +cwe = "CWE-77" +ecosystem = "pip" +published_at = "2024-04-27T09:30:33Z" +post_cutoff = false +commit = "b4021d784a97e25151a5353aa763a741e9a148f5" +parent = "4084ea18f96d9a953315f5555fca45f26639b8be" +commit_url = "https://github.com/cyanomiko/dcnnt-py/commit/b4021d784a97e25151a5353aa763a741e9a148f5" +vendored = false +host = "github" +path = "dcnnt/plugins/notifications.py" +mode = "name" +relpath = "dcnnt/plugins/notifications.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-08-14" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "dcnnt/plugins/notifications.py" +function = "main" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8p42-7597-p2f6: dcnnt-py is vulnerable to command injection via Notification Handler" + +[[pair]] +name = "find-exec-isexec-74fb108" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "shime/find-exec" +cve = "CVE-2023-40582 GHSA-95rp-6gqp-6622" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2023-08-30T20:08:58Z" +post_cutoff = false +commit = "74fb108097c229b03d6dba4cce81e36aa364b51c" +parent = "934ae934713bcb7bb9d6264030672d0c974cb541" +commit_url = "https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-08-24" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "index.js" +function = "isExec" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-95rp-6gqp-6622: Command Injection Vulnerability in find-exec" + +[[pair]] +name = "blamer-git-0965877" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "kucherenko/blamer" +cve = "CVE-2023-26143 GHSA-6f9p-g466-f8v8" +cwe = "CWE-88" +ecosystem = "npm" +published_at = "2023-09-19T06:30:17Z" +post_cutoff = false +commit = "0965877f115753371a2570f10a63c455d2b2cde3" +parent = "530d2152bb96a6ac240f47f78d9dccd2e84487b9" +commit_url = "https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3" +vendored = false +host = "github" +path = "src/vcs/git.ts" +mode = "name" +relpath = "src/vcs/git.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-09-17" +fix_lines = { in_function = 3, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-88" +class = "argument-injection" +path = "src/vcs/git.ts" +function = "git" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-6f9p-g466-f8v8: blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API" + +[[pair]] +name = "php-heic-to-jpg-convert-852bc21" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "maestroerror/php-heic-to-jpg" +cve = "CVE-2024-48514 GHSA-g8v9-c8m3-942v" +cwe = "CWE-94" +ecosystem = "composer" +published_at = "2024-10-24T18:30:44Z" +post_cutoff = false +commit = "852bc210d302884e2635ba60b1b460b53afe5463" +parent = "5cfd76452915aad37666ecba7b67087aab9268cf" +commit_url = "https://github.com/maestroerror/php-heic-to-jpg/commit/852bc210d302884e2635ba60b1b460b53afe5463" +vendored = false +host = "github" +path = "src/HeicToJpg.php" +mode = "name" +relpath = "src/HeicToJpg.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-02-09" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/HeicToJpg.php" +function = "convert" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-g8v9-c8m3-942v: Remote code execution in php-heic-to-jpg" + +[[pair]] +name = "pyansys-geometry-start-program-f82346b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "ansys/pyansys-geometry" +cve = "CVE-2024-29189 GHSA-38jr-29fh-w9vm" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2024-03-25T19:37:46Z" +post_cutoff = false +commit = "f82346b9432b06532e84f3278125f5879b4e9f3f" +parent = "138ae18f810b3e556f90ca12164fc68bc76f063c" +commit_url = "https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f" +vendored = false +host = "github" +path = "src/ansys/geometry/core/connection/product_instance.py" +mode = "name" +relpath = "src/ansys/geometry/core/connection/product_instance.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-03-21" +fix_lines = { in_function = 1, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/ansys/geometry/core/connection/product_instance.py" +function = "_start_program" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-38jr-29fh-w9vm: ansys-geometry-core OS Command Injection vulnerability" + +[[pair]] +name = "sagemaker-python-sdk-capture-dependencies-2d873d5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/sagemaker-python-sdk" +cve = "CVE-2024-34073 GHSA-7pc3-pr3q-58vg" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2024-05-03T20:26:03Z" +post_cutoff = false +commit = "2d873d53f708ea570fc2e2a6974f8c3097fe9df5" +parent = "d27836eab1575d90db676ab2667b4816eaf45af0" +commit_url = "https://github.com/aws/sagemaker-python-sdk/commit/2d873d53f708ea570fc2e2a6974f8c3097fe9df5" +vendored = false +host = "github" +path = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py" +mode = "name" +relpath = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-04-02" +fix_lines = { in_function = 6, in_file = 4, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py" +function = "capture_dependencies" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7pc3-pr3q-58vg: sagemaker-python-sdk Command Injection vulnerability" + +[[pair]] +name = "node-mysql2-readcodefor-7d4b098" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "sidorares/node-mysql2" +cve = "CVE-2024-21511 GHSA-4rch-2fh8-94vw" +cwe = "CWE-94" +ecosystem = "npm" +published_at = "2024-04-23T06:30:47Z" +post_cutoff = false +commit = "7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713" +parent = "2efd6ab397a1af0ae2b198c6761473ccfbcd8da5" +commit_url = "https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713" +vendored = false +host = "github" +path = "lib/parsers/binary_parser.js" +mode = "name" +relpath = "lib/parsers/binary_parser.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-04-21" +fix_lines = { in_function = 4, in_file = 2, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "lib/parsers/binary_parser.js" +function = "readCodeFor" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-4rch-2fh8-94vw: MySQL2 for Node Arbitrary Code Injection" + +[[pair]] +name = "pymysql-escape-dict-521e400" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pymysql/pymysql" +cve = "CVE-2024-36039 GHSA-v9hf-5j83-6xpp" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2024-05-21T18:31:23Z" +post_cutoff = false +commit = "521e40050cb386a499f68f483fefd144c493053c" +parent = "7f032a699d55340f05101deb4d7d4f63db4adc11" +commit_url = "https://github.com/pymysql/pymysql/commit/521e40050cb386a499f68f483fefd144c493053c" +vendored = false +host = "github" +path = "pymysql/converters.py" +mode = "name" +relpath = "pymysql/converters.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-05-21" +fix_lines = { in_function = 6, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "pymysql/converters.py" +function = "escape_dict" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-v9hf-5j83-6xpp: PyMySQL SQL Injection vulnerability" + +[[pair]] +name = "mindsdb-dispatch-update-11a4db7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "mindsdb/mindsdb" +cve = "CVE-2024-45851 GHSA-wf9g-c67g-h4ch" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2024-09-12T15:33:01Z" +post_cutoff = false +commit = "11a4db792ad36cf704f7307c7602128b17752c80" +parent = "ff120b08f45a4b15a313f7723ea0f2d8aa4be87c" +commit_url = "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80" +vendored = false +host = "github" +path = "mindsdb/integrations/libs/vectordatabase_handler.py" +mode = "name" +relpath = "mindsdb/integrations/libs/vectordatabase_handler.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-07-24" +fix_lines = { in_function = 2, in_file = 1, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "mindsdb/integrations/libs/vectordatabase_handler.py" +function = "_dispatch_update" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-wf9g-c67g-h4ch: MindsDB Eval Injection vulnerability" + +[[pair]] +name = "haystack-validate-template-6c25a5c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "deepset-ai/haystack" +cve = "CVE-2024-41950 GHSA-hx9v-6r9f-w677" +cwe = "CWE-1336" +ecosystem = "pip" +published_at = "2024-07-31T18:50:41Z" +post_cutoff = false +commit = "6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e" +parent = "c077f4cc79a009d72a59399478f9cc78202c8ef5" +commit_url = "https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e" +vendored = false +host = "github" +path = "haystack/components/builders/dynamic_chat_prompt_builder.py" +mode = "name" +relpath = "haystack/components/builders/dynamic_chat_prompt_builder.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-26" +fix_lines = { in_function = 6, in_file = 5, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "haystack/components/builders/dynamic_chat_prompt_builder.py" +function = "_validate_template" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-hx9v-6r9f-w677: Insecure Jinja2 templates rendered in Haystack Components can lead to RCE" + +[[pair]] +name = "fides-render-829cbd9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "ethyca/fides" +cve = "CVE-2024-45053 GHSA-c34r-238x-f7qx" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2024-09-04T18:07:17Z" +post_cutoff = false +commit = "829cbd9cb5ef9c814fbac1ed6800e8d939d359c5" +parent = "e9174b771155abc0ff3faf1fb7b8b76836788617" +commit_url = "https://github.com/ethyca/fides/commit/829cbd9cb5ef9c814fbac1ed6800e8d939d359c5" +vendored = false +host = "github" +path = "src/fides/api/service/messaging/message_dispatch_service.py" +mode = "name" +relpath = "src/fides/api/service/messaging/message_dispatch_service.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-09-03" +fix_lines = { in_function = 6, in_file = 6, source_total = 64 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/fides/api/service/messaging/message_dispatch_service.py" +function = "_render" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-c34r-238x-f7qx: Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine" + +[[pair]] +name = "torchgeo-get-weight-1a98078" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "torchgeo/torchgeo" +cve = "CVE-2024-49048 GHSA-ghq9-vc6f-8qjf" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2026-04-01T00:03:56Z" +post_cutoff = false +commit = "1a980788cb7089a1115f3b786c7daa9dd47d7d7a" +parent = "da691c4568b0ab98ea74bb736081622fb98d23c9" +commit_url = "https://github.com/torchgeo/torchgeo/commit/1a980788cb7089a1115f3b786c7daa9dd47d7d7a" +vendored = false +host = "github" +path = "torchgeo/models/api.py" +mode = "name" +relpath = "torchgeo/models/api.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-09-28" +fix_lines = { in_function = 9, in_file = 11, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "torchgeo/models/api.py" +function = "get_weight" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-ghq9-vc6f-8qjf: TorchGeo Remote Code Execution Vulnerability" + +[[pair]] +name = "plotai-run-bdcfb13" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "mljar/plotai" +cve = "CVE-2025-1497 GHSA-2hmp-5wqg-f24h" +cwe = "CWE-77" +ecosystem = "pip" +published_at = "2025-03-10T15:30:47Z" +post_cutoff = false +commit = "bdcfb13484f0b85703a4c1ddfd71cb21840e7fde" +parent = "7a95b06812af120141c84f6bc28551ac5586f9b9" +commit_url = "https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde" +vendored = false +host = "github" +path = "plotai/code/executor.py" +mode = "name" +relpath = "plotai/code/executor.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-14" +fix_lines = { in_function = 1, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "plotai/code/executor.py" +function = "run" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-2hmp-5wqg-f24h: PlotAI eval vulnerability" + +[[pair]] +name = "matrix-appservice-irc-settopic-74f02c8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "matrix-org/matrix-appservice-irc" +cve = "CVE-2025-27146 GHSA-5mvm-89c9-9gm5" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2025-02-25T18:29:34Z" +post_cutoff = false +commit = "74f02c8e11f16ed1b355700092c1aa9c036a11bd" +parent = "062f3ace8b08e86e9f63c004ffdb85942af1b94e" +commit_url = "https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd" +vendored = false +host = "github" +path = "src/irc/BridgedClient.ts" +mode = "name" +relpath = "src/irc/BridgedClient.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-25" +fix_lines = { in_function = 5, in_file = 6, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "src/irc/BridgedClient.ts" +function = "setTopic" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-5mvm-89c9-9gm5: Matrix IRC Bridge allows IRC command injection to own puppeted user" + +[[pair]] +name = "conductor-initengine-e981650" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "conductor-oss/conductor" +cve = "CVE-2025-26074 GHSA-8gqp-hr9g-pg62" +cwe = "CWE-78" +ecosystem = "maven" +published_at = "2025-06-30T18:31:50Z" +post_cutoff = false +commit = "e9816501df1e364a3d39d7fe37d6e167c40eaa1b" +parent = "5976cad67bab4204e3ec4b2edd6f6831623c7c9a" +commit_url = "https://github.com/conductor-oss/conductor/commit/e9816501df1e364a3d39d7fe37d6e167c40eaa1b" +vendored = false +host = "github" +path = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java" +mode = "name" +relpath = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-01" +fix_lines = { in_function = 6, in_file = 5, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java" +function = "initEngine" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8gqp-hr9g-pg62: Conductor vulnerable to OS command injection through unrestricted access to Java classes" + +[[pair]] +name = "amplify-codegen-ui-buildbindingexpression-ca98c38" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws-amplify/amplify-codegen-ui" +cve = "CVE-2025-4318 GHSA-hf3j-86p7-mfw8" +cwe = "CWE-95" +ecosystem = "npm" +published_at = "2026-07-30T20:57:24Z" +post_cutoff = true +commit = "ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6" +parent = "bbc3435e592aaf9a96ad231d5468784d8e95f4c9" +commit_url = "https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6" +vendored = false +host = "github" +path = "packages/codegen-ui-react/lib/react-component-render-helper.ts" +mode = "name" +relpath = "packages/codegen-ui-react/lib/react-component-render-helper.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-04-10" +fix_lines = { in_function = 19, in_file = 103, source_total = 157 } + +[[pair.expected]] +cwe = "CWE-95" +class = "code-injection" +path = "packages/codegen-ui-react/lib/react-component-render-helper.ts" +function = "buildBindingExpression" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-hf3j-86p7-mfw8: AWS Amplify Studio UI Component Properties Has an Input Validation Issue" + +[[pair]] +name = "jeecgboot-ispass-ddf0f61" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jeecgboot/jeecgboot" +cve = "CVE-2025-51825 GHSA-gj8w-ffq9-6828" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2025-08-22T15:33:05Z" +post_cutoff = false +commit = "ddf0f61ae59d217b59884921a98a0bc69b143f41" +parent = "4042579167ed2760b43fabc0fc03dc4e9b9ce767" +commit_url = "https://github.com/jeecgboot/jeecgboot/commit/ddf0f61ae59d217b59884921a98a0bc69b143f41" +vendored = false +host = "github" +path = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java" +mode = "name" +relpath = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-27" +fix_lines = { in_function = 10, in_file = 24, source_total = 72 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java" +function = "isPass" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-gj8w-ffq9-6828: JeecgBoot SQL Injection Vulnerability" + +[[pair]] +name = "larecipe-replacelinks-c1d0d56" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "saleem-hadad/larecipe" +cve = "CVE-2025-53833 GHSA-jv7x-xhv2-p5v2" +cwe = "CWE-1336" +ecosystem = "composer" +published_at = "2025-07-14T21:22:01Z" +post_cutoff = false +commit = "c1d0d56889655ce5f2645db5acf0e78d5fc3b36b" +parent = "a5bd62b9ee2c9e15dee97a5cb7026736c8467269" +commit_url = "https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b" +vendored = false +host = "github" +path = "src/Models/Documentation.php" +mode = "name" +relpath = "src/Models/Documentation.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-07-14" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "src/Models/Documentation.php" +function = "replaceLinks" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-jv7x-xhv2-p5v2: LaRecipe is vulnerable to Server-Side Template Injection attacks" + +[[pair]] +name = "sequa-mcp-redirecttoauthorization-e569815" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "sequa-ai/sequa-mcp" +cve = "CVE-2025-10619 GHSA-9pw5-wx67-q964" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2025-09-17T21:30:43Z" +post_cutoff = false +commit = "e569815854166db5f71c2e722408f8957fb9e804" +parent = "aa343a5013d274c88eca48be703531ea8d621195" +commit_url = "https://github.com/sequa-ai/sequa-mcp/commit/e569815854166db5f71c2e722408f8957fb9e804" +vendored = false +host = "github" +path = "src/helpers/node-oauth-client-provider.ts" +mode = "name" +relpath = "src/helpers/node-oauth-client-provider.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-09-09" +fix_lines = { in_function = 6, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "src/helpers/node-oauth-client-provider.ts" +function = "redirectToAuthorization" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-9pw5-wx67-q964: @sequa-ai/sequa-mcp has Command Injection vulnerability" + +[[pair]] +name = "flink-cdc-tableexists-d576618" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/flink-cdc" +cve = "CVE-2025-62228 GHSA-wqm3-w3p6-xjgm" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2025-10-09T15:31:03Z" +post_cutoff = false +commit = "d5766187a9a4b191820e10238d4594ae665cdb89" +parent = "85a79aae2676d571fa952377055edcfafabd973e" +commit_url = "https://github.com/apache/flink-cdc/commit/d5766187a9a4b191820e10238d4594ae665cdb89" +vendored = false +host = "github" +path = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java" +mode = "name" +relpath = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-18" +fix_lines = { in_function = 21, in_file = 51, source_total = 77 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java" +function = "tableExists" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-wqm3-w3p6-xjgm: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers" + +[[pair]] +name = "hive-deletetablecolumnstatistics-c18d0df" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/hive" +cve = "CVE-2025-62728 GHSA-932v-x9x2-vq29" +cwe = "CWE-89" +ecosystem = "maven" +published_at = "2025-11-26T09:31:22Z" +post_cutoff = false +commit = "c18d0df2702130cf5d0f050e516eb8999aa56301" +parent = "770e70c98360ac0b029db46675e0dc5cd0e9040c" +commit_url = "https://github.com/apache/hive/commit/c18d0df2702130cf5d0f050e516eb8999aa56301" +vendored = false +host = "github" +path = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java" +mode = "name" +relpath = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-03" +fix_lines = { in_function = 17, in_file = 32, source_total = 44 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java" +function = "deleteTableColumnStatistics" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-932v-x9x2-vq29: Hive Metastore Server is vulnerable to SQL Injection" + +[[pair]] +name = "mcp-server-kubernetes-execinpod-d091107" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "flux159/mcp-server-kubernetes" +cve = "CVE-2025-66404 GHSA-wvxp-jp4w-w8wg" +cwe = "CWE-77" +ecosystem = "npm" +published_at = "2025-12-03T20:44:45Z" +post_cutoff = false +commit = "d091107ff92d9ffad1b3c295092f142d6578c48b" +parent = "0ab947f41c81a6a553f1c2acd733321d7a35f129" +commit_url = "https://github.com/flux159/mcp-server-kubernetes/commit/d091107ff92d9ffad1b3c295092f142d6578c48b" +vendored = false +host = "github" +path = "src/tools/exec_in_pod.ts" +mode = "name" +relpath = "src/tools/exec_in_pod.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-11-30" +fix_lines = { in_function = 30, in_file = 48, source_total = 65 } + +[[pair.expected]] +cwe = "CWE-77" +class = "command-injection" +path = "src/tools/exec_in_pod.ts" +function = "execInPod" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-wvxp-jp4w-w8wg: mcp-server-kubernetes has potential security issue in exec_in_pod tool" + +[[pair]] +name = "mcp-watch-clonerepo-e7da78c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "kapilduraphe/mcp-watch" +cve = "CVE-2025-66401 GHSA-27m7-ffhq-jqrm" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2025-12-02T00:38:14Z" +post_cutoff = false +commit = "e7da78c5b4b960f8b66c254059ad9ebc544a91a6" +parent = "0fca7228bd313ae5aa938d61311377e88ce6e682" +commit_url = "https://github.com/kapilduraphe/mcp-watch/commit/e7da78c5b4b960f8b66c254059ad9ebc544a91a6" +vendored = false +host = "github" +path = "src/scanner/McpScanner.ts" +mode = "name" +relpath = "src/scanner/McpScanner.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-30" +fix_lines = { in_function = 8, in_file = 9, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/scanner/McpScanner.ts" +function = "cloneRepo" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-27m7-ffhq-jqrm: MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL" + +[[pair]] +name = "elysia-get-26935bf" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "elysiajs/elysia" +cve = "CVE-2025-66457 GHSA-8vch-m3f4-q8jf" +cwe = "CWE-94" +ecosystem = "npm" +published_at = "2025-12-09T17:12:05Z" +post_cutoff = false +commit = "26935bf76ebc43b4a43d48b173fc853de43bb51e" +parent = "94f8528e0e093028868877e215f79f5ca21c519b" +commit_url = "https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e" +vendored = false +host = "github" +path = "src/compose.ts" +mode = "name" +relpath = "src/compose.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-01" +fix_lines = { in_function = 20, in_file = 20, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "src/compose.ts" +function = "get" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8vch-m3f4-q8jf: Elysia affected by arbitrary code injection through cookie config" + +[[pair]] +name = "parsl-workflow-resources-013a928" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "parsl/parsl" +cve = "CVE-2026-21892 GHSA-f2mf-q878-gh58" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-01-06T18:04:21Z" +post_cutoff = false +commit = "013a928461e70f38a33258bd525a351ed828e974" +parent = "2c37ae3e75137095302dac5f9cd3ca956cb51a47" +commit_url = "https://github.com/parsl/parsl/commit/013a928461e70f38a33258bd525a351ed828e974" +vendored = false +host = "github" +path = "parsl/monitoring/visualization/views.py" +mode = "name" +relpath = "parsl/monitoring/visualization/views.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-05" +fix_lines = { in_function = 8, in_file = 8, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "parsl/monitoring/visualization/views.py" +function = "workflow_resources" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-f2mf-q878-gh58: Parsl Monitoring Visualization Vulnerable to SQL Injection" + +[[pair]] +name = "workers-sdk-handler-99b1f32" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "cloudflare/workers-sdk" +cve = "CVE-2026-0933 GHSA-36p8-mvp6-cv38" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2026-01-21T23:00:35Z" +post_cutoff = false +commit = "99b1f328a9afe181b49f1114ed47f15f6d25f0be" +parent = "e98c95aa22938f5ab6c3c1befe91350b9dc2ba0c" +commit_url = "https://github.com/cloudflare/workers-sdk/commit/99b1f328a9afe181b49f1114ed47f15f6d25f0be" +vendored = false +host = "github" +path = "packages/wrangler/src/pages/deploy.ts" +mode = "name" +relpath = "packages/wrangler/src/pages/deploy.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-13" +fix_lines = { in_function = 7, in_file = 7, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "packages/wrangler/src/pages/deploy.ts" +function = "handler" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-36p8-mvp6-cv38: Wrangler affected by OS Command Injection in `wrangler pages deploy`" + +[[pair]] +name = "django-add-filtered-relation-005d60d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "django/django" +cve = "CVE-2026-1312 GHSA-6426-9fv3-65x8" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-02-03T15:30:24Z" +post_cutoff = false +commit = "005d60d97c4dfb117503bdb6f2facfcaf9315d84" +parent = "69065ca869b0970dff8fdd8fafb390bf8b3bf222" +commit_url = "https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84" +vendored = false +host = "github" +path = "django/db/models/sql/query.py" +mode = "name" +relpath = "django/db/models/sql/query.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-03" +fix_lines = { in_function = 5, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "django/db/models/sql/query.py" +function = "add_filtered_relation" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-6426-9fv3-65x8: Django has an SQL Injection issue" + +[[pair]] +name = "webhooks-init-8834499" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "craftcms/webhooks" +cve = "CVE-2026-32261 GHSA-8wg7-wm29-2rvg" +cwe = "CWE-1336" +ecosystem = "composer" +published_at = "2026-03-16T18:11:23Z" +post_cutoff = false +commit = "88344991a68b07145567c46dfd0ae3328c521f62" +parent = "d7904f55b8e53286b620cf7257e8a39d120a61ad" +commit_url = "https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62" +vendored = false +host = "github" +path = "src/Plugin.php" +mode = "name" +relpath = "src/Plugin.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-13" +fix_lines = { in_function = 8, in_file = 4, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "src/Plugin.php" +function = "init" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-8wg7-wm29-2rvg: RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin" + +[[pair]] +name = "git-js-preventuploadpack-1effd8e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "steveukx/git-js" +cve = "CVE-2026-28291 GHSA-jcxm-m3jx-f287" +cwe = "CWE-78" +ecosystem = "npm" +published_at = "2026-04-13T16:35:37Z" +post_cutoff = false +commit = "1effd8e5012a5da05a9776512fac3e39b11f2d2d" +parent = "1402490d14f4125b08f3b2d6c86d3baa0feae6fb" +commit_url = "https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d" +vendored = false +host = "github" +path = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts" +mode = "name" +relpath = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-21" +fix_lines = { in_function = 2, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts" +function = "preventUploadPack" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-jcxm-m3jx-f287: simple-git Affected by Command Execution via Option-Parsing Bypass" + +[[pair]] +name = "ormar-query-aggr-function-a03bae1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "collerek/ormar" +cve = "CVE-2026-26198 GHSA-xxh2-68g9-8jqr" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-02-23T22:12:17Z" +post_cutoff = false +commit = "a03bae14fe01358d3eaf7e319fcd5db2e4956b16" +parent = "ef95d3214daf9ccfd5591ae51d8b2fbe4b66c633" +commit_url = "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16" +vendored = false +host = "github" +path = "ormar/queryset/queryset.py" +mode = "name" +relpath = "ormar/queryset/queryset.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-22" +fix_lines = { in_function = 7, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "ormar/queryset/queryset.py" +function = "_query_aggr_function" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-xxh2-68g9-8jqr: ormar is vulnerable to SQL Injection through aggregate functions min() and max()" + +[[pair]] +name = "intake-expand-defaults-d0c0b6b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-2-Clause" +repo = "intake/intake" +cve = "CVE-2026-33310 GHSA-37g4-qqqv-7m99" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-03-19T17:46:54Z" +post_cutoff = false +commit = "d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b" +parent = "67e0303735a60cf0f261e34c68139d0d3aa48c87" +commit_url = "https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b" +vendored = false +host = "github" +path = "intake/catalog/utils.py" +mode = "name" +relpath = "intake/catalog/utils.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-09" +fix_lines = { in_function = 4, in_file = 8, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "intake/catalog/utils.py" +function = "expand_defaults" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-37g4-qqqv-7m99: Intake has a Command Injection via shell() Expansion in Parameter Defaults" + +[[pair]] +name = "openhands-get-git-diff-698cfc2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "openhands/openhands" +cve = "CVE-2026-33718 GHSA-7h8w-hj9j-8rjw" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-03-25T21:54:55Z" +post_cutoff = false +commit = "698cfc2520cdc50eac5fa869c6c1ba5c8fee9e13" +parent = "83561701939fe70577e74c4aeb5acd2f7f8f7da3" +commit_url = "https://github.com/openhands/openhands/commit/698cfc2520cdc50eac5fa869c6c1ba5c8fee9e13" +vendored = false +host = "github" +path = "openhands/runtime/utils/git_diff.py" +mode = "name" +relpath = "openhands/runtime/utils/git_diff.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-09" +fix_lines = { in_function = 18, in_file = 17, source_total = 35 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "openhands/runtime/utils/git_diff.py" +function = "get_git_diff" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-7h8w-hj9j-8rjw: OpenHands is Vulnerable to Command Injection through its Git Diff Handler" + +[[pair]] +name = "scitokens-getkeyinfo-3dba108" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "scitokens/scitokens" +cve = "CVE-2026-32714 GHSA-rh5m-2482-966c" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-03-31T22:49:15Z" +post_cutoff = false +commit = "3dba108853f2f4a6c0f2325c03779bf083c41cf2" +parent = "66b075c35da18f8364276553513a53c596b4b8e3" +commit_url = "https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2" +vendored = false +host = "github" +path = "src/scitokens/utils/keycache.py" +mode = "name" +relpath = "src/scitokens/utils/keycache.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-13" +fix_lines = { in_function = 12, in_file = 18, source_total = 31 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "src/scitokens/utils/keycache.py" +function = "getkeyinfo" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-rh5m-2482-966c: SciTokens is vulnerable to SQL Injection in KeyCache" + +[[pair]] +name = "langchain-get-template-variables-6bab0ba" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "langchain-ai/langchain" +cve = "CVE-2026-40087 GHSA-926x-3r5x-gfhw" +cwe = "CWE-1336" +ecosystem = "pip" +published_at = "2026-04-08T21:51:32Z" +post_cutoff = false +commit = "6bab0ba3c12328008ddca3e0d54ff5a6151cd27b" +parent = "4fe869f1c336e1df9fe3a6bd37f39a4d354a8608" +commit_url = "https://github.com/langchain-ai/langchain/commit/6bab0ba3c12328008ddca3e0d54ff5a6151cd27b" +vendored = false +host = "github" +path = "libs/core/langchain_core/prompts/string.py" +mode = "name" +relpath = "libs/core/langchain_core/prompts/string.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-08" +fix_lines = { in_function = 23, in_file = 71, source_total = 95 } + +[[pair.expected]] +cwe = "CWE-1336" +class = "template-injection" +path = "libs/core/langchain_core/prompts/string.py" +function = "get_template_variables" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-926x-3r5x-gfhw: LangChain has incomplete f-string validation in prompt templates" + +[[pair]] +name = "math-codegen-interpreter-4bb52d3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mauriciopoppe/math-codegen" +cve = "CVE-2026-41507 GHSA-p6x5-p4xf-cc4r" +cwe = "CWE-94" +ecosystem = "npm" +published_at = "2026-04-17T22:31:45Z" +post_cutoff = false +commit = "4bb52d3030683362b3559ee8dd91350555a05f6b" +parent = "abfc95c214245b06f3ceb2583393b003d1cd13eb" +commit_url = "https://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b" +vendored = false +host = "github" +path = "lib/Interpreter.js" +mode = "name" +relpath = "lib/Interpreter.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-09" +fix_lines = { in_function = 4, in_file = 5, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "lib/Interpreter.js" +function = "Interpreter" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-p6x5-p4xf-cc4r: Remote Code Execution (RCE) via String Literal Injection into math-codegen" + +[[pair]] +name = "amazon-redshift-python-driver-vector-in-69a69df" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/amazon-redshift-python-driver" +cve = "CVE-2026-8838 GHSA-29h4-r29x-hchv" +cwe = "CWE-94" +ecosystem = "pip" +published_at = "2026-05-29T19:32:28Z" +post_cutoff = false +commit = "69a69dfdead75918e20384da52bcd760ded8dbca" +parent = "2c1dd5b9aca1945a1b8e01b2359075d9e8b0e77c" +commit_url = "https://github.com/aws/amazon-redshift-python-driver/commit/69a69dfdead75918e20384da52bcd760ded8dbca" +vendored = false +host = "github" +path = "redshift_connector/utils/type_utils.py" +mode = "name" +relpath = "redshift_connector/utils/type_utils.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-18" +fix_lines = { in_function = 5, in_file = 24, source_total = 25 } + +[[pair.expected]] +cwe = "CWE-94" +class = "code-injection" +path = "redshift_connector/utils/type_utils.py" +function = "vector_in" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-29h4-r29x-hchv: amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection" + +[[pair]] +name = "yt-dlp-prepare-outtmpl-5faffa9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Unlicense" +repo = "yt-dlp/yt-dlp" +cve = "GHSA-69qj-pvh9-c5wg" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-06-16T22:29:14Z" +post_cutoff = true +commit = "5faffa999fd33b373d47773e8ee639d072accec2" +parent = "7aac95eae663be82cffeaf2a8c1193a5e349e401" +commit_url = "https://github.com/yt-dlp/yt-dlp/commit/5faffa999fd33b373d47773e8ee639d072accec2" +vendored = false +host = "github" +path = "yt_dlp/YoutubeDL.py" +mode = "name" +relpath = "yt_dlp/YoutubeDL.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-06-06" +fix_lines = { in_function = 10, in_file = 22, source_total = 53 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "yt_dlp/YoutubeDL.py" +function = "prepare_outtmpl" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-69qj-pvh9-c5wg: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp" + +[[pair]] +name = "wsgidav-exists-record-by-primary-key-6f35776" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "mar10/wsgidav" +cve = "CVE-2026-55509 GHSA-p6gw-4frg-j7jw" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-08-28T18:12:17Z" +post_cutoff = true +commit = "6f35776c9188f130ab044ce557015d51aaa83500" +parent = "67abdbd7d622fcf29aefdfbd0c9910de9e0c8b3d" +commit_url = "https://github.com/mar10/wsgidav/commit/6f35776c9188f130ab044ce557015d51aaa83500" +vendored = false +host = "github" +path = "wsgidav/samples/mysql_dav_provider.py" +mode = "name" +relpath = "wsgidav/samples/mysql_dav_provider.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-06-27" +fix_lines = { in_function = 40, in_file = 112, source_total = 140 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "wsgidav/samples/mysql_dav_provider.py" +function = "_exists_record_by_primary_key" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-p6gw-4frg-j7jw: WsgiDAV MySQL provider has a blind SQL injection" + +[[pair]] +name = "dynatrace-mcp-generatedqlsearchentitycommand-15d3546" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "dynatrace-oss/dynatrace-mcp" +cve = "GHSA-pqh8-p93p-2rx7" +cwe = "CWE-943" +ecosystem = "npm" +published_at = "2026-07-31T15:56:12Z" +post_cutoff = true +commit = "15d3546c0618ffbaeaeca477337e08e92f2151bc" +parent = "35db4695ce24f19d5326edee5a86e9ba39e13f69" +commit_url = "https://github.com/dynatrace-oss/dynatrace-mcp/commit/15d3546c0618ffbaeaeca477337e08e92f2151bc" +vendored = false +host = "github" +path = "src/capabilities/find-monitored-entity-by-name.ts" +mode = "name" +relpath = "src/capabilities/find-monitored-entity-by-name.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-07-14" +fix_lines = { in_function = 3, in_file = 6, source_total = 82 } + +[[pair.expected]] +cwe = "CWE-943" +class = "query-injection" +path = "src/capabilities/find-monitored-entity-by-name.ts" +function = "generateDqlSearchEntityCommand" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-pqh8-p93p-2rx7: @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL" + +[[pair]] +name = "agno-delete-by-metadata-6780513" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "agno-agi/agno" +cve = "CVE-2026-10105 GHSA-82m5-3pcp-hccq" +cwe = "CWE-89" +ecosystem = "pip" +published_at = "2026-05-29T18:31:34Z" +post_cutoff = false +commit = "678051366f14fe21de347b58a400bd707d5bebea" +parent = "f2fdceeb735f68bf750aae9b4bc4de9ebde7e0fa" +commit_url = "https://github.com/agno-agi/agno/commit/678051366f14fe21de347b58a400bd707d5bebea" +vendored = false +host = "github" +path = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py" +mode = "name" +relpath = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-07-27" +fix_lines = { in_function = 20, in_file = 21, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-89" +class = "sqli" +path = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py" +function = "delete_by_metadata" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-82m5-3pcp-hccq: agno contains a SQL injection vulnerability" + +[[pair]] +name = "virtualenv-quote-d721ff1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pypa/virtualenv" +cve = "CVE-2026-102937 GHSA-x78j-v8h9-3j2q" +cwe = "CWE-78" +ecosystem = "pip" +published_at = "2026-10-01T15:08:29Z" +post_cutoff = true +commit = "d721ff140ce4afdc2a9b76751e4584e25d9fbea6" +parent = "087a2ef8bd3aa15b562a3558b1068f603e50f77a" +commit_url = "https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6" +vendored = false +host = "github" +path = "src/virtualenv/activation/batch/__init__.py" +mode = "name" +relpath = "src/virtualenv/activation/batch/__init__.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-09-18" +fix_lines = { in_function = 10, in_file = 63, source_total = 127 } + +[[pair.expected]] +cwe = "CWE-78" +class = "command-injection" +path = "src/virtualenv/activation/batch/__init__.py" +function = "quote" +mechanism = "source_reaches_sink" +family = "injection" +evidence = "GHSA-x78j-v8h9-3j2q: virtualenv: Command injection via --prompt in activate.bat (batch activator)" + +[[pair]] +name = "zend-form-createattributesstring-6fe4031" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "zendframework/zend-form" +cve = "GHSA-gvpp-6jrj-5pqc" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-06-07T21:58:34Z" +post_cutoff = false +commit = "6fe40314e8e3477494aadd03d62573bd1c212bd1" +parent = "6afef49dae54bf68330825f6f6f3463a7bb992e9" +commit_url = "https://github.com/zendframework/zend-form/commit/6fe40314e8e3477494aadd03d62573bd1c212bd1" +vendored = false +host = "github" +path = "src/View/Helper/AbstractHelper.php" +mode = "name" +relpath = "src/View/Helper/AbstractHelper.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2014-04-15" +fix_lines = { in_function = 7, in_file = 8, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/View/Helper/AbstractHelper.php" +function = "createAttributesString" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-gvpp-6jrj-5pqc: Zend-Form vulnerable to Cross-site Scripting" + +[[pair]] +name = "zendframework-htmlattribs-1dd4f8c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "zendframework/zendframework" +cve = "GHSA-8q77-cv62-jj38" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-06-07T20:04:04Z" +post_cutoff = false +commit = "1dd4f8cede07469390eef1e629f808349fa1b5ea" +parent = "692a9d1f8f0d6b30bfd848241febd9d5e180d93a" +commit_url = "https://github.com/zendframework/zendframework/commit/1dd4f8cede07469390eef1e629f808349fa1b5ea" +vendored = false +host = "github" +path = "library/Zend/View/Helper/AbstractHtmlElement.php" +mode = "name" +relpath = "library/Zend/View/Helper/AbstractHtmlElement.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2014-04-15" +fix_lines = { in_function = 8, in_file = 11, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "library/Zend/View/Helper/AbstractHtmlElement.php" +function = "htmlAttribs" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8q77-cv62-jj38: Zendframework has potential Cross-site Scripting vector in multiple view helpers" + +[[pair]] +name = "scnsocialauth-invoke-4a00966" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "socalnick/scnsocialauth" +cve = "GHSA-g6f5-4w43-2x63" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-05-29T13:04:32Z" +post_cutoff = false +commit = "4a00966c41bc37251586d007564c5c891eba3700" +parent = "d255c32fe80c30bf936164736e6e7c1bf72773cf" +commit_url = "https://github.com/socalnick/scnsocialauth/commit/4a00966c41bc37251586d007564c5c891eba3700" +vendored = false +host = "github" +path = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php" +mode = "name" +relpath = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2015-01-16" +fix_lines = { in_function = 17, in_file = 15, source_total = 20 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php" +function = "__invoke" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-g6f5-4w43-2x63: ScnSocialAuth Cross-site Scripting vulnerability in login redirect param" + +[[pair]] +name = "ldapcherry-check-auth-6f98076" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "kakwa/ldapcherry" +cve = "CVE-2019-25095 GHSA-vq8w-x8v7-f88m" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2023-01-05T09:30:28Z" +post_cutoff = false +commit = "6f98076281e9452fdb1adcd1bcbb70a6f968ade9" +parent = "1ed654c91bf2caeedbad34944bf837b6c21a2292" +commit_url = "https://github.com/kakwa/ldapcherry/commit/6f98076281e9452fdb1adcd1bcbb70a6f968ade9" +vendored = false +host = "github" +path = "ldapcherry/__init__.py" +mode = "name" +relpath = "ldapcherry/__init__.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2019-01-02" +fix_lines = { in_function = 10, in_file = 12, source_total = 23 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "ldapcherry/__init__.py" +function = "_check_auth" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vq8w-x8v7-f88m: LdapCherry Cross-site Scripting vulnerbaility" + +[[pair]] +name = "framework-attributestostring-ae4d790" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "laravel/framework" +cve = "GHSA-vr95-p7q6-8m9q" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-05-15T22:16:06Z" +post_cutoff = false +commit = "ae4d790e99f3b743bc49984d37c9ca70adc62cd7" +parent = "bd67cc22af6fbc1f5745b0e3ce79e0a12b092048" +commit_url = "https://github.com/laravel/framework/commit/ae4d790e99f3b743bc49984d37c9ca70adc62cd7" +vendored = false +host = "github" +path = "src/Illuminate/View/Compilers/ComponentTagCompiler.php" +mode = "name" +relpath = "src/Illuminate/View/Compilers/ComponentTagCompiler.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2020-03-13" +fix_lines = { in_function = 6, in_file = 21, source_total = 40 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Illuminate/View/Compilers/ComponentTagCompiler.php" +function = "attributesToString" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vr95-p7q6-8m9q: Laravel Cross-site Scripting (XSS) vulnerability in blade templating" + +[[pair]] +name = "vditor-fixfirefoxarrowuptable-1b2382d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "vanessa219/vditor" +cve = "CVE-2021-32855 GHSA-vfmp-9999-6wqj" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-21T15:30:23Z" +post_cutoff = false +commit = "1b2382d7f8a4ee509d9245db4450d926a0b24146" +parent = "30891f9bac9d0c3571fd16c58065a14c7f0bc90c" +commit_url = "https://github.com/vanessa219/vditor/commit/1b2382d7f8a4ee509d9245db4450d926a0b24146" +vendored = false +host = "github" +path = "src/ts/util/fixBrowserBehavior.ts" +mode = "name" +relpath = "src/ts/util/fixBrowserBehavior.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2021-09-21" +fix_lines = { in_function = 1, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/ts/util/fixBrowserBehavior.ts" +function = "fixFirefoxArrowUpTable" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vfmp-9999-6wqj: Vditor Cross-site Scripting vulnerability" + +[[pair]] +name = "jquery-minicolors-init-ef13482" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "claviska/jquery-minicolors" +cve = "CVE-2021-32850 GHSA-crh5-vv2v-c82q" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-21T00:30:20Z" +post_cutoff = false +commit = "ef134824a7f4110ada53ea6c173111a4fa2f48f3" +parent = "707b80383c192250772386e7f590abc0835cd510" +commit_url = "https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3" +vendored = false +host = "github" +path = "jquery.minicolors.js" +mode = "name" +relpath = "jquery.minicolors.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2021-11-24" +fix_lines = { in_function = 3, in_file = 2, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "jquery.minicolors.js" +function = "init" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-crh5-vv2v-c82q: @claviska/jquery-minicolors vulnerable to Cross-site Scripting" + +[[pair]] +name = "mind-elixir-core-creatediv-0734852" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "ssshooter/mind-elixir-core" +cve = "CVE-2021-32851 GHSA-m22q-97p5-79v2" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-21T00:30:20Z" +post_cutoff = false +commit = "073485269ac83af24371f35bd08507defa885655" +parent = "6d5c5c66d583d9b486b03c4b56e026c6fdd1d69b" +commit_url = "https://github.com/ssshooter/mind-elixir-core/commit/073485269ac83af24371f35bd08507defa885655" +vendored = false +host = "github" +path = "src/plugin/nodeMenu.ts" +mode = "name" +relpath = "src/plugin/nodeMenu.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2021-11-25" +fix_lines = { in_function = 15, in_file = 11, source_total = 42 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/plugin/nodeMenu.ts" +function = "createDiv" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-m22q-97p5-79v2: Mind-elixir Cross-site Scripting vulnerability" + +[[pair]] +name = "eslint-detailed-reporter-renderissue-505c190" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mportuga/eslint-detailed-reporter" +cve = "CVE-2022-4942 GHSA-4xr4-89m5-46c7" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-04-20T06:30:17Z" +post_cutoff = false +commit = "505c190efd4905990db6207863bdcbd9b1d7e1bd" +parent = "f19967fb85454b3ded7e89cd27b0826a40f45283" +commit_url = "https://github.com/mportuga/eslint-detailed-reporter/commit/505c190efd4905990db6207863bdcbd9b1d7e1bd" +vendored = false +host = "github" +path = "lib/template-generator.js" +mode = "name" +relpath = "lib/template-generator.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2022-06-02" +fix_lines = { in_function = 2, in_file = 12, source_total = 15 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "lib/template-generator.js" +function = "renderIssue" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-4xr4-89m5-46c7: eslint-detailed-reporter vulnerable to cross-site scripting" + +[[pair]] +name = "sanitize-url-decodehtmlcharacters-d4bdc89" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "braintree/sanitize-url" +cve = "CVE-2022-48345 GHSA-q8gg-vj6m-hgmj" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-02-24T06:30:16Z" +post_cutoff = false +commit = "d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c" +parent = "b70161daebd9523590fc6feda017d0489a8f6002" +commit_url = "https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c" +vendored = false +host = "github" +path = "src/index.ts" +mode = "name" +relpath = "src/index.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-10-20" +fix_lines = { in_function = 1, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/index.ts" +function = "decodeHtmlCharacters" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-q8gg-vj6m-hgmj: @braintree/sanitize-url Cross-site Scripting vulnerability" + +[[pair]] +name = "modoboa-identities-eef9ab7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "ISC" +repo = "modoboa/modoboa" +cve = "CVE-2023-0519 GHSA-jm3m-wr3p-hjrq" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2023-01-27T00:30:18Z" +post_cutoff = false +commit = "eef9ab72b5305578a3ad7a7463bd284aa645e98b" +parent = "718ee4370701c715a62edab3b206ed1b469f73d4" +commit_url = "https://github.com/modoboa/modoboa/commit/eef9ab72b5305578a3ad7a7463bd284aa645e98b" +vendored = false +host = "github" +path = "modoboa/admin/static/admin/js/admin.js" +mode = "name" +relpath = "modoboa/admin/static/admin/js/admin.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-01-26" +fix_lines = { in_function = 2, in_file = 1, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "modoboa/admin/static/admin/js/admin.js" +function = "Identities" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-jm3m-wr3p-hjrq: Cross-site Scripting in modoboa" + +[[pair]] +name = "jquery-validation-delegate-7a490d8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "jquery-validation/jquery-validation" +cve = "CVE-2025-3573 GHSA-rrj2-ph5q-jxw2" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-04-15T06:30:34Z" +post_cutoff = false +commit = "7a490d8f39bd988027568ddcf51755e1f4688902" +parent = "cfe74a19b671b0983b3b13dbf959619cfe926de9" +commit_url = "https://github.com/jquery-validation/jquery-validation/commit/7a490d8f39bd988027568ddcf51755e1f4688902" +vendored = false +host = "github" +path = "src/core.js" +mode = "name" +relpath = "src/core.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-02-01" +fix_lines = { in_function = 14, in_file = 12, source_total = 15 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/core.js" +function = "delegate" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-rrj2-ph5q-jxw2: jquery-validation vulnerable to Cross-site Scripting" + +[[pair]] +name = "email-ext-plugin-rendertemplate-7b2bd25" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/email-ext-plugin" +cve = "CVE-2023-25764 GHSA-p2fr-mq9m-6w6p" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2023-02-15T15:30:41Z" +post_cutoff = false +commit = "7b2bd251aa0193d009d85b713362d965dab262d0" +parent = "f715c42d186f363f64b64a6a6ed76ed241e702c9" +commit_url = "https://github.com/jenkinsci/email-ext-plugin/commit/7b2bd251aa0193d009d85b713362d965dab262d0" +vendored = false +host = "github" +path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java" +mode = "name" +relpath = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-02-08" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/main/java/hudson/plugins/emailext/EmailExtTemplateAction.java" +function = "renderTemplate" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-p2fr-mq9m-6w6p: Cross-site Scripting in Jenkins Email Extension Plugin" + +[[pair]] +name = "archiva-checkparamchars-d62e81c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/archiva" +cve = "CVE-2023-28158 GHSA-qf34-f43r-gv9p" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2023-03-29T15:30:17Z" +post_cutoff = false +commit = "d62e81c7e75f617cf01d2a75952a2c857758f8c4" +parent = "4d93c1f457e3a285e84a46f25fceee1c0d2bd615" +commit_url = "https://github.com/apache/archiva/commit/d62e81c7e75f617cf01d2a75952a2c857758f8c4" +vendored = false +host = "github" +path = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java" +mode = "name" +relpath = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-03-14" +fix_lines = { in_function = 10, in_file = 19, source_total = 29 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java" +function = "checkParamChars" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-qf34-f43r-gv9p: Apache Archiva vulnerable to privilege escalation via stored cross-site scripting (XSS)" + +[[pair]] +name = "silverstripe-form-capture-details-5b3aa39" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "bigfork/silverstripe-form-capture" +cve = "CVE-2023-28851 GHSA-38h6-gmr2-j4wx" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2023-04-03T21:06:31Z" +post_cutoff = false +commit = "5b3aa39dd1eef042f173167b0fa4d3f717971772" +parent = "9da789e26e38cac8f09d20fca7b36f7b3678a28c" +commit_url = "https://github.com/bigfork/silverstripe-form-capture/commit/5b3aa39dd1eef042f173167b0fa4d3f717971772" +vendored = false +host = "github" +path = "src/Model/CapturedFormSubmission.php" +mode = "name" +relpath = "src/Model/CapturedFormSubmission.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-03-31" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Model/CapturedFormSubmission.php" +function = "Details" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-38h6-gmr2-j4wx: Silverstripe Form Capture vulnerable to stored cross-site-scripting" + +[[pair]] +name = "whatsapp-chat-exporter-create-html-bfdc68c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "knugihk/whatsapp-chat-exporter" +cve = "GHSA-8c6x-g4fw-8rf4" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2023-07-10T21:54:36Z" +post_cutoff = false +commit = "bfdc68cd6ad53ceecf132773f9aaba50dd80fe79" +parent = "594a04adbcfbf7b4e6185348fd77cb7ae77f4452" +commit_url = "https://github.com/knugihk/whatsapp-chat-exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79" +vendored = false +host = "github" +path = "Whatsapp_Chat_Exporter/extract.py" +mode = "name" +relpath = "Whatsapp_Chat_Exporter/extract.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-15" +fix_lines = { in_function = 2, in_file = 1, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "Whatsapp_Chat_Exporter/extract.py" +function = "create_html" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8c6x-g4fw-8rf4: Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats." + +[[pair]] +name = "ckeditor-wordcount-plugin-strip-0f03b3e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "w8tcha/ckeditor-wordcount-plugin" +cve = "CVE-2023-37905 GHSA-q9w4-w667-qqj4" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-07-10T21:54:03Z" +post_cutoff = false +commit = "0f03b3e5b7c1409998a13aba3a95396e6fa349d8" +parent = "d5a876dcb3093539f1b0a3270b640cf93fe78cf0" +commit_url = "https://github.com/w8tcha/ckeditor-wordcount-plugin/commit/0f03b3e5b7c1409998a13aba3a95396e6fa349d8" +vendored = false +host = "github" +path = "wordcount/plugin.js" +mode = "name" +relpath = "wordcount/plugin.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-07-08" +fix_lines = { in_function = 5, in_file = 5, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "wordcount/plugin.js" +function = "strip" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-q9w4-w667-qqj4: ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor" + +[[pair]] +name = "critters-createdocument-7757902" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "googlechromelabs/critters" +cve = "CVE-2023-3481 GHSA-cx3j-qqxj-9597" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2023-08-11T18:57:53Z" +post_cutoff = false +commit = "7757902c9e0b3285d516359b3cb602cd9d50d80e" +parent = "c663a2431a9956d7f7c2be2554f4c0d82f32999a" +commit_url = "https://github.com/googlechromelabs/critters/commit/7757902c9e0b3285d516359b3cb602cd9d50d80e" +vendored = false +host = "github" +path = "packages/critters/src/dom.js" +mode = "name" +relpath = "packages/critters/src/dom.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-08-04" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/critters/src/dom.js" +function = "createDocument" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-cx3j-qqxj-9597: Critters Cross-site Scripting Vulnerability" + +[[pair]] +name = "mjml-python-parse-84c495d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "felixschwarz/mjml-python" +cve = "CVE-2024-26151 GHSA-578p-fxmm-6229" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2024-02-22T21:40:59Z" +post_cutoff = false +commit = "84c495da20a91640a1ca551ace17df7f3be644aa" +parent = "3308bbae0d36b048f89eb5057d2c2a6a87e868da" +commit_url = "https://github.com/felixschwarz/mjml-python/commit/84c495da20a91640a1ca551ace17df7f3be644aa" +vendored = false +host = "github" +path = "mjml/mjml2html.py" +mode = "name" +relpath = "mjml/mjml2html.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-11-17" +fix_lines = { in_function = 2, in_file = 3, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "mjml/mjml2html.py" +function = "parse" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-578p-fxmm-6229: Potentially untrusted input is rendered as HTML in final output" + +[[pair]] +name = "apollo-client-nextjs-transportdatatojs-b92bc42" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "apollographql/apollo-client-nextjs" +cve = "CVE-2024-23841 GHSA-rv8p-rr2h-fgpg" +cwe = "CWE-80" +ecosystem = "npm" +published_at = "2024-01-30T20:57:45Z" +post_cutoff = false +commit = "b92bc42abd5f8e17d4db361c36bd08e4f541a46b" +parent = "4271a8c1d06ba089b5de4da59ff8258f7528ede3" +commit_url = "https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b" +vendored = false +host = "github" +path = "package/src/ssr/dataTransport.ts" +mode = "name" +relpath = "package/src/ssr/dataTransport.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-01-30" +fix_lines = { in_function = 4, in_file = 3, source_total = 29 } + +[[pair.expected]] +cwe = "CWE-80" +class = "xss" +path = "package/src/ssr/dataTransport.ts" +function = "transportDataToJS" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-rv8p-rr2h-fgpg: @apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability" + +[[pair]] +name = "urql-transportdatatojs-4b7011b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "urql-graphql/urql" +cve = "CVE-2024-24556 GHSA-qhjf-hm5j-335w" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-01-30T20:57:28Z" +post_cutoff = false +commit = "4b7011b70d5718728ff912d02a4dbdc7f703540d" +parent = "b4c46f2dd8eb43186ac21861a5ce6df958463479" +commit_url = "https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d" +vendored = false +host = "github" +path = "packages/next-urql/src/DataHydrationContext.ts" +mode = "name" +relpath = "packages/next-urql/src/DataHydrationContext.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-01-30" +fix_lines = { in_function = 2, in_file = 2, source_total = 27 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/next-urql/src/DataHydrationContext.ts" +function = "transportDataToJS" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-qhjf-hm5j-335w: @urql/next Cross-site Scripting vulnerability" + +[[pair]] +name = "dependency-check-plugin-transform-b3b286a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jenkinsci/dependency-check-plugin" +cve = "CVE-2024-28153 GHSA-9pp4-mx6x-xh36" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2024-03-06T18:30:38Z" +post_cutoff = false +commit = "b3b286a9615603f0294eb740193d153d843fae3a" +parent = "20f4e50e9576b8a08d6b71782334a31c961d684b" +commit_url = "https://github.com/jenkinsci/dependency-check-plugin/commit/b3b286a9615603f0294eb740193d153d843fae3a" +vendored = false +host = "github" +path = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java" +mode = "name" +relpath = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-02-05" +fix_lines = { in_function = 32, in_file = 65, source_total = 86 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java" +function = "transform" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9pp4-mx6x-xh36: Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability" + +[[pair]] +name = "send-sendstream-ae4f298" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "pillarjs/send" +cve = "CVE-2024-43799 GHSA-m6fv-jmcg-4jfg" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-09-10T19:42:41Z" +post_cutoff = false +commit = "ae4f2989491b392ae2ef3b0015a019770ae65d35" +parent = "b69cbb3dc4c09c37917d08a4c13fcd1bac97ade5" +commit_url = "https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-09-10" +fix_lines = { in_function = 3, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "index.js" +function = "SendStream" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-m6fv-jmcg-4jfg: send vulnerable to template injection that can lead to XSS" + +[[pair]] +name = "serve-static-createredirectdirectorylistener-0c11fad" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "expressjs/serve-static" +cve = "CVE-2024-43800 GHSA-cm22-4g7w-348p" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-09-10T19:42:33Z" +post_cutoff = false +commit = "0c11fad159898cdc69fd9ab63269b72468ecaf6b" +parent = "9b5a12a76f4d70530d2d2a8c7742e9158ed3c0a4" +commit_url = "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-09-10" +fix_lines = { in_function = 3, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "index.js" +function = "createRedirectDirectoryListener" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-cm22-4g7w-348p: serve-static vulnerable to template injection that can lead to XSS" + +[[pair]] +name = "layui-getpath-f756b41" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "layui/layui" +cve = "CVE-2024-47075 GHSA-j827-6rgf-9629" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-09-26T17:54:24Z" +post_cutoff = false +commit = "f756b41d63bf3d488a2cb042918638c9851bf2b0" +parent = "5e707cec12b4a52dfb2057b662e8bf4edd3693f3" +commit_url = "https://github.com/layui/layui/commit/f756b41d63bf3d488a2cb042918638c9851bf2b0" +vendored = false +host = "github" +path = "src/layui.js" +mode = "name" +relpath = "src/layui.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-09-23" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/layui.js" +function = "getPath" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-j827-6rgf-9629: Layui has DOM Clobbering gadgets that leads to Cross-site Scripting" + +[[pair]] +name = "vue-i18n-ismessageast-72f0d32" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "intlify/vue-i18n" +cve = "CVE-2024-52809 GHSA-9r9m-ffp6-9x4v" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2024-12-02T17:26:20Z" +post_cutoff = false +commit = "72f0d323006fc7363b18cab62d4522dadd874411" +parent = "554cc24818179588f77a6d92071ad91b24fd46a3" +commit_url = "https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411" +vendored = false +host = "github" +path = "packages/core-base/src/compilation.ts" +mode = "name" +relpath = "packages/core-base/src/compilation.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-11-28" +fix_lines = { in_function = 9, in_file = 17, source_total = 201 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/core-base/src/compilation.ts" +function = "isMessageAST" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9r9m-ffp6-9x4v: vue-i18n has cross-site scripting vulnerability with prototype pollution" + +[[pair]] +name = "simplexlsx-readthemecolors-71a5e3d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "shuchkin/simplexlsx" +cve = "CVE-2024-56364 GHSA-r87q-fj25-f8jf" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2024-12-23T18:18:54Z" +post_cutoff = false +commit = "71a5e3d40d14e33161f8a40b3fd02de542218ef0" +parent = "0044a4c917037f7613bcd81c7766339a35b9832a" +commit_url = "https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0" +vendored = false +host = "github" +path = "src/SimpleXLSXEx.php" +mode = "name" +relpath = "src/SimpleXLSXEx.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-12-21" +fix_lines = { in_function = 8, in_file = 5, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/SimpleXLSXEx.php" +function = "readThemeColors" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-r87q-fj25-f8jf: Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx" + +[[pair]] +name = "dom-expressions-replace-521f75d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ryansolid/dom-expressions" +cve = "CVE-2025-27108 GHSA-hw62-58pr-7wc5" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-02-25T17:49:57Z" +post_cutoff = false +commit = "521f75dfa89ed24161646e7007d9d7d21da07767" +parent = "828f9e9cef5e0482d904ae4f6ec1069dba378a44" +commit_url = "https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767" +vendored = false +host = "github" +path = "packages/dom-expressions/src/server.js" +mode = "name" +relpath = "packages/dom-expressions/src/server.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-01-07" +fix_lines = { in_function = 5, in_file = 8, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/dom-expressions/src/server.js" +function = "replace" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-hw62-58pr-7wc5: DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace" + +[[pair]] +name = "jte-javascriptblock-a6fb00d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "casid/jte" +cve = "CVE-2025-23026 GHSA-vh22-6c6h-rm8q" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-01-13T16:57:59Z" +post_cutoff = false +commit = "a6fb00d53c7b8dbb86de933215dbe1b9191a57f1" +parent = "0c7d4ad7a135d169b2db85062d827279e6d86aaf" +commit_url = "https://github.com/casid/jte/commit/a6fb00d53c7b8dbb86de933215dbe1b9191a57f1" +vendored = false +host = "github" +path = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java" +mode = "name" +relpath = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-01-13" +fix_lines = { in_function = 2, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java" +function = "javaScriptBlock" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vh22-6c6h-rm8q: jte's HTML templates containing Javascript template strings are subject to XSS" + +[[pair]] +name = "felix-dev-rendercontent-87513ea" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/felix-dev" +cve = "CVE-2025-25247 GHSA-4c37-7m5h-c8m9" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-02-10T12:30:45Z" +post_cutoff = false +commit = "87513ea3533fdb79d9e2b251410bf2bfbd63941e" +parent = "c9df37190eddd3a8af4262956436880a3acb8c90" +commit_url = "https://github.com/apache/felix-dev/commit/87513ea3533fdb79d9e2b251410bf2bfbd63941e" +vendored = false +host = "github" +path = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java" +mode = "name" +relpath = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-02" +fix_lines = { in_function = 2, in_file = 3, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java" +function = "renderContent" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-4c37-7m5h-c8m9: Apache Felix Webconsole: XSS in services console" + +[[pair]] +name = "label-studio-upload-example-using-config-8cf6958" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "humansignal/label-studio" +cve = "CVE-2025-25296 GHSA-wpq5-3366-mqw4" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-02-14T15:23:03Z" +post_cutoff = false +commit = "8cf6958e1e27ef6a03ed287e674470975d340885" +parent = "54f454e3abfe919b3016f369582da6aff1440aea" +commit_url = "https://github.com/humansignal/label-studio/commit/8cf6958e1e27ef6a03ed287e674470975d340885" +vendored = false +host = "github" +path = "label_studio/projects/views.py" +mode = "name" +relpath = "label_studio/projects/views.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-04" +fix_lines = { in_function = 4, in_file = 4, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "label_studio/projects/views.py" +function = "upload_example_using_config" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-wpq5-3366-mqw4: Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint" + +[[pair]] +name = "vega-replace-694560c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "vega/vega" +cve = "CVE-2025-27793 GHSA-963h-3v39-3pqf" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-03-27T18:00:24Z" +post_cutoff = false +commit = "694560c0aa576df8b6c5f0f7d202ac82233e6966" +parent = "560aeecbbe99edb3022071fbe8c756d04f2e57bc" +commit_url = "https://github.com/vega/vega/commit/694560c0aa576df8b6c5f0f7d202ac82233e6966" +vendored = false +host = "github" +path = "packages/vega-functions/src/functions/sequence.js" +mode = "name" +relpath = "packages/vega-functions/src/functions/sequence.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-14" +fix_lines = { in_function = 1, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/vega-functions/src/functions/sequence.js" +function = "replace" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-963h-3v39-3pqf: Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]" + +[[pair]] +name = "htmlsanitizer-makesanitizedcopy-af6d2a7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "jitbit/htmlsanitizer" +cve = "CVE-2025-29771 GHSA-vhv4-fh94-jm5x" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-03-14T19:54:52Z" +post_cutoff = false +commit = "af6d2a78877e7277cd01c825b7fb50edb5956963" +parent = "79975a1defa648f40625100cf68462d74d6d5ec7" +commit_url = "https://github.com/jitbit/htmlsanitizer/commit/af6d2a78877e7277cd01c825b7fb50edb5956963" +vendored = false +host = "github" +path = "HtmlSanitizer.js" +mode = "name" +relpath = "HtmlSanitizer.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-03-12" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "HtmlSanitizer.js" +function = "makeSanitizedCopy" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vhv4-fh94-jm5x: JS Html Sanitizer allows XSS when used with contentEditable" + +[[pair]] +name = "jsondiffpatch-typeformatttererrorformatter-0e374b5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "benjamine/jsondiffpatch" +cve = "CVE-2025-9910 GHSA-33vc-wfww-vjfv" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-09-11T06:30:23Z" +post_cutoff = false +commit = "0e374b5dd8d7879b329a9fc18affbd46ad50dd14" +parent = "3cb442637b156eaab4a7f3c9f342c0b9168030aa" +commit_url = "https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14" +vendored = false +host = "github" +path = "packages/jsondiffpatch/src/formatters/html.ts" +mode = "name" +relpath = "packages/jsondiffpatch/src/formatters/html.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-03-24" +fix_lines = { in_function = 11, in_file = 15, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/jsondiffpatch/src/formatters/html.ts" +function = "typeFormattterErrorFormatter" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-33vc-wfww-vjfv: jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin" + +[[pair]] +name = "django-tomselect-prepare-results-0990ed3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "omenapps/django-tomselect" +cve = "GHSA-785h-76cm-cpmf" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-03-26T20:34:02Z" +post_cutoff = false +commit = "0990ed36c8874f9d42fa9deff7734bf8dcd46d40" +parent = "d9859b2e7c10a9af29a9f4fe676b6967cd6ca1a3" +commit_url = "https://github.com/omenapps/django-tomselect/commit/0990ed36c8874f9d42fa9deff7734bf8dcd46d40" +vendored = false +host = "github" +path = "src/django_tomselect/autocompletes.py" +mode = "name" +relpath = "src/django_tomselect/autocompletes.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-03-26" +fix_lines = { in_function = 7, in_file = 12, source_total = 157 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/django_tomselect/autocompletes.py" +function = "prepare_results" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-785h-76cm-cpmf: Django TomSelect incomplete escaping of dangerous characters in widget attributes" + +[[pair]] +name = "unopim-getrules-49d5f6a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "unopim/unopim" +cve = "CVE-2025-55742 GHSA-xr97-25v7-hc2q" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2025-08-21T14:25:23Z" +post_cutoff = false +commit = "49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75" +parent = "b5e169e65725e0d80b6c79d57e62a25e1af6a3c3" +commit_url = "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75" +vendored = false +host = "github" +path = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php" +mode = "name" +relpath = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-01" +fix_lines = { in_function = 10, in_file = 9, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php" +function = "getRules" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-xr97-25v7-hc2q: UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality" + +[[pair]] +name = "cloudbees-jenkins-advisor-plugin-executeinternal-4b456b3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/cloudbees-jenkins-advisor-plugin" +cve = "CVE-2025-47885 GHSA-xrpq-4g9w-qrwj" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-05-14T21:31:20Z" +post_cutoff = false +commit = "4b456b3110d1504d7dce8e7fca84c4e8793650e6" +parent = "4a0914b416ad664bb3b9b07505d0d657b0d32d31" +commit_url = "https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/4b456b3110d1504d7dce8e7fca84c4e8793650e6" +vendored = false +host = "github" +path = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java" +mode = "name" +relpath = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-05-05" +fix_lines = { in_function = 6, in_file = 7, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java" +function = "executeInternal" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-xrpq-4g9w-qrwj: Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting" + +[[pair]] +name = "clevertap-web-sdk-handlemessageevent-84695b7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "clevertap/clevertap-web-sdk" +cve = "CVE-2026-26861 GHSA-j5mf-6rh3-rhgg" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-02-27T18:31:06Z" +post_cutoff = false +commit = "84695b726a751614ddc3a4f71382c239c5833e03" +parent = "5e4504572136c9b918f3fe084303bd5f73d3f008" +commit_url = "https://github.com/clevertap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03" +vendored = false +host = "github" +path = "src/modules/visualBuilder/pageBuilder.js" +mode = "name" +relpath = "src/modules/visualBuilder/pageBuilder.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-28" +fix_lines = { in_function = 6, in_file = 5, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/modules/visualBuilder/pageBuilder.js" +function = "handleMessageEvent" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-j5mf-6rh3-rhgg: CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function" + +[[pair]] +name = "mezzanine-displayable-links-js-898630d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-2-Clause" +repo = "stephenmcd/mezzanine" +cve = "CVE-2025-6050 GHSA-7pr5-w74r-jjj7" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-06-17T12:31:15Z" +post_cutoff = false +commit = "898630d8df48cf3ddb8b9942f59168b93216e3f8" +parent = "245473493057c08911852ea8c82db4818ad6c9be" +commit_url = "https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8" +vendored = false +host = "github" +path = "mezzanine/core/views.py" +mode = "name" +relpath = "mezzanine/core/views.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-06-04" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "mezzanine/core/views.py" +function = "displayable_links_js" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-7pr5-w74r-jjj7: Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function" + +[[pair]] +name = "cadwyn-swagger-dashboard-b424ecd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "zmievsa/cadwyn" +cve = "CVE-2025-53528 GHSA-2gxp-6r36-m97r" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-07-21T14:08:40Z" +post_cutoff = false +commit = "b424ecd57cd8dabbc8fe39b8f8ccafea629c7728" +parent = "5a6e2b7f009f33d93ea26a50156523ba3e4c42ca" +commit_url = "https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728" +vendored = false +host = "github" +path = "cadwyn/applications.py" +mode = "name" +relpath = "cadwyn/applications.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-07-05" +fix_lines = { in_function = 2, in_file = 3, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "cadwyn/applications.py" +function = "swagger_dashboard" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-2gxp-6r36-m97r: Cadwyn vulnerable to XSS on the docs page" + +[[pair]] +name = "webssh-log-status-a7a704f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "huashengdun/webssh" +cve = "CVE-2025-7885 GHSA-9cg4-9hv5-3376" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-07-20T12:30:27Z" +post_cutoff = false +commit = "a7a704f111391c82efc1bacf89693ff45bda7f5f" +parent = "1cf19c71861a0df4dcbad67b6544224bbe616be1" +commit_url = "https://github.com/huashengdun/webssh/commit/a7a704f111391c82efc1bacf89693ff45bda7f5f" +vendored = false +host = "github" +path = "webssh/static/js/main.js" +mode = "name" +relpath = "webssh/static/js/main.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-07-27" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "webssh/static/js/main.js" +function = "log_status" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9cg4-9hv5-3376: WebSSH Cross-site Scripting vulnerability" + +[[pair]] +name = "core-index-e984870" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "gp247net/core" +cve = "CVE-2025-57407 GHSA-46v4-5mc8-q2cf" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2025-09-23T18:30:22Z" +post_cutoff = false +commit = "e9848706b41d835ca3d668cb1554650403e86da1" +parent = "8c2d98e786ec01cd1841a9ccaa083f7e0e9a0f20" +commit_url = "https://github.com/gp247net/core/commit/e9848706b41d835ca3d668cb1554650403e86da1" +vendored = false +host = "github" +path = "src/Controllers/AdminLogController.php" +mode = "name" +relpath = "src/Controllers/AdminLogController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-08-05" +fix_lines = { in_function = 2, in_file = 1, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Controllers/AdminLogController.php" +function = "index" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-46v4-5mc8-q2cf: GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability" + +[[pair]] +name = "mesh-web-sdk-openlink-7f22148" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "frontfin/mesh-web-sdk" +cve = "CVE-2025-59430 GHSA-vh3f-qppr-j97f" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-09-22T21:09:27Z" +post_cutoff = false +commit = "7f22148516d58e21a8b7670dde927d614c0d15c2" +parent = "cf013b85ab95d64c63cbe46d6cb14695474924e7" +commit_url = "https://github.com/frontfin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2" +vendored = false +host = "github" +path = "packages/link/src/Link.ts" +mode = "name" +relpath = "packages/link/src/Link.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-10" +fix_lines = { in_function = 6, in_file = 7, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/link/src/Link.ts" +function = "openLink" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-vh3f-qppr-j97f: Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink" + +[[pair]] +name = "fastmcp-create-detail-box-2a20f54" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jlowin/fastmcp" +cve = "CVE-2025-62800 GHSA-mxxr-jv3v-6pgc" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-10-29T15:38:29Z" +post_cutoff = false +commit = "2a20f54617a37213ed83894a8c2f0ac38a2e83a3" +parent = "541822f07ff28b196bde09d3818fea0579becd86" +commit_url = "https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3" +vendored = false +host = "github" +path = "src/fastmcp/utilities/ui.py" +mode = "name" +relpath = "src/fastmcp/utilities/ui.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-10-14" +fix_lines = { in_function = 4, in_file = 7, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/fastmcp/utilities/ui.py" +function = "create_detail_box" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-mxxr-jv3v-6pgc: FastMCP vulnerable to reflected XSS in client's callback page" + +[[pair]] +name = "mailgen-setupbuttonfallbacktext-7a791a4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "eladnava/mailgen" +cve = "CVE-2025-62380 GHSA-q4w9-x3rv-4c8j" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2025-10-15T19:29:36Z" +post_cutoff = false +commit = "7a791a424ff3a3f7783f8750919f1e98639924a8" +parent = "cedddb6a672bf047d98b0053677310583d55ea45" +commit_url = "https://github.com/eladnava/mailgen/commit/7a791a424ff3a3f7783f8750919f1e98639924a8" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-10-15" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "index.js" +function = "setupButtonFallbackText" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-q4w9-x3rv-4c8j: Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails" + +[[pair]] +name = "spotipy-do-get-880b92d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "spotipy-dev/spotipy" +cve = "CVE-2025-66040 GHSA-r77h-rpp9-w2xm" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2025-12-01T19:07:26Z" +post_cutoff = false +commit = "880b92d7243dcf2b83bf31dc365a858d8b5e6767" +parent = "a91d9feb516a4360503dca9cfe63a35927b9befa" +commit_url = "https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767" +vendored = false +host = "github" +path = "spotipy/oauth2.py" +mode = "name" +relpath = "spotipy/oauth2.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-26" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "spotipy/oauth2.py" +function = "do_GET" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-r77h-rpp9-w2xm: Spotipy has a XSS vulnerability in its OAuth callback server" + +[[pair]] +name = "java-html-sanitizer-stripdisallowedtags-4149cf0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "owasp/java-html-sanitizer" +cve = "CVE-2025-66021 GHSA-g9gq-3pfx-2gw2" +cwe = "CWE-79" +ecosystem = "maven" +published_at = "2025-11-25T22:10:17Z" +post_cutoff = false +commit = "4149cf02ba84db13e8e9d7ee1b01b3f47238e072" +parent = "b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e" +commit_url = "https://github.com/owasp/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072" +vendored = false +host = "github" +path = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java" +mode = "name" +relpath = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-22" +fix_lines = { in_function = 26, in_file = 19, source_total = 31 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java" +function = "stripDisallowedTags" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-g9gq-3pfx-2gw2: OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization " + +[[pair]] +name = "html2pdf-js-createelement-988826e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ekoopmans/html2pdf.js" +cve = "CVE-2026-22787 GHSA-w8x4-x68c-m6fc" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-01-14T16:53:10Z" +post_cutoff = false +commit = "988826e336035b39a8608182d7b73c0e3cd78c7b" +parent = "f6dc70fdaa814f7b83d1e8059279814d5b46013e" +commit_url = "https://github.com/ekoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b" +vendored = false +host = "github" +path = "src/utils.js" +mode = "name" +relpath = "src/utils.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-12" +fix_lines = { in_function = 10, in_file = 10, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/utils.js" +function = "createElement" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-w8x4-x68c-m6fc: html2pdf.js contains a cross-site scripting vulnerability" + +[[pair]] +name = "distributed-http-get-ab72092" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "dask/distributed" +cve = "CVE-2026-23528 GHSA-c336-7962-wfj2" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-01-16T16:58:16Z" +post_cutoff = false +commit = "ab72092a8a938923c2bb51a2cd14ca26614827fa" +parent = "f4cfecc48856d5f0fbf7f840fbecdb17544fd30e" +commit_url = "https://github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827fa" +vendored = false +host = "github" +path = "distributed/http/proxy.py" +mode = "name" +relpath = "distributed/http/proxy.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-16" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "distributed/http/proxy.py" +function = "http_get" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-c336-7962-wfj2: Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard" + +[[pair]] +name = "beautiful-mermaid-rendernodeshape-68f3ab8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "lukilabs/beautiful-mermaid" +cve = "CVE-2026-26226 GHSA-cgmm-x5ww-q5cr" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-02-13T18:31:25Z" +post_cutoff = false +commit = "68f3ab8c9658e7f4a3b749e06a6b96e4c3f55db1" +parent = "83ab883b6826aa5c9df26843883bdbe89ceae7cf" +commit_url = "https://github.com/lukilabs/beautiful-mermaid/commit/68f3ab8c9658e7f4a3b749e06a6b96e4c3f55db1" +vendored = false +host = "github" +path = "src/renderer.ts" +mode = "name" +relpath = "src/renderer.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-29" +fix_lines = { in_function = 6, in_file = 4, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/renderer.ts" +function = "renderNodeShape" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-cgmm-x5ww-q5cr: beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)" + +[[pair]] +name = "isso-moderate-0afbfe0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "isso-comments/isso" +cve = "CVE-2026-27469 GHSA-9fww-8cpr-q66r" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-02-24T16:03:04Z" +post_cutoff = false +commit = "0afbfe0691ee237963e8fb0b2ee01c9e55ca2144" +parent = "09cddc1940c837cbd46559db49459d20f670cd16" +commit_url = "https://github.com/isso-comments/isso/commit/0afbfe0691ee237963e8fb0b2ee01c9e55ca2144" +vendored = false +host = "github" +path = "isso/views/comments.py" +mode = "name" +relpath = "isso/views/comments.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-19" +fix_lines = { in_function = 10, in_file = 26, source_total = 27 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "isso/views/comments.py" +function = "moderate" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-9fww-8cpr-q66r: Isso affected by Stored XSS via comment website field" + +[[pair]] +name = "pannellum-createhotspot-9391ef8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mpetroff/pannellum" +cve = "CVE-2026-27210 GHSA-8423-w5wx-h2r6" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-02-19T20:44:48Z" +post_cutoff = false +commit = "9391ef8da6a6a98c6a9f8c97f101adb900523681" +parent = "bb19235ac074df05c545c8d2d2235916d2aef0b8" +commit_url = "https://github.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681" +vendored = false +host = "github" +path = "src/js/pannellum.js" +mode = "name" +relpath = "src/js/pannellum.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-19" +fix_lines = { in_function = 8, in_file = 13, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/js/pannellum.js" +function = "createHotSpot" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8423-w5wx-h2r6: Pannellum has a XSS vulnerability in hot spot attributes" + +[[pair]] +name = "lxml-html-clean-call-9c5612c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "fedora-python/lxml_html_clean" +cve = "CVE-2026-28350 GHSA-xvp8-3mhv-424c" +cwe = "CWE-116" +ecosystem = "pip" +published_at = "2026-03-02T19:35:52Z" +post_cutoff = false +commit = "9c5612ca33b941eec4178abf8a5294b103403f34" +parent = "2ef732667ddbc74ea59847bcf24b75809aaeed3b" +commit_url = "https://github.com/fedora-python/lxml_html_clean/commit/9c5612ca33b941eec4178abf8a5294b103403f34" +vendored = false +host = "github" +path = "lxml_html_clean/clean.py" +mode = "name" +relpath = "lxml_html_clean/clean.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-27" +fix_lines = { in_function = 2, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-116" +class = "improper-encoding" +path = "lxml_html_clean/clean.py" +function = "__call__" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-xvp8-3mhv-424c: lxml-html-clean has tag injection through default Cleaner configuration" + +[[pair]] +name = "nicknames-invoke-4dde997" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "flarum/nicknames" +cve = "CVE-2026-30913 GHSA-3c4m-j3g4-hh25" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-03-10T00:56:30Z" +post_cutoff = false +commit = "4dde99729abdce8f6e2a7437c86e38735fdcca28" +parent = "7985676fea59adc4628a1f0ba42ea93afc9be498" +commit_url = "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28" +vendored = false +host = "github" +path = "src/AddNicknameValidation.php" +mode = "name" +relpath = "src/AddNicknameValidation.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-06" +fix_lines = { in_function = 5, in_file = 7, source_total = 20 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/AddNicknameValidation.php" +function = "__invoke" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3c4m-j3g4-hh25: flarum/nicknames extension has display name injection in notification emails (autolink & markdown)" + +[[pair]] +name = "vscode-lean4-replaceat-14b7a10" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "leanprover/vscode-lean4" +cve = "CVE-2026-32732 GHSA-6ggm-pwr9-r5h2" +cwe = "CWE-80" +ecosystem = "npm" +published_at = "2026-03-16T16:39:55Z" +post_cutoff = false +commit = "14b7a105c89d2819c5e78970fd258393f76453bb" +parent = "a884fa075489c3401e3702ad78aaa45a98a0841a" +commit_url = "https://github.com/leanprover/vscode-lean4/commit/14b7a105c89d2819c5e78970fd258393f76453bb" +vendored = false +host = "github" +path = "lean4-unicode-input-component/src/index.ts" +mode = "name" +relpath = "lean4-unicode-input-component/src/index.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-11" +fix_lines = { in_function = 4, in_file = 13, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-80" +class = "xss" +path = "lean4-unicode-input-component/src/index.ts" +function = "replaceAt" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-6ggm-pwr9-r5h2: XSS in @leanprover/unicode-input-component" + +[[pair]] +name = "express-xss-sanitizer-initializeoptions-5623009" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "ahmedadelfahim/express-xss-sanitizer" +cve = "CVE-2026-33979 GHSA-3843-rr4g-m8jq" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-03-27T17:56:45Z" +post_cutoff = false +commit = "5623009ef11dcf095c163a38dea07b9cc22ad19f" +parent = "62d6542a2a57298da7a2e02de623454007e4f6d6" +commit_url = "https://github.com/ahmedadelfahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f" +vendored = false +host = "github" +path = "lib/sanitize.js" +mode = "name" +relpath = "lib/sanitize.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-25" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "lib/sanitize.js" +function = "initializeOptions" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3843-rr4g-m8jq: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)" + +[[pair]] +name = "graby-cleanupxss-0295d82" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "j0k3r/graby" +cve = "GHSA-3h6j-9x8m-rg3g" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-03-31T23:12:36Z" +post_cutoff = false +commit = "0295d828822f7a59c5751a8199973a4f965a99b0" +parent = "5c5870bd0e8b03c9ea3e7c056d013cd9e4ab2f9a" +commit_url = "https://github.com/j0k3r/graby/commit/0295d828822f7a59c5751a8199973a4f965a99b0" +vendored = false +host = "github" +path = "src/Graby.php" +mode = "name" +relpath = "src/Graby.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-27" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Graby.php" +function = "cleanupXss" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3h6j-9x8m-rg3g: Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config" + +[[pair]] +name = "unhead-getstreamkey-64b5ac0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "unjs/unhead" +cve = "GHSA-x7mm-9vvv-64w8" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-04-10T22:09:39Z" +post_cutoff = false +commit = "64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6" +parent = "17c123eb9e8974bf72973246efdf26a199fd11bd" +commit_url = "https://github.com/unjs/unhead/commit/64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6" +vendored = false +host = "github" +path = "packages/unhead/src/stream/server.ts" +mode = "name" +relpath = "packages/unhead/src/stream/server.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-10" +fix_lines = { in_function = 4, in_file = 20, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/unhead/src/stream/server.ts" +function = "getStreamKey" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-x7mm-9vvv-64w8: unhead: Streaming SSR `streamKey` injected into inline script without identifier validation" + +[[pair]] +name = "ipl-web-postdispatch-f387e92" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "icinga/ipl-web" +cve = "CVE-2026-42224 GHSA-55wf-5m3q-6jjf" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-04-29T21:01:55Z" +post_cutoff = false +commit = "f387e92504d7a03bb857d1aee9b7410e06dd065d" +parent = "b0fa6ea09f7269b7616e0ae6c9ec50035679bb23" +commit_url = "https://github.com/icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d" +vendored = false +host = "github" +path = "src/Compat/CompatController.php" +mode = "name" +relpath = "src/Compat/CompatController.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-21" +fix_lines = { in_function = 4, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Compat/CompatController.php" +function = "postDispatch" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-55wf-5m3q-6jjf: ipl/web is vulnerable to reflected XSS by malformed search requests" + +[[pair]] +name = "livewire-markdown-editor-updatedattachments-1e60eaa" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "mckenziearts/livewire-markdown-editor" +cve = "GHSA-gxxh-8vcj-w2mh" +cwe = "CWE-79" +ecosystem = "composer" +published_at = "2026-05-04T22:11:05Z" +post_cutoff = false +commit = "1e60eaa5781e89704e112425f832774be85cd71f" +parent = "cfd07048019694d2aaeaa9247a63991703173858" +commit_url = "https://github.com/mckenziearts/livewire-markdown-editor/commit/1e60eaa5781e89704e112425f832774be85cd71f" +vendored = false +host = "github" +path = "src/Livewire/MarkdownEditor.php" +mode = "name" +relpath = "src/Livewire/MarkdownEditor.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-24" +fix_lines = { in_function = 11, in_file = 43, source_total = 73 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/Livewire/MarkdownEditor.php" +function = "updatedAttachments" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-gxxh-8vcj-w2mh: livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler" + +[[pair]] +name = "microdot-set-cookie-99b281b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "miguelgrinberg/microdot" +cve = "CVE-2026-42874 GHSA-7wc8-wvc4-m498" +cwe = "CWE-113" +ecosystem = "pip" +published_at = "2026-05-05T18:35:20Z" +post_cutoff = false +commit = "99b281b45faef8472410f2d56bfef496dfbd95d5" +parent = "da91d4272aa2fb5efcc81bf823947737e031d0f8" +commit_url = "https://github.com/miguelgrinberg/microdot/commit/99b281b45faef8472410f2d56bfef496dfbd95d5" +vendored = false +host = "github" +path = "src/microdot/microdot.py" +mode = "name" +relpath = "src/microdot/microdot.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-24" +fix_lines = { in_function = 2, in_file = 3, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-113" +class = "header-injection" +path = "src/microdot/microdot.py" +function = "set_cookie" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-7wc8-wvc4-m498: Microdot has HTTP response splitting in Response.set_cookie()" + +[[pair]] +name = "liquidjs-strip-html-26ea285" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "harttle/liquidjs" +cve = "CVE-2026-44644 GHSA-2qv6-9wx5-cwv4" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-05-27T00:09:12Z" +post_cutoff = false +commit = "26ea2856c7a90aec892b98d94a9b7a3e18539045" +parent = "a55f543f49aea8f769e680b0d115aa903952efd0" +commit_url = "https://github.com/harttle/liquidjs/commit/26ea2856c7a90aec892b98d94a9b7a3e18539045" +vendored = false +host = "github" +path = "src/filters/html.ts" +mode = "name" +relpath = "src/filters/html.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-03" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/filters/html.ts" +function = "strip_html" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-2qv6-9wx5-cwv4: LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS" + +[[pair]] +name = "sveltia-cms-sanitizeentrysummary-43a6ac5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "sveltia/sveltia-cms" +cve = "GHSA-97r8-rf7q-wmjw" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-05-18T13:43:50Z" +post_cutoff = false +commit = "43a6ac5d0182a503400d8ce1ac156e08f537b1b2" +parent = "bb403947508f0070a93938878153530771c1b405" +commit_url = "https://github.com/sveltia/sveltia-cms/commit/43a6ac5d0182a503400d8ce1ac156e08f537b1b2" +vendored = false +host = "github" +path = "src/lib/services/contents/entry/summary.js" +mode = "name" +relpath = "src/lib/services/contents/entry/summary.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-11" +fix_lines = { in_function = 7, in_file = 9, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/lib/services/contents/entry/summary.js" +function = "sanitizeEntrySummary" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-97r8-rf7q-wmjw: Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML" + +[[pair]] +name = "svelte-encode-a16ebc6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "sveltejs/svelte" +cve = "GHSA-f3cj-j4f6-wq85" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-05-14T20:30:09Z" +post_cutoff = false +commit = "a16ebc67bbcf8f708360195687e1b2719463e1a4" +parent = "d2375e2ebcab5c88feb5652f1a9d621b8f06b259" +commit_url = "https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4" +vendored = false +host = "github" +path = "packages/svelte/src/internal/server/hydratable.js" +mode = "name" +relpath = "packages/svelte/src/internal/server/hydratable.js" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-14" +fix_lines = { in_function = 5, in_file = 8, source_total = 19 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/svelte/src/internal/server/hydratable.js" +function = "encode" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-f3cj-j4f6-wq85: Svelte: SSR XSS via Insecure Promise Serialization in hydratable" + +[[pair]] +name = "marimo-inject-service-worker-fdd55c8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "marimo-team/marimo" +cve = "CVE-2026-54386 GHSA-8m59-7xv8-735h" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-06-18T00:32:36Z" +post_cutoff = true +commit = "fdd55c8cf6260ae23bb411dc9d9269def5cf75d6" +parent = "dc35cdfecf4f9b918d9c40faa92e2ad0d71501c4" +commit_url = "https://github.com/marimo-team/marimo/commit/fdd55c8cf6260ae23bb411dc9d9269def5cf75d6" +vendored = false +host = "github" +path = "marimo/_server/api/endpoints/assets.py" +mode = "name" +relpath = "marimo/_server/api/endpoints/assets.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-06-04" +fix_lines = { in_function = 2, in_file = 6, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "marimo/_server/api/endpoints/assets.py" +function = "_inject_service_worker" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-8m59-7xv8-735h: marimo contains a reflected cross-site scripting vulnerability in the notebook page" + +[[pair]] +name = "jupyterlab-git-diffheader-c6d37b8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "jupyterlab/jupyterlab-git" +cve = "CVE-2026-54527 GHSA-f962-v9hr-pfg5" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-06-19T19:36:04Z" +post_cutoff = true +commit = "c6d37b88f36aa59aee317930b95e427fb9d6b09b" +parent = "af267598e7437993c02a14101db41c75809a7f88" +commit_url = "https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b" +vendored = false +host = "github" +path = "src/components/diff/NotebookDiff.ts" +mode = "name" +relpath = "src/components/diff/NotebookDiff.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-06-17" +fix_lines = { in_function = 23, in_file = 14, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/components/diff/NotebookDiff.ts" +function = "diffHeader" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-f962-v9hr-pfg5: jupyterlab-git extension: Stored XSS leading to RCE" + +[[pair]] +name = "appium-mcp-createlocatorgeneratorui-e222bbb" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "appium/appium-mcp" +cve = "GHSA-x975-rgx4-5fh4" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-06-19T21:43:14Z" +post_cutoff = true +commit = "e222bbbd6fe2b656a320efcd143563f08061a83d" +parent = "1655fbd41f462f43dc49fd78f15727db0e2fb6c3" +commit_url = "https://github.com/appium/appium-mcp/commit/e222bbbd6fe2b656a320efcd143563f08061a83d" +vendored = false +host = "github" +path = "src/ui/mcp-ui-utils.ts" +mode = "name" +relpath = "src/ui/mcp-ui-utils.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-06-18" +fix_lines = { in_function = 14, in_file = 26, source_total = 33 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "src/ui/mcp-ui-utils.ts" +function = "createLocatorGeneratorUI" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-x975-rgx4-5fh4: appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)" + +[[pair]] +name = "jupyterlab-updateconfig-be9303f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "jupyterlab/jupyterlab" +cve = "CVE-2026-73417 GHSA-pppj-hq3g-57pj" +cwe = "CWE-79" +ecosystem = "pip" +published_at = "2026-07-22T23:16:18Z" +post_cutoff = true +commit = "be9303f5bcd5308eaeae953c5a3c903046682c2c" +parent = "a555fe1dcb4a4d6b135236ae89319a9f303780d9" +commit_url = "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c" +vendored = false +host = "github" +path = "packages/notebook-extension/src/index.ts" +mode = "name" +relpath = "packages/notebook-extension/src/index.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-07-21" +fix_lines = { in_function = 13, in_file = 7, source_total = 87 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/notebook-extension/src/index.ts" +function = "updateConfig" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-pppj-hq3g-57pj: JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)" + +[[pair]] +name = "file-viewer-render-ef04568" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "flyfish-dev/file-viewer" +cve = "CVE-2026-91127 GHSA-3753-m2x2-q623" +cwe = "CWE-79" +ecosystem = "npm" +published_at = "2026-09-18T17:19:42Z" +post_cutoff = true +commit = "ef045680f8d9830a3eee9612f7df46a734361b07" +parent = "772ae40de07e48134de0449997cb4924b0cde3e4" +commit_url = "https://github.com/flyfish-dev/file-viewer/commit/ef045680f8d9830a3eee9612f7df46a734361b07" +vendored = false +host = "github" +path = "packages/renderers/word/src/wordDoc.ts" +mode = "name" +relpath = "packages/renderers/word/src/wordDoc.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-08-24" +fix_lines = { in_function = 14, in_file = 13, source_total = 160 } + +[[pair.expected]] +cwe = "CWE-79" +class = "xss" +path = "packages/renderers/word/src/wordDoc.ts" +function = "render" +mechanism = "source_reaches_sink" +family = "output_encoding" +evidence = "GHSA-3753-m2x2-q623: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer" + +[[pair]] +name = "twig-validatename-3d19a2e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "fabpot/twig" +cve = "GHSA-7cvr-xhm5-x998" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2024-05-30T13:42:49Z" +post_cutoff = false +commit = "3d19a2eed53570776af313593aaeb5ad62cf4980" +parent = "481abb83323f4dcabadc9292b0e9f104df0719de" +commit_url = "https://github.com/fabpot/twig/commit/3d19a2eed53570776af313593aaeb5ad62cf4980" +vendored = false +host = "github" +path = "lib/Twig/Loader/Filesystem.php" +mode = "name" +relpath = "lib/Twig/Loader/Filesystem.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2013-04-08" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lib/Twig/Loader/Filesystem.php" +function = "validateName" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-7cvr-xhm5-x998: Twig Path Traversal vulnerability in the filesystem loader" + +[[pair]] +name = "bazingajstranslationbundle-getlocales-7accee9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "willdurand/bazingajstranslationbundle" +cve = "GHSA-x86x-qhf8-f37w" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2024-06-07T22:20:27Z" +post_cutoff = false +commit = "7accee93569c3f3d2379f035a41ece66522801fc" +parent = "df6c0fd603c0192ebc5584991a52a1092c5f60bd" +commit_url = "https://github.com/willdurand/bazingajstranslationbundle/commit/7accee93569c3f3d2379f035a41ece66522801fc" +vendored = false +host = "github" +path = "Controller/Controller.php" +mode = "name" +relpath = "Controller/Controller.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2014-07-29" +fix_lines = { in_function = 3, in_file = 4, source_total = 22 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "Controller/Controller.php" +function = "getLocales" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-x86x-qhf8-f37w: willdurand/js-translation-bundle potential path traversal attack and remote code injection" + +[[pair]] +name = "nodeserver-onrequest-c4c0f01" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "youngerheart/nodeserver" +cve = "CVE-2020-36651 GHSA-3fwq-qv5v-2wxf" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2023-01-18T03:31:17Z" +post_cutoff = false +commit = "c4c0f0138ab5afbac58e03915d446680421bde28" +parent = "56b51bd4bdff640a4eb2e16e8558ce7b709a95b6" +commit_url = "https://github.com/youngerheart/nodeserver/commit/c4c0f0138ab5afbac58e03915d446680421bde28" +vendored = false +host = "github" +path = "nodeserver.js" +mode = "name" +relpath = "nodeserver.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2020-08-21" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "nodeserver.js" +function = "onRequest" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3fwq-qv5v-2wxf: Path Traversal in web-node-server" + +[[pair]] +name = "microweber-download-572bdc3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "microweber/microweber" +cve = "CVE-2025-34076 GHSA-j64v-xh5w-8hqj" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2025-07-02T21:32:00Z" +post_cutoff = false +commit = "572bdc36b5b47923790016f6b961c8df53226855" +parent = "b71f9e2a2c8b1f96ea54d6d894452585f424e509" +commit_url = "https://github.com/microweber/microweber/commit/572bdc36b5b47923790016f6b961c8df53226855" +vendored = false +host = "github" +path = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php" +mode = "name" +relpath = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2022-02-03" +fix_lines = { in_function = 7, in_file = 11, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php" +function = "download" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-j64v-xh5w-8hqj: Microweber CMS API has authenticated local file inclusion vulnerability" + +[[pair]] +name = "binwalk-extractor-696fe34" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "refirmlabs/binwalk" +cve = "CVE-2022-4510 GHSA-3cm8-v4mc-gppg" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2023-01-26T21:30:20Z" +post_cutoff = false +commit = "696fe34ed680ffd951bfeca737feb4a0b98dde5c" +parent = "a555eb1fa6ed0073c36b3493fba7a463a98eaa97" +commit_url = "https://github.com/refirmlabs/binwalk/commit/696fe34ed680ffd951bfeca737feb4a0b98dde5c" +vendored = false +host = "github" +path = "src/binwalk/plugins/unpfs.py" +mode = "name" +relpath = "src/binwalk/plugins/unpfs.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2022-10-26" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/binwalk/plugins/unpfs.py" +function = "extractor" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3cm8-v4mc-gppg: Path traversal in binwalk" + +[[pair]] +name = "gatsby-onoperation-ae5a654" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "gatsbyjs/gatsby" +cve = "CVE-2023-34238 GHSA-c6f8-8r25-c4gc" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2023-06-09T22:52:01Z" +post_cutoff = false +commit = "ae5a654eb346b2e7a9d341b809b2f82d34c0f17c" +parent = "18a47dadfdb0e38daf4371739ebaeb2593d3e6f6" +commit_url = "https://github.com/gatsbyjs/gatsby/commit/ae5a654eb346b2e7a9d341b809b2f82d34c0f17c" +vendored = false +host = "github" +path = "packages/gatsby/src/utils/start-server.ts" +mode = "name" +relpath = "packages/gatsby/src/utils/start-server.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-05-05" +fix_lines = { in_function = 26, in_file = 33, source_total = 102 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "packages/gatsby/src/utils/start-server.ts" +function = "onOperation" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-c6f8-8r25-c4gc: Gatsby develop server has Local File Inclusion vulnerability" + +[[pair]] +name = "codedx-plugin-checkcsvfilematches-138932b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "jenkinsci/codedx-plugin" +cve = "CVE-2023-2196 GHSA-5gjq-5339-x5cv" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2023-05-16T18:30:16Z" +post_cutoff = false +commit = "138932b362c7da3c310b1f34fc854c5bf5f52458" +parent = "0214f30488ea8481f01e4b14a861e13d75bebb8b" +commit_url = "https://github.com/jenkinsci/codedx-plugin/commit/138932b362c7da3c310b1f34fc854c5bf5f52458" +vendored = false +host = "github" +path = "src/main/java/org/jenkinsci/plugins/codedx/Util.java" +mode = "name" +relpath = "src/main/java/org/jenkinsci/plugins/codedx/Util.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-05-10" +fix_lines = { in_function = 4, in_file = 3, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/main/java/org/jenkinsci/plugins/codedx/Util.java" +function = "checkCSVFileMatches" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5gjq-5339-x5cv: Jenkins Code Dx Plugin missing permission checks" + +[[pair]] +name = "php-imap-fetch-88aaafb" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "webklex/php-imap" +cve = "CVE-2023-35169 GHSA-47p7-xfcc-4pv9" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2023-06-21T21:58:58Z" +post_cutoff = false +commit = "88aaafbd881f09c3ec174f7417d36a8dedbd1b37" +parent = "6ea5a94f2f8936ac5c2c40a46fbbd88f2bdeb16b" +commit_url = "https://github.com/webklex/php-imap/commit/88aaafbd881f09c3ec174f7417d36a8dedbd1b37" +vendored = false +host = "github" +path = "src/Attachment.php" +mode = "name" +relpath = "src/Attachment.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-20" +fix_lines = { in_function = 6, in_file = 20, source_total = 26 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Attachment.php" +function = "fetch" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-47p7-xfcc-4pv9: php-imap vulnerable to RCE through a directory traversal vulnerability" + +[[pair]] +name = "cypress-image-snapshot-removesnapshot-ef49519" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "simonsmith/cypress-image-snapshot" +cve = "CVE-2023-38695 GHSA-vxjg-hchx-cc4g" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2023-08-01T16:59:40Z" +post_cutoff = false +commit = "ef49519795daf5183f4fac6f3136e194f20f39f4" +parent = "b64bdc31943c3eb862efadef32586f96fbf787f5" +commit_url = "https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4" +vendored = false +host = "github" +path = "src/plugin.ts" +mode = "name" +relpath = "src/plugin.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-07-31" +fix_lines = { in_function = 2, in_file = 2, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/plugin.ts" +function = "removeSnapshot" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vxjg-hchx-cc4g: @simonsmith/cypress-image-snapshothas fix for insecure snapshot file names" + +[[pair]] +name = "pf4j-extract-8e0aa19" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "pf4j/pf4j" +cve = "CVE-2023-40828 GHSA-cj8w-v588-p8wx" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2023-08-29T00:32:04Z" +post_cutoff = false +commit = "8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72" +parent = "c1c9c982dc372d1027468e166c3e0675d6890e2a" +commit_url = "https://github.com/pf4j/pf4j/commit/8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72" +vendored = false +host = "github" +path = "pf4j/src/main/java/org/pf4j/util/Unzip.java" +mode = "name" +relpath = "pf4j/src/main/java/org/pf4j/util/Unzip.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-08-16" +fix_lines = { in_function = 5, in_file = 14, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pf4j/src/main/java/org/pf4j/util/Unzip.java" +function = "extract" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-cj8w-v588-p8wx: pf4j vulnerable to remote code execution via expandIfZip method in the extract function" + +[[pair]] +name = "aws-sdk-php-buildendpoint-aebc9f8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/aws-sdk-php" +cve = "CVE-2023-51651 GHSA-557v-xcg6-rm5m" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2023-12-21T23:16:13Z" +post_cutoff = false +commit = "aebc9f801438746ac4ade327551576cb75f635f2" +parent = "3daedce00e450411630528245d83f734651b5dda" +commit_url = "https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2" +vendored = false +host = "github" +path = "src/Api/Serializer/RestSerializer.php" +mode = "name" +relpath = "src/Api/Serializer/RestSerializer.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-11-22" +fix_lines = { in_function = 6, in_file = 9, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Api/Serializer/RestSerializer.php" +function = "buildEndpoint" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-557v-xcg6-rm5m: Potential URI resolution path traversal in the AWS SDK for PHP" + +[[pair]] +name = "arrp-dumpdirect-7ea80db" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MPL-2.0" +repo = "devan-kerman/arrp" +cve = "CVE-2024-24042 GHSA-cg24-jjr5-rxmf" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2024-03-19T09:30:32Z" +post_cutoff = false +commit = "7ea80db462c8bf66a0565e84fa49c1f2ecb9287b" +parent = "3a685438960b7fa64adaf71f7f13fba30d9b60f7" +commit_url = "https://github.com/devan-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b" +vendored = false +host = "github" +path = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java" +mode = "name" +relpath = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-01-09" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java" +function = "dumpDirect" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-cg24-jjr5-rxmf: Path traversal in flaskcode Devan-Kerman ARRP" + +[[pair]] +name = "paddle-download-5c50d1a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "paddlepaddle/paddle" +cve = "CVE-2024-0818 GHSA-2rp8-hff9-c5wr" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-03-07T15:30:38Z" +post_cutoff = false +commit = "5c50d1a8b97b310cbc36560ec36d8377d6f29d7c" +parent = "62a1261328c6bc165d2cfaea1338b74b5801104f" +commit_url = "https://github.com/paddlepaddle/paddle/commit/5c50d1a8b97b310cbc36560ec36d8377d6f29d7c" +vendored = false +host = "github" +path = "python/paddle/dataset/common.py" +mode = "name" +relpath = "python/paddle/dataset/common.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-01-31" +fix_lines = { in_function = 5, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "python/paddle/dataset/common.py" +function = "download" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-2rp8-hff9-c5wr: PaddlePaddle Path Traversal vulnerability" + +[[pair]] +name = "lektor-untrusted-to-os-path-7393d87" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "lektor/lektor" +cve = "CVE-2024-28335 GHSA-wv28-7fpw-fj49" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-03-27T06:30:33Z" +post_cutoff = false +commit = "7393d87bd354e43120937789956175064e4610a0" +parent = "4b5731226f5e2a3f70ecf258d6718e99a962921c" +commit_url = "https://github.com/lektor/lektor/commit/7393d87bd354e43120937789956175064e4610a0" +vendored = false +host = "github" +path = "lektor/utils.py" +mode = "name" +relpath = "lektor/utils.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-02-27" +fix_lines = { in_function = 5, in_file = 4, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lektor/utils.py" +function = "untrusted_to_os_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-wv28-7fpw-fj49: Lektor does not sanitize database path traversal" + +[[pair]] +name = "unzip-stream-unzipstream-ab67989" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mhr3/unzip-stream" +cve = "GHSA-6jrj-vc65-c983" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2024-08-26T15:17:40Z" +post_cutoff = false +commit = "ab67989719abb4dcc774d02de266151905b8d45a" +parent = "4a4be03d5e13ce5408b8be3dee970d15212ca532" +commit_url = "https://github.com/mhr3/unzip-stream/commit/ab67989719abb4dcc774d02de266151905b8d45a" +vendored = false +host = "github" +path = "lib/unzip-stream.js" +mode = "name" +relpath = "lib/unzip-stream.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-04-20" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lib/unzip-stream.js" +function = "UnzipStream" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-6jrj-vc65-c983: unzip-stream allows Arbitrary File Write via artifact extraction" + +[[pair]] +name = "openapi-generator-generate-edbb021" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "openapitools/openapi-generator" +cve = "CVE-2024-35219 GHSA-g3hr-p86p-593h" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2024-05-28T15:47:57Z" +post_cutoff = false +commit = "edbb021aadae47dcfe690313ce5119faf77f800d" +parent = "4a872a8d697fbcfb8fd115bfaf10c00c2e3e3e06" +commit_url = "https://github.com/openapitools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d" +vendored = false +host = "github" +path = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java" +mode = "name" +relpath = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-05-14" +fix_lines = { in_function = 8, in_file = 8, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java" +function = "generate" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-g3hr-p86p-593h: OpenAPI Generator Online - Arbitrary File Read/Delete" + +[[pair]] +name = "weave-send-local-file-f43d5fb" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "wandb/weave" +cve = "CVE-2024-7340 GHSA-r49h-6qxq-624f" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-07-31T15:31:19Z" +post_cutoff = false +commit = "f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f" +parent = "c28d8d5bd811c33fd7b75663482447be9120299d" +commit_url = "https://github.com/wandb/weave/commit/f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f" +vendored = false +host = "github" +path = "weave/weave_server.py" +mode = "name" +relpath = "weave/weave_server.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-02" +fix_lines = { in_function = 18, in_file = 26, source_total = 28 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "weave/weave_server.py" +function = "send_local_file" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-r49h-6qxq-624f: Weave server API vulnerable to arbitrary file leak" + +[[pair]] +name = "solara-get-from-cache-df2fd66" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "widgetti/solara" +cve = "CVE-2024-39903 GHSA-9794-pc4r-438w" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2024-07-12T21:00:21Z" +post_cutoff = false +commit = "df2fd66a7f4e8ffd36e8678697a8a4f76760dc54" +parent = "681f69b7779da2bd3586d6e9fd0b21d36e6fb124" +commit_url = "https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54" +vendored = false +host = "github" +path = "solara/server/cdn_helper.py" +mode = "name" +relpath = "solara/server/cdn_helper.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-07-11" +fix_lines = { in_function = 10, in_file = 18, source_total = 41 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "solara/server/cdn_helper.py" +function = "get_from_cache" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-9794-pc4r-438w: Local File Inclusion in Solara" + +[[pair]] +name = "url-to-png-handleextractqueryparamsmiddleware-e4eaeca" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "jasonraimondi/url-to-png" +cve = "CVE-2024-39918 GHSA-vvmv-wrvp-9gjr" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2024-07-15T17:46:57Z" +post_cutoff = false +commit = "e4eaeca6493b21cd515b582fd6c0af09ede54507" +parent = "ef8391480c25332fc74d6cf841eab2969e18db27" +commit_url = "https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507" +vendored = false +host = "github" +path = "src/middlewares/extract_query_params.ts" +mode = "name" +relpath = "src/middlewares/extract_query_params.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-07-13" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/middlewares/extract_query_params.ts" +function = "handleExtractQueryParamsMiddleware" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vvmv-wrvp-9gjr: @jmondi/url-to-png contains a Path Traversal vulnerability" + +[[pair]] +name = "df-core-handleservicerequest-5435460" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "Apache-2.0" +repo = "dreamfactorysoftware/df-core" +cve = "CVE-2025-55988 GHSA-gv7f-w92j-383q" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2026-03-20T21:31:28Z" +post_cutoff = false +commit = "54354605b2ec9afe6ee96756a5a22f6f56828950" +parent = "64ff000d125e55678a2cf909b157c2f5fd4b109c" +commit_url = "https://github.com/dreamfactorysoftware/df-core/commit/54354605b2ec9afe6ee96756a5a22f6f56828950" +vendored = false +host = "github" +path = "src/Http/Controllers/RestController.php" +mode = "name" +relpath = "src/Http/Controllers/RestController.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-09-02" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Http/Controllers/RestController.php" +function = "handleServiceRequest" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gv7f-w92j-383q: DreamFactory has a directory traversal" + +[[pair]] +name = "simile-butterfly-getresource-537f64b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "openrefine/simile-butterfly" +cve = "CVE-2024-47883 GHSA-3p8v-w8mr-m3x8" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2024-10-24T18:16:43Z" +post_cutoff = false +commit = "537f64bfa72746f8b21d4bda461fad843435319c" +parent = "2ad1fa4cd8afe3c920c8e6e04fe7a7df5cf8294e" +commit_url = "https://github.com/openrefine/simile-butterfly/commit/537f64bfa72746f8b21d4bda461fad843435319c" +vendored = false +host = "github" +path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java" +mode = "name" +relpath = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-10-19" +fix_lines = { in_function = 12, in_file = 13, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "main/src/edu/mit/simile/butterfly/ButterflyModuleImpl.java" +function = "getResource" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3p8v-w8mr-m3x8: Butterfly has path/URL confusion in resource handling leading to multiple weaknesses" + +[[pair]] +name = "oak-send-4b2f27e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "oakserver/oak" +cve = "CVE-2024-49770 GHSA-qm92-93fv-vh7m" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2024-11-01T21:37:10Z" +post_cutoff = false +commit = "4b2f27efd5cba5a45b2c3982e610da3af0869209" +parent = "3896fe568b25ac0b4c5afbf822ff8344c3d1712a" +commit_url = "https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209" +vendored = false +host = "github" +path = "send.ts" +mode = "name" +relpath = "send.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-11-01" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "send.ts" +function = "send" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-qm92-93fv-vh7m: Path traversal in oak allows transfer of hidden files within the served root directory" + +[[pair]] +name = "agentscope-delete-workflow-7d285e8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "modelscope/agentscope" +cve = "CVE-2024-8537 GHSA-c4cc-w454-4634" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-03-20T12:32:48Z" +post_cutoff = false +commit = "7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a" +parent = "6178c29bcbff044c5bab788c0eb364c0fe84baec" +commit_url = "https://github.com/modelscope/agentscope/commit/7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a" +vendored = false +host = "github" +path = "src/agentscope/studio/_app.py" +mode = "name" +relpath = "src/agentscope/studio/_app.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-11-28" +fix_lines = { in_function = 3, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/agentscope/studio/_app.py" +function = "_delete_workflow" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-c4cc-w454-4634: AgentScope path traversal vulnerability" + +[[pair]] +name = "djl-unzip-7415cc5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "deepjavalibrary/djl" +cve = "CVE-2025-0851 GHSA-jcrp-x7w3-ffmg" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2025-01-29T22:21:33Z" +post_cutoff = false +commit = "7415cc5f72aae69ea9716a5e4f709af03a77a619" +parent = "503289a69c581e2373e12cff78ea2adc03a8d86f" +commit_url = "https://github.com/deepjavalibrary/djl/commit/7415cc5f72aae69ea9716a5e4f709af03a77a619" +vendored = false +host = "github" +path = "api/src/main/java/ai/djl/util/ZipUtils.java" +mode = "name" +relpath = "api/src/main/java/ai/djl/util/ZipUtils.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-12-06" +fix_lines = { in_function = 10, in_file = 20, source_total = 34 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "api/src/main/java/ai/djl/util/ZipUtils.java" +function = "unzip" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-jcrp-x7w3-ffmg: Deep Java Library path traversal issue" + +[[pair]] +name = "carbon-resetmessages-129700e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "briannesbitt/carbon" +cve = "CVE-2025-22145 GHSA-j3f9-p6hm-5w6q" +cwe = "CWE-98" +ecosystem = "composer" +published_at = "2025-01-08T21:03:28Z" +post_cutoff = false +commit = "129700ed449b1f02d70272d2ac802357c8c30c58" +parent = "f01cfa96468f4c38325f507ab81a4f1d2cd93cfe" +commit_url = "https://github.com/briannesbitt/carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58" +vendored = false +host = "github" +path = "src/Carbon/AbstractTranslator.php" +mode = "name" +relpath = "src/Carbon/AbstractTranslator.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-12-27" +fix_lines = { in_function = 1, in_file = 2, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-98" +class = "file-inclusion" +path = "src/Carbon/AbstractTranslator.php" +function = "resetMessages" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-j3f9-p6hm-5w6q: Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale" + +[[pair]] +name = "browsershot-seturl-e327397" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "spatie/browsershot" +cve = "CVE-2025-1026 GHSA-f2q5-6mx7-q9qq" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2025-02-05T06:30:26Z" +post_cutoff = false +commit = "e3273974506865a24fbb5b65b534d8d4b8dfbf72" +parent = "bcfd608b264fab654bf78e199bdfbb03e9323eb7" +commit_url = "https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72" +vendored = false +host = "github" +path = "src/Browsershot.php" +mode = "name" +relpath = "src/Browsershot.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-12-30" +fix_lines = { in_function = 3, in_file = 5, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Browsershot.php" +function = "setUrl" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-f2q5-6mx7-q9qq: Browsershot Local File Inclusion" + +[[pair]] +name = "aws-sam-cli-copytree-462b4e0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "aws/aws-sam-cli" +cve = "CVE-2025-3048 GHSA-pp64-wj43-xqcr" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-03-31T22:36:52Z" +post_cutoff = false +commit = "462b4e07b873035c25e8abc9068bb3b76e06314c" +parent = "42ba2f712a8f5084d6da9677febdcdf495d816e7" +commit_url = "https://github.com/aws/aws-sam-cli/commit/462b4e07b873035c25e8abc9068bb3b76e06314c" +vendored = false +host = "github" +path = "samcli/lib/utils/osutils.py" +mode = "name" +relpath = "samcli/lib/utils/osutils.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-14" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "samcli/lib/utils/osutils.py" +function = "copytree" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pp64-wj43-xqcr: AWS SAM CLI Path Traversal allows file copy to local cache" + +[[pair]] +name = "solon-find-f46e47f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "opensolon/solon" +cve = "CVE-2025-1584 GHSA-x8q6-cchr-p7m6" +cwe = "CWE-23" +ecosystem = "maven" +published_at = "2025-02-23T15:30:58Z" +post_cutoff = false +commit = "f46e47fd1f8455b9467d7ead3cdb0509115b2ef1" +parent = "87474726f1e496b381ce9d5ebbadabd0e04c2d75" +commit_url = "https://github.com/opensolon/solon/commit/f46e47fd1f8455b9467d7ead3cdb0509115b2ef1" +vendored = false +host = "github" +path = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java" +mode = "name" +relpath = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-02-21" +fix_lines = { in_function = 26, in_file = 27, source_total = 39 } + +[[pair.expected]] +cwe = "CWE-23" +class = "path-traversal" +path = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java" +function = "find" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-x8q6-cchr-p7m6: Solon Path Traversal" + +[[pair]] +name = "setuptools-resolve-download-filename-250a6d1" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pypa/setuptools" +cve = "CVE-2025-47273 GHSA-5rjg-fvgr-3xxf" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-05-19T16:52:43Z" +post_cutoff = false +commit = "250a6d17978f9f6ac3ac887091f2d32886fbbb0b" +parent = "d8390feaa99091d1ba9626bec0e4ba7072fc507a" +commit_url = "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b" +vendored = false +host = "github" +path = "setuptools/package_index.py" +mode = "name" +relpath = "setuptools/package_index.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-04-19" +fix_lines = { in_function = 13, in_file = 17, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "setuptools/package_index.py" +function = "_resolve_download_filename" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5rjg-fvgr-3xxf: setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write" + +[[pair]] +name = "dagster-get-notebook-data-3a3cec2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "dagster-io/dagster" +cve = "CVE-2025-51481 GHSA-h7x8-jv97-fvvm" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-07-22T18:30:42Z" +post_cutoff = false +commit = "3a3cec2b51577c4970e6fc4c199cda6418c09a9d" +parent = "cb0f186667b55086346165fc8c00defa1f44a9c2" +commit_url = "https://github.com/dagster-io/dagster/commit/3a3cec2b51577c4970e6fc4c199cda6418c09a9d" +vendored = false +host = "github" +path = "python_modules/dagster/dagster/_grpc/impl.py" +mode = "name" +relpath = "python_modules/dagster/dagster/_grpc/impl.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-19" +fix_lines = { in_function = 9, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "python_modules/dagster/dagster/_grpc/impl.py" +function = "get_notebook_data" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-h7x8-jv97-fvvm: Dagster Local File Inclusion vulnerability" + +[[pair]] +name = "llama-index-load-data-a86c96a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "run-llama/llama_index" +cve = "CVE-2025-6210 GHSA-3j8r-jf9w-5cmh" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-07-07T12:30:23Z" +post_cutoff = false +commit = "a86c96ae0e662492eeb471b658ae849a93f628ff" +parent = "1359a5300b15216766aa0ac0db0173d2016e03bf" +commit_url = "https://github.com/run-llama/llama_index/commit/a86c96ae0e662492eeb471b658ae849a93f628ff" +vendored = false +host = "github" +path = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py" +mode = "name" +relpath = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-06-03" +fix_lines = { in_function = 5, in_file = 17, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py" +function = "load_data" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3j8r-jf9w-5cmh: LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit" + +[[pair]] +name = "salt-file-recv-c4ad23f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "saltstack/salt" +cve = "CVE-2024-38824 GHSA-8pcp-r83j-fc92" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-06-13T09:30:34Z" +post_cutoff = false +commit = "c4ad23f0f3132d8d8a88f19fa537dc42cf21b215" +parent = "5ff18fd0ececdfd083ddce693c3ccef30e44f155" +commit_url = "https://github.com/saltstack/salt/commit/c4ad23f0f3132d8d8a88f19fa537dc42cf21b215" +vendored = false +host = "github" +path = "salt/master.py" +mode = "name" +relpath = "salt/master.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-06-06" +fix_lines = { in_function = 7, in_file = 4, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "salt/master.py" +function = "_file_recv" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-8pcp-r83j-fc92: Salt vulnerable to directory traversal attack in file receiving method" + +[[pair]] +name = "ignite-gridlogcommandhandler-5c42c7a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/ignite" +cve = "CVE-2025-48977 GHSA-v45h-mqf4-6939" +cwe = "CWE-23" +ecosystem = "maven" +published_at = "2026-05-28T12:30:28Z" +post_cutoff = false +commit = "5c42c7a303937844179ad470edb35c1ad1cee6ab" +parent = "98550a68b8eb034fd0346b4f4798c9465d8aa7c6" +commit_url = "https://github.com/apache/ignite/commit/5c42c7a303937844179ad470edb35c1ad1cee6ab" +vendored = false +host = "github" +path = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java" +mode = "name" +relpath = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-06-13" +fix_lines = { in_function = 4, in_file = 12, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-23" +class = "path-traversal" +path = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java" +function = "GridLogCommandHandler" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-v45h-mqf4-6939: Apache Ignite REST API Has a Relative Path Traversal Vulnerability" + +[[pair]] +name = "ipx-resolvefile-81693dd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "unjs/ipx" +cve = "CVE-2025-54387 GHSA-mm3p-j368-7jcr" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-08-04T14:48:25Z" +post_cutoff = false +commit = "81693ddbfc062cc922e4e2406e8427ab4e3ad214" +parent = "df55edb9c49bb56536cc9277efb24557edacd747" +commit_url = "https://github.com/unjs/ipx/commit/81693ddbfc062cc922e4e2406e8427ab4e3ad214" +vendored = false +host = "github" +path = "src/storage/node-fs.ts" +mode = "name" +relpath = "src/storage/node-fs.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-07-24" +fix_lines = { in_function = 2, in_file = 1, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/storage/node-fs.ts" +function = "resolveFile" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-mm3p-j368-7jcr: IPX Allows Path Traversal via Prefix Matching Bypass" + +[[pair]] +name = "core-download-file-fe95f6e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "home-assistant/core" +cve = "CVE-2025-65713 GHSA-pp3g-xmm4-5cw9" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-12-23T18:30:27Z" +post_cutoff = false +commit = "fe95f6e1c5ebf15da0987c1a69fc23f05cbf36cf" +parent = "37510aa316bd46dbbd8f983fbfcec543eac7c704" +commit_url = "https://github.com/home-assistant/core/commit/fe95f6e1c5ebf15da0987c1a69fc23f05cbf36cf" +vendored = false +host = "github" +path = "homeassistant/components/downloader/services.py" +mode = "name" +relpath = "homeassistant/components/downloader/services.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-08-05" +fix_lines = { in_function = 28, in_file = 38, source_total = 41 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "homeassistant/components/downloader/services.py" +function = "download_file" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pp3g-xmm4-5cw9: Home Assistant Core before is vulnerable to Directory Traversal" + +[[pair]] +name = "auth0-php-fileexists-9026da5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "auth0/auth0-php" +cve = "CVE-2025-58769 GHSA-9mh6-g99m-ppcw" +cwe = "CWE-22" +ecosystem = "composer" +published_at = "2025-10-01T21:20:45Z" +post_cutoff = false +commit = "9026da58f5c381cd4cb5932de829eff6eacbb65c" +parent = "7f4414045fc7dc257baf8451a9cda2aacb7ed03b" +commit_url = "https://github.com/auth0/auth0-php/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c" +vendored = false +host = "github" +path = "src/Utility/Assert.php" +mode = "name" +relpath = "src/Utility/Assert.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-08-07" +fix_lines = { in_function = 6, in_file = 9, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Utility/Assert.php" +function = "fileExists" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-9mh6-g99m-ppcw: auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import" + +[[pair]] +name = "tiny-scientist-review-paper-7fd4287" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "ulab-uiuc/tiny-scientist" +cve = "CVE-2025-55149 GHSA-rrgf-hcr9-jq6h" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-08-11T13:38:14Z" +post_cutoff = false +commit = "7fd42873603012acb8c55a4fc3eaac9ab18e6559" +parent = "d0d4d6ed91c378d5201ac60dcd8e7c3303412d66" +commit_url = "https://github.com/ulab-uiuc/tiny-scientist/commit/7fd42873603012acb8c55a4fc3eaac9ab18e6559" +vendored = false +host = "github" +path = "backend/app.py" +mode = "name" +relpath = "backend/app.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-08-08" +fix_lines = { in_function = 8, in_file = 10, source_total = 14 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "backend/app.py" +function = "review_paper" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-rrgf-hcr9-jq6h: TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)" + +[[pair]] +name = "vite-plugin-static-copy-vialocal-0bc6b49" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "sapphi-red/vite-plugin-static-copy" +cve = "CVE-2025-57753 GHSA-pp7p-q8fx-2968" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-08-21T14:53:52Z" +post_cutoff = false +commit = "0bc6b49ed72b46eecfc9682045f4b46a19694969" +parent = "14895079087ea926826baf62cabb4ec31cbe758a" +commit_url = "https://github.com/sapphi-red/vite-plugin-static-copy/commit/0bc6b49ed72b46eecfc9682045f4b46a19694969" +vendored = false +host = "github" +path = "src/middleware.ts" +mode = "name" +relpath = "src/middleware.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-08-21" +fix_lines = { in_function = 6, in_file = 15, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/middleware.ts" +function = "viaLocal" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pp7p-q8fx-2968: vite-plugin-static-copy files not included in `src` are possible to access with a crafted request" + +[[pair]] +name = "tar-fs-incwd-0bd54cd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "mafintosh/tar-fs" +cve = "CVE-2025-59343 GHSA-vj76-c3g6-qr5v" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-09-24T18:57:04Z" +post_cutoff = false +commit = "0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09" +parent = "cb1c571fba8ec6dd56340f55dcd5d284372a8249" +commit_url = "https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09" +vendored = false +host = "github" +path = "index.js" +mode = "name" +relpath = "index.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-09-16" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "index.js" +function = "inCwd" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vj76-c3g6-qr5v: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball" + +[[pair]] +name = "dosage-connect-336a968" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "webcomics/dosage" +cve = "CVE-2025-64184 GHSA-4vcx-3pj3-44m7" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2025-11-04T15:31:48Z" +post_cutoff = false +commit = "336a9684191604bc49eed7296b74bd582151181e" +parent = "8af120b2473c63fc582b9b545c86efe4369f2301" +commit_url = "https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e" +vendored = false +host = "github" +path = "dosagelib/comic.py" +mode = "name" +relpath = "dosagelib/comic.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-01" +fix_lines = { in_function = 11, in_file = 12, source_total = 16 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "dosagelib/comic.py" +function = "connect" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-4vcx-3pj3-44m7: Dosage vulnerable to a Directory Traversal through crafted HTTP responses" + +[[pair]] +name = "unstructured-attachment-file-name-b01d35b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "unstructured-io/unstructured" +cve = "CVE-2025-64712 GHSA-gm8q-m8mv-jj5m" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-02-03T17:43:56Z" +post_cutoff = false +commit = "b01d35b2373fd087d2e15162b9c021663c97155d" +parent = "1c519efef5f888ae02ee4621b213eda527662d5f" +commit_url = "https://github.com/unstructured-io/unstructured/commit/b01d35b2373fd087d2e15162b9c021663c97155d" +vendored = false +host = "github" +path = "unstructured/partition/msg.py" +mode = "name" +relpath = "unstructured/partition/msg.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-11-06" +fix_lines = { in_function = 8, in_file = 16, source_total = 19 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "unstructured/partition/msg.py" +function = "_attachment_file_name" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gm8q-m8mv-jj5m: Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write" + +[[pair]] +name = "pebble-getfile-b3451c8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "pebbletemplates/pebble" +cve = "CVE-2025-1686 GHSA-p75g-cxfj-7wrx" +cwe = "CWE-73" +ecosystem = "maven" +published_at = "2025-02-28T19:45:03Z" +post_cutoff = false +commit = "b3451c8f305a1a248fbcc2363fd307d0baaee329" +parent = "a5a38beb9cee15546b03f0d74ff3facf51b2d181" +commit_url = "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329" +vendored = false +host = "github" +path = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java" +mode = "name" +relpath = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-12-11" +fix_lines = { in_function = 23, in_file = 96, source_total = 135 } + +[[pair.expected]] +cwe = "CWE-73" +class = "path-traversal" +path = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java" +function = "getFile" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-p75g-cxfj-7wrx: Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro" + +[[pair]] +name = "vite-plugin-react-findsourcemapurl-582fba0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "vitejs/vite-plugin-react" +cve = "CVE-2025-68155 GHSA-g239-q96q-x4qm" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2025-12-16T22:32:26Z" +post_cutoff = false +commit = "582fba0b9a52b13fcff6beaaa3bfbd532bc5359d" +parent = "329c40a600dedc790fca36f2d460dc3d40186f7c" +commit_url = "https://github.com/vitejs/vite-plugin-react/commit/582fba0b9a52b13fcff6beaaa3bfbd532bc5359d" +vendored = false +host = "github" +path = "packages/plugin-rsc/src/plugins/find-source-map-url.ts" +mode = "name" +relpath = "packages/plugin-rsc/src/plugins/find-source-map-url.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-16" +fix_lines = { in_function = 5, in_file = 10, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "packages/plugin-rsc/src/plugins/find-source-map-url.ts" +function = "findSourceMapURL" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-g239-q96q-x4qm: @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint" + +[[pair]] +name = "bodyparser-markasmoved-143a16f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "adonisjs/bodyparser" +cve = "CVE-2026-21440 GHSA-gvq6-hvvp-h34h" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-01-02T18:58:32Z" +post_cutoff = false +commit = "143a16f35602be8561215611582211dec280cae6" +parent = "890b2c9820f9fdf2b2b0eaa709fecd920087e96c" +commit_url = "https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6" +vendored = false +host = "github" +path = "src/multipart/file.ts" +mode = "name" +relpath = "src/multipart/file.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-02" +fix_lines = { in_function = 5, in_file = 5, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/multipart/file.ts" +function = "markAsMoved" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gvq6-hvvp-h34h: AdonisJS Path Traversal in Multipart File Handling" + +[[pair]] +name = "pnpm-getbinsfrompackagemanifest-17432ad" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "pnpm/pnpm" +cve = "CVE-2026-24131 GHSA-v253-rj99-jwpq" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-01-26T21:29:58Z" +post_cutoff = false +commit = "17432ad5bbed5c2e77255ca6d56a1449bbcfd943" +parent = "b277b45bc35ae77ca72d7634d144bbd58a48b70f" +commit_url = "https://github.com/pnpm/pnpm/commit/17432ad5bbed5c2e77255ca6d56a1449bbcfd943" +vendored = false +host = "github" +path = "pkg-manager/package-bins/src/index.ts" +mode = "name" +relpath = "pkg-manager/package-bins/src/index.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-21" +fix_lines = { in_function = 3, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pkg-manager/package-bins/src/index.ts" +function = "getBinsFromPackageManifest" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-v253-rj99-jwpq: pnpm has Path Traversal via arbitrary file permission modification " + +[[pair]] +name = "wheel-unpack-7a7d2de" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pypa/wheel" +cve = "CVE-2026-24049 GHSA-8rrh-rw8j-w5fx" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-01-22T18:02:56Z" +post_cutoff = false +commit = "7a7d2de96b22a9adf9208afcc9547e1001569fef" +parent = "41418fac233d6973ea8798d620df4aa5b3aa1b66" +commit_url = "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef" +vendored = false +host = "github" +path = "src/wheel/_commands/unpack.py" +mode = "name" +relpath = "src/wheel/_commands/unpack.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-21" +fix_lines = { in_function = 4, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/wheel/_commands/unpack.py" +function = "unpack" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-8rrh-rw8j-w5fx: Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack" + +[[pair]] +name = "openchatbi-save-report-372a7e8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "zhongyu09/openchatbi" +cve = "CVE-2026-28795 GHSA-vmwq-8g8c-jm79" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-02T21:47:32Z" +post_cutoff = false +commit = "372a7e861da5159c3106d64d6f6edf8284db8c75" +parent = "235291864f2d4aa0b40e445a00c3766001d6f3bf" +commit_url = "https://github.com/zhongyu09/openchatbi/commit/372a7e861da5159c3106d64d6f6edf8284db8c75" +vendored = false +host = "github" +path = "openchatbi/tool/save_report.py" +mode = "name" +relpath = "openchatbi/tool/save_report.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-01-27" +fix_lines = { in_function = 6, in_file = 10, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "openchatbi/tool/save_report.py" +function = "save_report" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-vmwq-8g8c-jm79: OpenChatBI has a Path Traversal Vulnerability in save_report Tool" + +[[pair]] +name = "clasp-fetchremote-ba6bd66" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "google/clasp" +cve = "CVE-2026-4092 GHSA-hqjg-pww4-pcgq" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-03-13T20:57:29Z" +post_cutoff = false +commit = "ba6bd666fe74de54950122b5d92ecf1dcc02a9d3" +parent = "56f0e6274c2daa2c0928d44fe50c517b188c11f5" +commit_url = "https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3" +vendored = false +host = "github" +path = "src/core/files.ts" +mode = "name" +relpath = "src/core/files.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-01-31" +fix_lines = { in_function = 17, in_file = 49, source_total = 54 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/core/files.ts" +function = "fetchRemote" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-hqjg-pww4-pcgq: @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script" + +[[pair]] +name = "basic-ftp-downloadfromworkingdir-2a2a0e6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "patrickjuchli/basic-ftp" +cve = "CVE-2026-27699 GHSA-5rq4-664w-9x2c" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-02-25T22:34:26Z" +post_cutoff = false +commit = "2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9" +parent = "65c90d949c0f8a9709759dff9e76bbe07061812b" +commit_url = "https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9" +vendored = false +host = "github" +path = "src/Client.ts" +mode = "name" +relpath = "src/Client.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-23" +fix_lines = { in_function = 6, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/Client.ts" +function = "_downloadFromWorkingDir" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5rq4-664w-9x2c: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method" + +[[pair]] +name = "mcp-atlassian-download-attachment-52b9b09" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "sooperset/mcp-atlassian" +cve = "CVE-2026-27825 GHSA-xjgw-4wvw-rgm4" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-10T18:56:07Z" +post_cutoff = false +commit = "52b9b0997681e87244b20d58034deae89c91631e" +parent = "ab36f8161bba807b16964f2c6124174c9eca1acf" +commit_url = "https://github.com/sooperset/mcp-atlassian/commit/52b9b0997681e87244b20d58034deae89c91631e" +vendored = false +host = "github" +path = "src/mcp_atlassian/jira/attachments.py" +mode = "name" +relpath = "src/mcp_atlassian/jira/attachments.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-24" +fix_lines = { in_function = 6, in_file = 13, source_total = 68 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/mcp_atlassian/jira/attachments.py" +function = "download_attachment" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-xjgw-4wvw-rgm4: MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment" + +[[pair]] +name = "bentoml-safe-extract-tarfile-4e0eb00" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "bentoml/bentoml" +cve = "CVE-2026-27905 GHSA-m6w7-qv66-g3mf" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-03T17:46:47Z" +post_cutoff = false +commit = "4e0eb007765ac04c7924220d643f264715cc9670" +parent = "3ba9d54637312aa2a9c7c35540c18c30317cac3f" +commit_url = "https://github.com/bentoml/bentoml/commit/4e0eb007765ac04c7924220d643f264715cc9670" +vendored = false +host = "github" +path = "src/bentoml/_internal/utils/filesystem.py" +mode = "name" +relpath = "src/bentoml/_internal/utils/filesystem.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-02-25" +fix_lines = { in_function = 24, in_file = 22, source_total = 24 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/bentoml/_internal/utils/filesystem.py" +function = "safe_extract_tarfile" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-m6w7-qv66-g3mf: BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction" + +[[pair]] +name = "dbt-common-safe-extract-e547954" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "dbt-labs/dbt-common" +cve = "CVE-2026-29790 GHSA-w75w-9qv4-j5xj" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-05T00:59:10Z" +post_cutoff = false +commit = "e547954a48bac9394ef6eb98432e429dce9a7709" +parent = "e10b8aca2164c632cf0ab5fdbb16db0ec9176189" +commit_url = "https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709" +vendored = false +host = "github" +path = "dbt_common/clients/system.py" +mode = "name" +relpath = "dbt_common/clients/system.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-27" +fix_lines = { in_function = 10, in_file = 9, source_total = 12 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "dbt_common/clients/system.py" +function = "safe_extract" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-w75w-9qv4-j5xj: dbt-common's commonprefix() doesn't protect against path traversal" + +[[pair]] +name = "black-get-cache-key-4937fe6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "psf/black" +cve = "CVE-2026-32274 GHSA-3936-cmfr-pm3m" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-12T18:33:10Z" +post_cutoff = false +commit = "4937fe6cf241139ddbfc16b0bdbb5b422798909d" +parent = "2e641d174469c505d5ae905e75d4c769597e681f" +commit_url = "https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d" +vendored = false +host = "github" +path = "src/black/mode.py" +mode = "name" +relpath = "src/black/mode.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-12" +fix_lines = { in_function = 7, in_file = 4, source_total = 28 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/black/mode.py" +function = "get_cache_key" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-3936-cmfr-pm3m: Black: Arbitrary file writes from unsanitized user input in cache file name" + +[[pair]] +name = "agixt-safe-join-2079ea5" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "josh-xt/agixt" +cve = "CVE-2026-39981 GHSA-5gfj-64gh-mgmw" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-08T20:02:01Z" +post_cutoff = false +commit = "2079ea5a88fa671a921bf0b5eba887a5a1b73d5f" +parent = "872f519fcc75eb574d717ea10ca91fc089718ffe" +commit_url = "https://github.com/josh-xt/agixt/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f" +vendored = false +host = "github" +path = "agixt/extensions/essential_abilities.py" +mode = "name" +relpath = "agixt/extensions/essential_abilities.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-15" +fix_lines = { in_function = 14, in_file = 14, source_total = 17 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "agixt/extensions/essential_abilities.py" +function = "safe_join" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5gfj-64gh-mgmw: AGiXT Vulnerable to Path Traversal in safe_join()" + +[[pair]] +name = "mesop-make-file-path-c6b382f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "mesop-dev/mesop" +cve = "CVE-2026-33054 GHSA-8qvf-mr4w-9x2c" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-03-18T20:01:21Z" +post_cutoff = false +commit = "c6b382f363b73ac32c402a2db3aadc7784f66a5b" +parent = "712aafffd458def75e2f2fe4bd94d430436921e3" +commit_url = "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b" +vendored = false +host = "github" +path = "mesop/server/state_session.py" +mode = "name" +relpath = "mesop/server/state_session.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-15" +fix_lines = { in_function = 7, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "mesop/server/state_session.py" +function = "_make_file_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-8qvf-mr4w-9x2c: Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion" + +[[pair]] +name = "kedro-plugins-partition-to-path-65115f7" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "kedro-org/kedro-plugins" +cve = "CVE-2026-35492 GHSA-cjg8-h5qc-hrjv" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-06T17:55:14Z" +post_cutoff = false +commit = "65115f76b872217317734b6bde8927170c98fc4b" +parent = "df4b6a65ca75dbd3efed38362d2a045c746ab9ad" +commit_url = "https://github.com/kedro-org/kedro-plugins/commit/65115f76b872217317734b6bde8927170c98fc4b" +vendored = false +host = "github" +path = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py" +mode = "name" +relpath = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-18" +fix_lines = { in_function = 9, in_file = 51, source_total = 55 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py" +function = "_partition_to_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-cjg8-h5qc-hrjv: kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write" + +[[pair]] +name = "anthropic-sdk-typescript-validatenosymlinkescape-0ac69b3" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "anthropics/anthropic-sdk-typescript" +cve = "CVE-2026-34451 GHSA-5474-4w2j-mq4c" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-04-01T21:16:49Z" +post_cutoff = false +commit = "0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9" +parent = "284561fe36b244f5b6ab624ec2608c07f71f476e" +commit_url = "https://github.com/anthropics/anthropic-sdk-typescript/commit/0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9" +vendored = false +host = "github" +path = "src/tools/memory/node.ts" +mode = "name" +relpath = "src/tools/memory/node.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-31" +fix_lines = { in_function = 2, in_file = 2, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/tools/memory/node.ts" +function = "validateNoSymlinkEscape" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5474-4w2j-mq4c: Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories" + +[[pair]] +name = "copier-external-data-5413062" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "copier-org/copier" +cve = "CVE-2026-34730 GHSA-hgjq-p8cr-gg4h" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-01T22:38:39Z" +post_cutoff = false +commit = "5413062eb17b73dc885f5e645cdc161e69ef641b" +parent = "cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df" +commit_url = "https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b" +vendored = false +host = "github" +path = "copier/_main.py" +mode = "name" +relpath = "copier/_main.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-31" +fix_lines = { in_function = 22, in_file = 22, source_total = 27 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "copier/_main.py" +function = "_external_data" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-hgjq-p8cr-gg4h: Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode" + +[[pair]] +name = "vite-transformmiddleware-79f002f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "vitejs/vite" +cve = "CVE-2026-39365 GHSA-4w7w-66w2-5vf9" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-04-06T18:03:46Z" +post_cutoff = false +commit = "79f002f2286c03c88c7b74c511c7f9fc6dc46694" +parent = "a9a3df299378d9cbc5f069e3536a369f8188c8ff" +commit_url = "https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694" +vendored = false +host = "github" +path = "packages/vite/src/node/server/middlewares/transform.ts" +mode = "name" +relpath = "packages/vite/src/node/server/middlewares/transform.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-06" +fix_lines = { in_function = 3, in_file = 4, source_total = 4 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "packages/vite/src/node/server/middlewares/transform.ts" +function = "transformMiddleware" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-4w7w-66w2-5vf9: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling" + +[[pair]] +name = "nicegui-create-file-upload-d38a702" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "zauberzeug/nicegui" +cve = "CVE-2026-39844 GHSA-w8wv-vfpc-hw2w" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-08T15:04:13Z" +post_cutoff = false +commit = "d38a702e3af2da5b0708f689be8d71413fc77056" +parent = "2580928afff6e34d31b77ff22769d773feb817a8" +commit_url = "https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056" +vendored = false +host = "github" +path = "nicegui/elements/upload_files.py" +mode = "name" +relpath = "nicegui/elements/upload_files.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-07" +fix_lines = { in_function = 2, in_file = 7, source_total = 9 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "nicegui/elements/upload_files.py" +function = "create_file_upload" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-w8wv-vfpc-hw2w: NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows" + +[[pair]] +name = "quarkus-openapi-generator-unzip-08b4064" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "quarkiverse/quarkus-openapi-generator" +cve = "CVE-2026-40180 GHSA-jx2w-vp7f-456q" +cwe = "CWE-22" +ecosystem = "maven" +published_at = "2026-04-08T19:14:32Z" +post_cutoff = false +commit = "08b406414ff30ed192e86c7fa924e57565534ff0" +parent = "e062c8c9fff0ff9d4f025bb77101155acf786232" +commit_url = "https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0" +vendored = false +host = "github" +path = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java" +mode = "name" +relpath = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-07" +fix_lines = { in_function = 7, in_file = 7, source_total = 7 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java" +function = "unzip" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-jx2w-vp7f-456q: quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class" + +[[pair]] +name = "excel-mcp-server-get-excel-path-f51340e" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "haris-musa/excel-mcp-server" +cve = "CVE-2026-40576 GHSA-j98m-w3xp-9f56" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-14T00:03:17Z" +post_cutoff = false +commit = "f51340ecd5778952405044b203d3a2d4c8a46833" +parent = "de4dc75f6ba629ccd2e097f5963235846be622e6" +commit_url = "https://github.com/haris-musa/excel-mcp-server/commit/f51340ecd5778952405044b203d3a2d4c8a46833" +vendored = false +host = "github" +path = "src/excel_mcp/server.py" +mode = "name" +relpath = "src/excel_mcp/server.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-12" +fix_lines = { in_function = 16, in_file = 31, source_total = 39 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/excel_mcp/server.py" +function = "get_excel_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-j98m-w3xp-9f56: excel-mcp-server has a Path Traversal issue" + +[[pair]] +name = "psitransfer-getfilename-8b547bf" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "BSD-2-Clause" +repo = "psi-4ward/psitransfer" +cve = "CVE-2026-41180 GHSA-533q-w4g6-5586" +cwe = "CWE-22" +ecosystem = "npm" +published_at = "2026-04-16T21:13:40Z" +post_cutoff = false +commit = "8b547bf3e09757122efa00aab90281e3915aa0c6" +parent = "22ec552e6d579c1c859a9523810153289f3fb43b" +commit_url = "https://github.com/psi-4ward/psitransfer/commit/8b547bf3e09757122efa00aab90281e3915aa0c6" +vendored = false +host = "github" +path = "lib/store.js" +mode = "name" +relpath = "lib/store.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-14" +fix_lines = { in_function = 11, in_file = 10, source_total = 121 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "lib/store.js" +function = "getFilename" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-533q-w4g6-5586: PsiTransfer: Upload PATCH path traversal can create `config..js` and lead to code execution on restart" + +[[pair]] +name = "pptagent-get-html-table-image-418491a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "icip-cas/pptagent" +cve = "CVE-2026-42080 GHSA-pxhg-7xr2-w7xg" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-05T18:57:31Z" +post_cutoff = false +commit = "418491a9a1c02d9d93194b5973bb58df35cf9d00" +parent = "858da237342f4fdf9e6c3e47baaef6f44647c8f0" +commit_url = "https://github.com/icip-cas/pptagent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00" +vendored = false +host = "github" +path = "pptagent/utils.py" +mode = "name" +relpath = "pptagent/utils.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-19" +fix_lines = { in_function = 5, in_file = 25, source_total = 35 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pptagent/utils.py" +function = "get_html_table_image" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-pxhg-7xr2-w7xg: PPTAgent: Arbitrary File Write via `save_generated_slides`" + +[[pair]] +name = "pygeoapi-get-data-path-bf25b86" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "geopython/pygeoapi" +cve = "CVE-2026-42351 GHSA-f6pr-83pg-ghh6" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-04-29T22:18:02Z" +post_cutoff = false +commit = "bf25b8695edbdd5476eeffc102b633d1d3e45f52" +parent = "e80347d782ca4a076a2825920b0082701ceef909" +commit_url = "https://github.com/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52" +vendored = false +host = "github" +path = "pygeoapi/provider/filesystem.py" +mode = "name" +relpath = "pygeoapi/provider/filesystem.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-20" +fix_lines = { in_function = 6, in_file = 9, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "pygeoapi/provider/filesystem.py" +function = "get_data_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-f6pr-83pg-ghh6: pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider" + +[[pair]] +name = "grav-plugin-form-uploadfiles-48bacc4" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "getgrav/grav-plugin-form" +cve = "CVE-2026-42845 GHSA-w4rc-p66m-x6qq" +cwe = "CWE-73" +ecosystem = "composer" +published_at = "2026-05-06T23:03:13Z" +post_cutoff = false +commit = "48bacc4187e1cff815000e526d5ca2878484867f" +parent = "2032e77857e4fd1662357a9411b490c6c725da43" +commit_url = "https://github.com/getgrav/grav-plugin-form/commit/48bacc4187e1cff815000e526d5ca2878484867f" +vendored = false +host = "github" +path = "classes/Form.php" +mode = "name" +relpath = "classes/Form.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-04-29" +fix_lines = { in_function = 10, in_file = 20, source_total = 21 } + +[[pair.expected]] +cwe = "CWE-73" +class = "path-traversal" +path = "classes/Form.php" +function = "uploadFiles" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-w4rc-p66m-x6qq: Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override" + +[[pair]] +name = "taipy-get-resource-129fd40" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "avaiga/taipy" +cve = "CVE-2026-48544 GHSA-28gh-q3gw-pvx8" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-27T15:33:26Z" +post_cutoff = false +commit = "129fd407ffca49ee4ab853772c88d0c873e038dd" +parent = "d8556b92128defb4ea079e8776b1385cdc17e3fa" +commit_url = "https://github.com/avaiga/taipy/commit/129fd407ffca49ee4ab853772c88d0c873e038dd" +vendored = false +host = "github" +path = "taipy/gui/extension/library.py" +mode = "name" +relpath = "taipy/gui/extension/library.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-04-30" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "taipy/gui/extension/library.py" +function = "get_resource" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-28gh-q3gw-pvx8: Taipy contains a path traversal vulnerability" + +[[pair]] +name = "jupyter-server-get-os-path-0d829f2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "jupyter-server/jupyter_server" +cve = "CVE-2026-5422 GHSA-gf7q-q4j7-hp7c" +cwe = "CWE-23" +ecosystem = "pip" +published_at = "2026-06-02T12:31:26Z" +post_cutoff = true +commit = "0d829f2c35a481c3b24ecbe1e25a6f79954e88f2" +parent = "5869e779566352371904d0aed9407265148c0f78" +commit_url = "https://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2" +vendored = false +host = "github" +path = "jupyter_server/services/contents/fileio.py" +mode = "name" +relpath = "jupyter_server/services/contents/fileio.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-06" +fix_lines = { in_function = 5, in_file = 4, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-23" +class = "path-traversal" +path = "jupyter_server/services/contents/fileio.py" +function = "_get_os_path" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-gf7q-q4j7-hp7c: Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() " + +[[pair]] +name = "apm-looks-like-legacy-apm-bundle-77d1dda" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "microsoft/apm" +cve = "CVE-2026-46383 GHSA-mq5j-pw29-jcv3" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-15T18:25:34Z" +post_cutoff = false +commit = "77d1dda8303c8d7ccb6148788a6274fdece98499" +parent = "f85b9f54ad303159f9c448268eb7005c319fe02a" +commit_url = "https://github.com/microsoft/apm/commit/77d1dda8303c8d7ccb6148788a6274fdece98499" +vendored = false +host = "github" +path = "src/apm_cli/bundle/local_bundle.py" +mode = "name" +relpath = "src/apm_cli/bundle/local_bundle.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-11" +fix_lines = { in_function = 13, in_file = 12, source_total = 33 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/apm_cli/bundle/local_bundle.py" +function = "_looks_like_legacy_apm_bundle" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-mq5j-pw29-jcv3: Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`" + +[[pair]] +name = "pdm-write-to-fs-41aa5f9" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "pdm-project/pdm" +cve = "CVE-2026-47764 GHSA-78v8-vpjp-cjqh" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-06-10T20:33:13Z" +post_cutoff = true +commit = "41aa5f94a30e51b1a460af27312dd9dc532aad5a" +parent = "904e1dded8f36fc21373db5b731a5801a6a1f2d9" +commit_url = "https://github.com/pdm-project/pdm/commit/41aa5f94a30e51b1a460af27312dd9dc532aad5a" +vendored = false +host = "github" +path = "src/pdm/installers/installers.py" +mode = "name" +relpath = "src/pdm/installers/installers.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-05-20" +fix_lines = { in_function = 12, in_file = 14, source_total = 24 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "src/pdm/installers/installers.py" +function = "write_to_fs" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-78v8-vpjp-cjqh: PDM wheel installation leads to Path Traversal via overridden write_to_fs" + +[[pair]] +name = "xiaomusic-music-file-88404da" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "hanxi/xiaomusic" +cve = "CVE-2026-10108 GHSA-5j8p-5rrj-8wjg" +cwe = "CWE-22" +ecosystem = "pip" +published_at = "2026-05-29T18:31:35Z" +post_cutoff = false +commit = "88404da7a283f2c0a796a4cd16bbb6e6aa1f4722" +parent = "c6679a69e4295a7e508f5ec157b60c5ac5b8a041" +commit_url = "https://github.com/hanxi/xiaomusic/commit/88404da7a283f2c0a796a4cd16bbb6e6aa1f4722" +vendored = false +host = "github" +path = "xiaomusic/api/routers/file.py" +mode = "name" +relpath = "xiaomusic/api/routers/file.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-05-26" +fix_lines = { in_function = 4, in_file = 3, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-22" +class = "path-traversal" +path = "xiaomusic/api/routers/file.py" +function = "music_file" +mechanism = "path_join_user_input" +family = "path" +evidence = "GHSA-5j8p-5rrj-8wjg: xiaomusic contains an unauthenticated path traversal vulnerability" + +[[pair]] +name = "serializer-decode-0943a06" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "symfony/serializer" +cve = "GHSA-j68w-pg49-f6vx" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2024-05-30T00:52:20Z" +post_cutoff = false +commit = "0943a06a663b573d7319fc1acd56d3484eaaa430" +parent = "d89f7d242d1bdf0c281bb498c840538c8071ec10" +commit_url = "https://github.com/symfony/serializer/commit/0943a06a663b573d7319fc1acd56d3484eaaa430" +vendored = false +host = "github" +path = "Encoder/XmlEncoder.php" +mode = "name" +relpath = "Encoder/XmlEncoder.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2012-02-24" +fix_lines = { in_function = 8, in_file = 11, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "Encoder/XmlEncoder.php" +function = "decode" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-j68w-pg49-f6vx: Symfony XML decoding attack vector through external entities" + +[[pair]] +name = "dependency-injection-parsefile-5c5040c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "symfony/dependency-injection" +cve = "GHSA-c636-cg5r-2498" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2024-05-29T19:59:13Z" +post_cutoff = false +commit = "5c5040c890a8e4085dcd6fa3827f574ab5f71f4c" +parent = "e2f9fee8ec36209fee64ee15a73fd5e0e8372652" +commit_url = "https://github.com/symfony/dependency-injection/commit/5c5040c890a8e4085dcd6fa3827f574ab5f71f4c" +vendored = false +host = "github" +path = "Loader/XmlFileLoader.php" +mode = "name" +relpath = "Loader/XmlFileLoader.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2012-08-28" +fix_lines = { in_function = 5, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "Loader/XmlFileLoader.php" +function = "parseFile" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-c636-cg5r-2498: Symfony XML Entity Expansion security vulnerability" + +[[pair]] +name = "routing-loadfile-769e8e6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "symfony/routing" +cve = "GHSA-rjpm-qmq7-q85w" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2024-05-30T00:49:54Z" +post_cutoff = false +commit = "769e8e6584c5d13e7c6f51aa77a9d5f977fec463" +parent = "4ff9294af0ce24d40aec58ef39b1550732586bd8" +commit_url = "https://github.com/symfony/routing/commit/769e8e6584c5d13e7c6f51aa77a9d5f977fec463" +vendored = false +host = "github" +path = "Loader/XmlFileLoader.php" +mode = "name" +relpath = "Loader/XmlFileLoader.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2012-08-28" +fix_lines = { in_function = 5, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "Loader/XmlFileLoader.php" +function = "loadFile" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-rjpm-qmq7-q85w: Symfony XXE security vulnerability" + +[[pair]] +name = "silverstripe-seed-onbeforesecuritylogin-b065ebd" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "BSD-3-Clause" +repo = "symbiote/silverstripe-seed" +cve = "CVE-2017-20164 GHSA-wm32-3r4m-jvcc" +cwe = "CWE-601" +ecosystem = "composer" +published_at = "2023-01-07T21:30:38Z" +post_cutoff = false +commit = "b065ebd82da53009d273aa7e989191f701485244" +parent = "573d695aa7ed4d68c70cc3d2de3728051b4b495d" +commit_url = "https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244" +vendored = false +host = "github" +path = "code/extensions/SecurityLoginExtension.php" +mode = "name" +relpath = "code/extensions/SecurityLoginExtension.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2017-02-16" +fix_lines = { in_function = 2, in_file = 1, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "code/extensions/SecurityLoginExtension.php" +function = "onBeforeSecurityLogin" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-wm32-3r4m-jvcc: Symbiote Seed Open Redirect vulnerability" + +[[pair]] +name = "urllib3-init-adb358f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "urllib3/urllib3" +cve = "CVE-2018-25091 GHSA-gwvm-45gx-3cf8" +cwe = "CWE-601" +ecosystem = "pip" +published_at = "2023-10-15T21:30:26Z" +post_cutoff = false +commit = "adb358f8e06865406d1f05e581a16cbea2136fbc" +parent = "a252e2549ff797fe13e688f05296fa496e0c469a" +commit_url = "https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc" +vendored = false +host = "github" +path = "src/urllib3/util/retry.py" +mode = "name" +relpath = "src/urllib3/util/retry.py" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2018-12-29" +fix_lines = { in_function = 3, in_file = 2, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "src/urllib3/util/retry.py" +function = "__init__" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-gwvm-45gx-3cf8: Authorization Header forwarded on redirect" + +[[pair]] +name = "seotools-maketag-ca27cd0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "artesaos/seotools" +cve = "CVE-2020-36665 GHSA-w2x5-hpmg-j98h" +cwe = "CWE-601" +ecosystem = "composer" +published_at = "2023-07-06T19:24:11Z" +post_cutoff = false +commit = "ca27cd0edf917e0bc805227013859b8b5a1f01fb" +parent = "445c0bf0ddbd7cdc271d2887d25009a0e1ff2cb6" +commit_url = "https://github.com/artesaos/seotools/commit/ca27cd0edf917e0bc805227013859b8b5a1f01fb" +vendored = false +host = "github" +path = "src/SEOTools/OpenGraph.php" +mode = "name" +relpath = "src/SEOTools/OpenGraph.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2020-04-02" +fix_lines = { in_function = 1, in_file = 1, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "src/SEOTools/OpenGraph.php" +function = "makeTag" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-w2x5-hpmg-j98h: Artesãos SEOTools Open Redirect vulnerability" + +[[pair]] +name = "axmlrpc-parse-ad6615b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "gturri/axmlrpc" +cve = "CVE-2020-36641 GHSA-g4r8-28fp-f255" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2023-01-05T12:30:27Z" +post_cutoff = false +commit = "ad6615b3ec41353e614f6ea5fdd5b046442a832b" +parent = "2e59d03c961607d32bc9dc5e7aba931338907603" +commit_url = "https://github.com/gturri/axmlrpc/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b" +vendored = false +host = "github" +path = "src/main/java/de/timroes/axmlrpc/ResponseParser.java" +mode = "name" +relpath = "src/main/java/de/timroes/axmlrpc/ResponseParser.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2020-10-15" +fix_lines = { in_function = 6, in_file = 10, source_total = 11 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/main/java/de/timroes/axmlrpc/ResponseParser.java" +function = "parse" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-g4r8-28fp-f255: aXMLRPC XML External Entity vulnerability" + +[[pair]] +name = "neo4j-apoc-procedures-parsexml-c3e2a29" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "neo4j-contrib/neo4j-apoc-procedures" +cve = "GHSA-9vx8-f5c4-862x" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2023-02-24T17:39:18Z" +post_cutoff = false +commit = "c3e2a29020497acf9417879f38e8af4e8c6d5783" +parent = "1b60237168679daed62edcdb1260d5fc790329ab" +commit_url = "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/c3e2a29020497acf9417879f38e8af4e8c6d5783" +vendored = false +host = "github" +path = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java" +mode = "name" +relpath = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-02-13" +fix_lines = { in_function = 9, in_file = 13, source_total = 13 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java" +function = "parseXML" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-9vx8-f5c4-862x: XML External Entity (XXE) vulnerability in apoc.import.graphml" + +[[pair]] +name = "keycloak-nodejs-connect-forcechecksso-190a947" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "keycloak/keycloak-nodejs-connect" +cve = "CVE-2022-2237 GHSA-59fq-727j-hm3f" +cwe = "CWE-601" +ecosystem = "npm" +published_at = "2023-03-02T23:21:02Z" +post_cutoff = false +commit = "190a9470e234bbd9ac5d5de43f5a19aead9a2c21" +parent = "e4bd6b7bc8116432bf8fde87c5f06417005f88ea" +commit_url = "https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21" +vendored = false +host = "github" +path = "middleware/check-sso.js" +mode = "name" +relpath = "middleware/check-sso.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-03-01" +fix_lines = { in_function = 2, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "middleware/check-sso.js" +function = "forceCheckSSO" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-59fq-727j-hm3f: keycloak-connect contains Open redirect vulnerability in the Node.js adapter" + +[[pair]] +name = "mstest-plugin-containsdata-f9b9b0c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "MIT" +repo = "jenkinsci/mstest-plugin" +cve = "CVE-2023-24441 GHSA-3ppr-72x5-x67q" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2023-01-26T21:30:18Z" +post_cutoff = false +commit = "f9b9b0cbdf7559fdd8fc4004e5a242f5801daa67" +parent = "3870f53d9d1ab5759ab82a44c8d6b4ca9d933923" +commit_url = "https://github.com/jenkinsci/mstest-plugin/commit/f9b9b0cbdf7559fdd8fc4004e5a242f5801daa67" +vendored = false +host = "github" +path = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java" +mode = "name" +relpath = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-06-16" +fix_lines = { in_function = 6, in_file = 15, source_total = 20 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java" +function = "containsData" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-3ppr-72x5-x67q: XML external entity vulnerability on agents in Jenkins MSTest Plugin " + +[[pair]] +name = "request-redirect-c5bcf21" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "cypress-io/request" +cve = "CVE-2023-28155 GHSA-p8p7-x288-28g6" +cwe = "CWE-918" +ecosystem = "npm" +published_at = "2023-03-16T15:30:19Z" +post_cutoff = false +commit = "c5bcf21d40fb61feaff21a0e5a2b3934a440024f" +parent = "0664780557c95610eafeedff6067bacac6783705" +commit_url = "https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f" +vendored = false +host = "github" +path = "lib/redirect.js" +mode = "name" +relpath = "lib/redirect.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-08-08" +fix_lines = { in_function = 4, in_file = 5, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "lib/redirect.js" +function = "Redirect" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-p8p7-x288-28g6: Server-Side Request Forgery in Request" + +[[pair]] +name = "drill-xmlreader-0e88b7a" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/drill" +cve = "CVE-2023-48362 GHSA-v62g-jwj9-rfvx" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2024-07-24T09:30:40Z" +post_cutoff = false +commit = "0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3" +parent = "097da744ff416bda7bd6e83df3d7b3f31369c42e" +commit_url = "https://github.com/apache/drill/commit/0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3" +vendored = false +host = "github" +path = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java" +mode = "name" +relpath = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2023-11-06" +fix_lines = { in_function = 1, in_file = 3, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java" +function = "XMLReader" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-v62g-jwj9-rfvx: XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill" + +[[pair]] +name = "axis-axis1-java-getservice-685c309" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "apache/axis-axis1-java" +cve = "CVE-2023-51441 GHSA-hr2c-p8rh-238h" +cwe = "CWE-918" +ecosystem = "maven" +published_at = "2024-01-06T12:30:34Z" +post_cutoff = false +commit = "685c309febc64aa393b2d64a05f90e7eb9f73e06" +parent = "e84c60c1f0764b01577d62c9e6453457d523ee77" +commit_url = "https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06" +vendored = false +host = "github" +path = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java" +mode = "name" +relpath = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2023-12-18" +fix_lines = { in_function = 3, in_file = 7, source_total = 8 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java" +function = "getService" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-hr2c-p8rh-238h: Apache Axis Improper Input Validation vulnerability" + +[[pair]] +name = "cyclonedx-javascript-library-getparser-5e5e1e0" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "cyclonedx/cyclonedx-javascript-library" +cve = "CVE-2024-34345 GHSA-38gf-rh2w-gmj7" +cwe = "CWE-611" +ecosystem = "npm" +published_at = "2024-05-08T19:55:37Z" +post_cutoff = false +commit = "5e5e1e0b9422f47d2de81c7c4064b803a01e7203" +parent = "974c5585dac0428f2863459b215a3dc2951421a6" +commit_url = "https://github.com/cyclonedx/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203" +vendored = false +host = "github" +path = "src/validation/xmlValidator.node.ts" +mode = "name" +relpath = "src/validation/xmlValidator.node.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2024-05-07" +fix_lines = { in_function = 3, in_file = 2, source_total = 3 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/validation/xmlValidator.node.ts" +function = "getParser" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-38gf-rh2w-gmj7: @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability" + +[[pair]] +name = "fhir-ig-publisher-loadmappingspaces-3560de2" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "hl7/fhir-ig-publisher" +cve = "CVE-2024-52807 GHSA-8c3x-hq82-gjcm" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2025-01-24T18:33:29Z" +post_cutoff = false +commit = "3560de2f486d688a3ddcf4aa54d8bdacea380c3d" +parent = "ba0b48d4ddb4dbffb45e0d45c43069e99a038385" +commit_url = "https://github.com/hl7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d" +vendored = false +host = "github" +path = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java" +mode = "name" +relpath = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2024-11-19" +fix_lines = { in_function = 2, in_file = 1, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java" +function = "loadMappingSpaces" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-8c3x-hq82-gjcm: XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`" + +[[pair]] +name = "fedify-lookupwebfinger-8be3c20" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "dahlia/fedify" +cve = "CVE-2025-23221 GHSA-c59p-wq67-24wx" +cwe = "CWE-918" +ecosystem = "npm" +published_at = "2025-01-21T19:58:29Z" +post_cutoff = false +commit = "8be3c2038eebf4ae12481683a1e809b314be3151" +parent = "c505eb82fcd6b5b17174c6659c29721bc801ab9a" +commit_url = "https://github.com/dahlia/fedify/commit/8be3c2038eebf4ae12481683a1e809b314be3151" +vendored = false +host = "github" +path = "src/webfinger/lookup.ts" +mode = "name" +relpath = "src/webfinger/lookup.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-01-18" +fix_lines = { in_function = 1, in_file = 2, source_total = 2 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "src/webfinger/lookup.ts" +function = "lookupWebFinger" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-c59p-wq67-24wx: Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify" + +[[pair]] +name = "local-s3-createservicefactory-d6ed756" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "robothy/local-s3" +cve = "GHSA-47qw-ccjm-9c2c" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2025-03-10T18:29:36Z" +post_cutoff = false +commit = "d6ed756ceb30c1eb9d4263321ac683d734f8836f" +parent = "009901882be8b543e85b67c5ec2e9f30d83d62ef" +commit_url = "https://github.com/robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f" +vendored = false +host = "github" +path = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java" +mode = "name" +relpath = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-02-24" +fix_lines = { in_function = 2, in_file = 3, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java" +function = "createServiceFactory" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-47qw-ccjm-9c2c: LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection" + +[[pair]] +name = "webdrivermanager-loadxml-125646b" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "java" +origin = "github-advisory" +license = "Apache-2.0" +repo = "bonigarcia/webdrivermanager" +cve = "CVE-2025-4641 GHSA-pwm3-776c-8q7q" +cwe = "CWE-611" +ecosystem = "maven" +published_at = "2025-05-14T21:31:18Z" +post_cutoff = false +commit = "125646bd53855cf5de99fd4bc501b3604c151c9b" +parent = "0f14b3fc93cdfb58b24f419ce28ca08955aac964" +commit_url = "https://github.com/bonigarcia/webdrivermanager/commit/125646bd53855cf5de99fd4bc501b3604c151c9b" +vendored = false +host = "github" +path = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java" +mode = "name" +relpath = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-04-07" +fix_lines = { in_function = 3, in_file = 6, source_total = 6 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java" +function = "loadXML" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-pwm3-776c-8q7q: BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference" + +[[pair]] +name = "workers-oauth-provider-parseauthrequest-66de8d8" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "cloudflare/workers-oauth-provider" +cve = "CVE-2025-4143 GHSA-4pc9-x2fx-p7vj" +cwe = "CWE-601" +ecosystem = "npm" +published_at = "2025-05-01T17:00:29Z" +post_cutoff = false +commit = "66de8d802c1d7c468887906ea1a0769a975ff1e3" +parent = "3e3d0bfea19a5bf444423fc88622e65d6c14fad0" +commit_url = "https://github.com/cloudflare/workers-oauth-provider/commit/66de8d802c1d7c468887906ea1a0769a975ff1e3" +vendored = false +host = "github" +path = "src/oauth-provider.ts" +mode = "name" +relpath = "src/oauth-provider.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-04-30" +fix_lines = { in_function = 10, in_file = 34, source_total = 50 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "src/oauth-provider.ts" +function = "parseAuthRequest" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-4pc9-x2fx-p7vj: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint" + +[[pair]] +name = "langroid-extract-field-values-36e7e7d" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "MIT" +repo = "langroid/langroid" +cve = "CVE-2025-46726 GHSA-pw95-88fg-3j6f" +cwe = "CWE-611" +ecosystem = "pip" +published_at = "2025-05-05T20:40:44Z" +post_cutoff = false +commit = "36e7e7db4dd1636de225c2c66c84052b1e9ac3c3" +parent = "eca5c0677ee27acf71b7ff68e69576135769a2fb" +commit_url = "https://github.com/langroid/langroid/commit/36e7e7db4dd1636de225c2c66c84052b1e9ac3c3" +vendored = false +host = "github" +path = "langroid/agent/xml_tool_message.py" +mode = "name" +relpath = "langroid/agent/xml_tool_message.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-05-03" +fix_lines = { in_function = 7, in_file = 11, source_total = 18 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "langroid/agent/xml_tool_message.py" +function = "extract_field_values" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-pw95-88fg-3j6f: Langroid Allows XXE Injection via XMLToolMessage" + +[[pair]] +name = "math-read-fc31c8f" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "phpoffice/math" +cve = "CVE-2025-48882 GHSA-42hm-pq2f-3r7m" +cwe = "CWE-611" +ecosystem = "composer" +published_at = "2025-05-29T17:27:39Z" +post_cutoff = false +commit = "fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a" +parent = "6ea0c8140b9597b11127233c381f2d5d90f01265" +commit_url = "https://github.com/phpoffice/math/commit/fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a" +vendored = false +host = "github" +path = "src/Math/Reader/MathML.php" +mode = "name" +relpath = "src/Math/Reader/MathML.php" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-05-29" +fix_lines = { in_function = 3, in_file = 11, source_total = 96 } + +[[pair.expected]] +cwe = "CWE-611" +class = "xxe" +path = "src/Math/Reader/MathML.php" +function = "read" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-42hm-pq2f-3r7m: PHPOffice Math allows XXE when processing an XML file in the MathML format " + +[[pair]] +name = "datasette-handle-404-f257ca6" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "python" +origin = "github-advisory" +license = "Apache-2.0" +repo = "simonw/datasette" +cve = "CVE-2025-64481 GHSA-w832-gg5g-x44m" +cwe = "CWE-601" +ecosystem = "pip" +published_at = "2025-11-06T15:13:33Z" +post_cutoff = false +commit = "f257ca6edb64848c3b04b54d41e347c54fe57c05" +parent = "295e4a2e87464fc1838d6278308bf151bc14ba73" +commit_url = "https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05" +vendored = false +host = "github" +path = "datasette/app.py" +mode = "name" +relpath = "datasette/app.py" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2025-11-05" +fix_lines = { in_function = 1, in_file = 5, source_total = 5 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "datasette/app.py" +function = "handle_404" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-w832-gg5g-x44m: Open redirect endpoint in Datasette" + +[[pair]] +name = "fastify-reply-from-buildurl-4d9795c" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "javascript" +origin = "github-advisory" +license = "MIT" +repo = "fastify/fastify-reply-from" +cve = "CVE-2025-66415 GHSA-2q7r-29rg-6m5h" +cwe = "CWE-441" +ecosystem = "npm" +published_at = "2025-12-02T00:38:57Z" +post_cutoff = false +commit = "4d9795cd5b57a36756d37b7f036eae369f69fa66" +parent = "79ff1d2496d9496c59d5b392a18ce220c2d82b3f" +commit_url = "https://github.com/fastify/fastify-reply-from/commit/4d9795cd5b57a36756d37b7f036eae369f69fa66" +vendored = false +host = "github" +path = "lib/utils.js" +mode = "name" +relpath = "lib/utils.js" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2025-12-01" +fix_lines = { in_function = 5, in_file = 6, source_total = 10 } + +[[pair.expected]] +cwe = "CWE-441" +class = "ssrf" +path = "lib/utils.js" +function = "buildURL" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-2q7r-29rg-6m5h: fastify-reply-from affected by bypass of reply forwarding" + +[[pair]] +name = "angular-cli-joinurlparts-f086ecc" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "MIT" +repo = "angular/angular-cli" +cve = "CVE-2026-27738 GHSA-xh43-g2fq-wjrj" +cwe = "CWE-601" +ecosystem = "npm" +published_at = "2026-02-25T22:41:57Z" +post_cutoff = false +commit = "f086eccc36d10cf01c426e35864bc32e1e292323" +parent = "6cf621c905de4815b1e12964fb909876ca6e3ea3" +commit_url = "https://github.com/angular/angular-cli/commit/f086eccc36d10cf01c426e35864bc32e1e292323" +vendored = false +host = "github" +path = "packages/angular/ssr/src/utils/url.ts" +mode = "name" +relpath = "packages/angular/ssr/src/utils/url.ts" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-02-23" +fix_lines = { in_function = 19, in_file = 15, source_total = 36 } + +[[pair.expected]] +cwe = "CWE-601" +class = "open_redirect" +path = "packages/angular/ssr/src/utils/url.ts" +function = "joinUrlParts" +mechanism = "validation_strength" +family = "untrusted_destination" +evidence = "GHSA-xh43-g2fq-wjrj: Angular SSR has an Open Redirect via X-Forwarded-Prefix" + +[[pair]] +name = "backstage-fetchcimdmetadata-17038ab" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "typescript" +origin = "github-advisory" +license = "Apache-2.0" +repo = "backstage/backstage" +cve = "CVE-2026-32236 GHSA-qp4c-xg64-7c6x" +cwe = "CWE-918" +ecosystem = "npm" +published_at = "2026-03-12T14:51:02Z" +post_cutoff = false +commit = "17038abf2dfdb4abc08a59b1c95af39851de0e07" +parent = "3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce" +commit_url = "https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07" +vendored = false +host = "github" +path = "plugins/auth-backend/src/service/CimdClient.ts" +mode = "name" +relpath = "plugins/auth-backend/src/service/CimdClient.ts" +provenance = "agent" +split = "train" +review_tier = "advisory" +fix_date = "2026-03-11" +fix_lines = { in_function = 1, in_file = 1, source_total = 1 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "plugins/auth-backend/src/service/CimdClient.ts" +function = "fetchCimdMetadata" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-qp4c-xg64-7c6x: @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch" + +[[pair]] +name = "core-bundle-dev-app-fromurl-7904f69" +slice = "advisory-fixes" +batch = "2026-10-04" +language = "php" +origin = "github-advisory" +license = "MIT" +repo = "roadiz/core-bundle-dev-app" +cve = "CVE-2026-33486 GHSA-rc55-58f4-687g" +cwe = "CWE-918" +ecosystem = "composer" +published_at = "2026-03-23T21:43:14Z" +post_cutoff = false +commit = "7904f690a51b88b1c72c02149ebdf85fa81f19f2" +parent = "17ddb5934cdfe9aa617707081ca4765dc988b1d6" +commit_url = "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2" +vendored = false +host = "github" +path = "lib/Documents/src/DownloadedFile.php" +mode = "name" +relpath = "lib/Documents/src/DownloadedFile.php" +provenance = "agent" +split = "holdout" +review_tier = "advisory" +fix_date = "2026-03-19" +fix_lines = { in_function = 17, in_file = 74, source_total = 75 } + +[[pair.expected]] +cwe = "CWE-918" +class = "ssrf" +path = "lib/Documents/src/DownloadedFile.php" +function = "fromUrl" +mechanism = "source_reaches_sink" +family = "untrusted_destination" +evidence = "GHSA-rc55-58f4-687g: Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents" diff --git a/benchmarks/pairs/advisory-fixes-3/verification.json b/benchmarks/pairs/advisory-fixes-3/verification.json new file mode 100644 index 0000000..70ece08 --- /dev/null +++ b/benchmarks/pairs/advisory-fixes-3/verification.json @@ -0,0 +1,1261 @@ +{ + "pairs": [ + { + "name": "fosuserbundle-refreshuser-5a36e29", + "ok": true, + "bytes_read": 2129 + }, + { + "name": "security-getresolvedindexpattern-f7cc569", + "ok": true, + "bytes_read": 4417 + }, + { + "name": "orocalendarbundle-checkpermissions-460a8ff", + "ok": true, + "bytes_read": 2232 + }, + { + "name": "remult-doonid-6892ae9", + "ok": true, + "bytes_read": 2158 + }, + { + "name": "micronaut-security-parseaudiences-9728b92", + "ok": true, + "bytes_read": 8471 + }, + { + "name": "servicenow-devops-plugin-dochecktoolid-67192e2", + "ok": true, + "bytes_read": 6385 + }, + { + "name": "synapse-received-remote-receipt-63d28a8", + "ok": true, + "bytes_read": 5591 + }, + { + "name": "strapi-plugin-protected-populate-protectpopulate-0544106", + "ok": true, + "bytes_read": 8740 + }, + { + "name": "scriptler-plugin-doshowscript-5addb5f", + "ok": true, + "bytes_read": 2627 + }, + { + "name": "undici-shouldremoveheader-6805746", + "ok": true, + "bytes_read": 1789 + }, + { + "name": "silverstripe-reports-handleaction-0351106", + "ok": true, + "bytes_read": 2239 + }, + { + "name": "flask-cors-get-cors-headers-7ae310c", + "ok": true, + "bytes_read": 5392 + }, + { + "name": "matrix-js-sdk-getvisiblerooms-43c72d5", + "ok": true, + "bytes_read": 2268 + }, + { + "name": "strimzi-kafka-operator-generaterolebindingforrole-c8a1493", + "ok": true, + "bytes_read": 2461 + }, + { + "name": "bagisto-reorder-b2b1cf6", + "ok": true, + "bytes_read": 1991 + }, + { + "name": "froshplatformadminer-index-c4dd6c3", + "ok": true, + "bytes_read": 1432 + }, + { + "name": "azure-blob-actionloadcontainerdata-cf69db4", + "ok": true, + "bytes_read": 1760 + }, + { + "name": "connect-cms-update-7c99517", + "ok": true, + "bytes_read": 17367 + }, + { + "name": "parse-server-gethandler-053109b", + "ok": true, + "bytes_read": 5755 + }, + { + "name": "openclaw-resolvecommandauthorization-2aa93d4", + "ok": true, + "bytes_read": 7580 + }, + { + "name": "snappy-prepareoutput-1ee6360", + "ok": true, + "bytes_read": 3052 + }, + { + "name": "llama-hub-init-c01416e", + "ok": true, + "bytes_read": 1774 + }, + { + "name": "ngrinder-read-85efa4a", + "ok": true, + "bytes_read": 2562 + }, + { + "name": "qiskit-ibm-runtime-object-hook-b78fca1", + "ok": true, + "bytes_read": 8563 + }, + { + "name": "invokeai-torch-load-file-756008d", + "ok": true, + "bytes_read": 1511 + }, + { + "name": "jackrabbit-getrepository-7a31909", + "ok": true, + "bytes_read": 2868 + }, + { + "name": "inspiremusic-load-784cbf8", + "ok": true, + "bytes_read": 3453 + }, + { + "name": "datachain-deserialize-914b956", + "ok": true, + "bytes_read": 2419 + }, + { + "name": "ray-deserialize-with-fallback-c02bd31", + "ok": true, + "bytes_read": 2259 + }, + { + "name": "yii2-jqgrid-widget-addsearchoptionsrecursively-a117e0f", + "ok": true, + "bytes_read": 5372 + }, + { + "name": "postgraas-server-create-postgres-db-7cd8d01", + "ok": true, + "bytes_read": 3719 + }, + { + "name": "xmlseclibs-processrefnode-6490326", + "ok": true, + "bytes_read": 5722 + }, + { + "name": "propel2-applylimit-cd23d73", + "ok": true, + "bytes_read": 1558 + }, + { + "name": "propel-applylimit-b720932", + "ok": true, + "bytes_read": 1530 + }, + { + "name": "node-gry-exec-5108446", + "ok": true, + "bytes_read": 2212 + }, + { + "name": "json-logic-js-arrayunique-c1dd82f", + "ok": true, + "bytes_read": 27341 + }, + { + "name": "yii2-gii-validatemessagecategory-ed61e0d", + "ok": true, + "bytes_read": 1699 + }, + { + "name": "contao-tablelookupwizard-preparewhere-a5e723a", + "ok": true, + "bytes_read": 3698 + }, + { + "name": "spring-module-core-getschema-d374a5f", + "ok": true, + "bytes_read": 1294 + }, + { + "name": "window-control-sendkeys-075c854", + "ok": true, + "bytes_read": 4823 + }, + { + "name": "snowflake-connector-nodejs-convertrawvariant-0c9622a", + "ok": true, + "bytes_read": 2617 + }, + { + "name": "node-git-commit-info-gitcommitinfo-f7c491e", + "ok": true, + "bytes_read": 2105 + }, + { + "name": "numexpr-stringtoexpression-4b2d89c", + "ok": true, + "bytes_read": 3809 + }, + { + "name": "scancode-io-fetch-docker-image-07ec0de", + "ok": true, + "bytes_read": 4194 + }, + { + "name": "dcnnt-py-main-b4021d7", + "ok": true, + "bytes_read": 3551 + }, + { + "name": "find-exec-isexec-74fb108", + "ok": true, + "bytes_read": 905 + }, + { + "name": "blamer-git-0965877", + "ok": true, + "bytes_read": 1716 + }, + { + "name": "php-heic-to-jpg-convert-852bc21", + "ok": true, + "bytes_read": 1237 + }, + { + "name": "pyansys-geometry-start-program-f82346b", + "ok": true, + "bytes_read": 2182 + }, + { + "name": "sagemaker-python-sdk-capture-dependencies-2d873d5", + "ok": true, + "bytes_read": 3061 + }, + { + "name": "node-mysql2-readcodefor-7d4b098", + "ok": true, + "bytes_read": 5834 + }, + { + "name": "pymysql-escape-dict-521e400", + "ok": true, + "bytes_read": 929 + }, + { + "name": "mindsdb-dispatch-update-11a4db7", + "ok": true, + "bytes_read": 2751 + }, + { + "name": "haystack-validate-template-6c25a5c", + "ok": true, + "bytes_read": 3638 + }, + { + "name": "fides-render-829cbd9", + "ok": true, + "bytes_read": 1395 + }, + { + "name": "torchgeo-get-weight-1a98078", + "ok": true, + "bytes_read": 1527 + }, + { + "name": "plotai-run-bdcfb13", + "ok": true, + "bytes_read": 1555 + }, + { + "name": "matrix-appservice-irc-settopic-74f02c8", + "ok": true, + "bytes_read": 1838 + }, + { + "name": "conductor-initengine-e981650", + "ok": true, + "bytes_read": 2880 + }, + { + "name": "amplify-codegen-ui-buildbindingexpression-ca98c38", + "ok": true, + "bytes_read": 1920 + }, + { + "name": "jeecgboot-ispass-ddf0f61", + "ok": true, + "bytes_read": 4642 + }, + { + "name": "larecipe-replacelinks-c1d0d56", + "ok": true, + "bytes_read": 1703 + }, + { + "name": "sequa-mcp-redirecttoauthorization-e569815", + "ok": true, + "bytes_read": 1181 + }, + { + "name": "flink-cdc-tableexists-d576618", + "ok": true, + "bytes_read": 3958 + }, + { + "name": "hive-deletetablecolumnstatistics-c18d0df", + "ok": true, + "bytes_read": 2951 + }, + { + "name": "mcp-server-kubernetes-execinpod-d091107", + "ok": true, + "bytes_read": 2948 + }, + { + "name": "mcp-watch-clonerepo-e7da78c", + "ok": true, + "bytes_read": 1918 + }, + { + "name": "elysia-get-26935bf", + "ok": true, + "bytes_read": 8518 + }, + { + "name": "parsl-workflow-resources-013a928", + "ok": true, + "bytes_read": 4881 + }, + { + "name": "workers-sdk-handler-99b1f32", + "ok": true, + "bytes_read": 25234 + }, + { + "name": "django-add-filtered-relation-005d60d", + "ok": true, + "bytes_read": 4651 + }, + { + "name": "webhooks-init-8834499", + "ok": true, + "bytes_read": 14129 + }, + { + "name": "git-js-preventuploadpack-1effd8e", + "ok": true, + "bytes_read": 2294 + }, + { + "name": "ormar-query-aggr-function-a03bae1", + "ok": true, + "bytes_read": 3084 + }, + { + "name": "intake-expand-defaults-d0c0b6b", + "ok": true, + "bytes_read": 3836 + }, + { + "name": "openhands-get-git-diff-698cfc2", + "ok": true, + "bytes_read": 2482 + }, + { + "name": "scitokens-getkeyinfo-3dba108", + "ok": true, + "bytes_read": 9088 + }, + { + "name": "langchain-get-template-variables-6bab0ba", + "ok": true, + "bytes_read": 3833 + }, + { + "name": "math-codegen-interpreter-4bb52d3", + "ok": true, + "bytes_read": 2493 + }, + { + "name": "amazon-redshift-python-driver-vector-in-69a69df", + "ok": true, + "bytes_read": 1142 + }, + { + "name": "yt-dlp-prepare-outtmpl-5faffa9", + "ok": true, + "bytes_read": 22948 + }, + { + "name": "wsgidav-exists-record-by-primary-key-6f35776", + "ok": true, + "bytes_read": 3327 + }, + { + "name": "dynatrace-mcp-generatedqlsearchentitycommand-15d3546", + "ok": true, + "bytes_read": 2785 + }, + { + "name": "agno-delete-by-metadata-6780513", + "ok": true, + "bytes_read": 4686 + }, + { + "name": "virtualenv-quote-d721ff1", + "ok": true, + "bytes_read": 1608 + }, + { + "name": "zend-form-createattributesstring-6fe4031", + "ok": true, + "bytes_read": 3696 + }, + { + "name": "zendframework-htmlattribs-1dd4f8c", + "ok": true, + "bytes_read": 3492 + }, + { + "name": "scnsocialauth-invoke-4a00966", + "ok": true, + "bytes_read": 1624 + }, + { + "name": "ldapcherry-check-auth-6f98076", + "ok": true, + "bytes_read": 5981 + }, + { + "name": "framework-attributestostring-ae4d790", + "ok": true, + "bytes_read": 1755 + }, + { + "name": "vditor-fixfirefoxarrowuptable-1b2382d", + "ok": true, + "bytes_read": 22562 + }, + { + "name": "jquery-minicolors-init-ef13482", + "ok": true, + "bytes_read": 8119 + }, + { + "name": "mind-elixir-core-creatediv-0734852", + "ok": true, + "bytes_read": 4928 + }, + { + "name": "eslint-detailed-reporter-renderissue-505c190", + "ok": true, + "bytes_read": 2077 + }, + { + "name": "sanitize-url-decodehtmlcharacters-d4bdc89", + "ok": true, + "bytes_read": 1066 + }, + { + "name": "modoboa-identities-eef9ab7", + "ok": true, + "bytes_read": 23675 + }, + { + "name": "jquery-validation-delegate-7a490d8", + "ok": true, + "bytes_read": 77807 + }, + { + "name": "email-ext-plugin-rendertemplate-7b2bd25", + "ok": true, + "bytes_read": 3416 + }, + { + "name": "archiva-checkparamchars-d62e81c", + "ok": true, + "bytes_read": 6429 + }, + { + "name": "silverstripe-form-capture-details-5b3aa39", + "ok": true, + "bytes_read": 1904 + }, + { + "name": "whatsapp-chat-exporter-create-html-bfdc68c", + "ok": true, + "bytes_read": 10510 + }, + { + "name": "ckeditor-wordcount-plugin-strip-0f03b3e", + "ok": true, + "bytes_read": 2367 + }, + { + "name": "critters-createdocument-7757902", + "ok": true, + "bytes_read": 2436 + }, + { + "name": "mjml-python-parse-84c495d", + "ok": true, + "bytes_read": 5827 + }, + { + "name": "apollo-client-nextjs-transportdatatojs-b92bc42", + "ok": true, + "bytes_read": 1585 + }, + { + "name": "urql-transportdatatojs-4b7011b", + "ok": true, + "bytes_read": 2015 + }, + { + "name": "dependency-check-plugin-transform-b3b286a", + "ok": true, + "bytes_read": 11799 + }, + { + "name": "send-sendstream-ae4f298", + "ok": true, + "bytes_read": 28326 + }, + { + "name": "serve-static-createredirectdirectorylistener-0c11fad", + "ok": true, + "bytes_read": 2576 + }, + { + "name": "layui-getpath-f756b41", + "ok": true, + "bytes_read": 1666 + }, + { + "name": "vue-i18n-ismessageast-72f0d32", + "ok": true, + "bytes_read": 1058 + }, + { + "name": "simplexlsx-readthemecolors-71a5e3d", + "ok": true, + "bytes_read": 2394 + }, + { + "name": "dom-expressions-replace-521f75d", + "ok": true, + "bytes_read": 1522 + }, + { + "name": "jte-javascriptblock-a6fb00d", + "ok": true, + "bytes_read": 3549 + }, + { + "name": "felix-dev-rendercontent-87513ea", + "ok": true, + "bytes_read": 2737 + }, + { + "name": "label-studio-upload-example-using-config-8cf6958", + "ok": true, + "bytes_read": 2425 + }, + { + "name": "vega-replace-694560c", + "ok": true, + "bytes_read": 1146 + }, + { + "name": "htmlsanitizer-makesanitizedcopy-af6d2a7", + "ok": true, + "bytes_read": 4555 + }, + { + "name": "jsondiffpatch-typeformatttererrorformatter-0e374b5", + "ok": true, + "bytes_read": 1411 + }, + { + "name": "django-tomselect-prepare-results-0990ed3", + "ok": true, + "bytes_read": 5287 + }, + { + "name": "unopim-getrules-49d5f6a", + "ok": true, + "bytes_read": 2882 + }, + { + "name": "cloudbees-jenkins-advisor-plugin-executeinternal-4b456b3", + "ok": true, + "bytes_read": 4881 + }, + { + "name": "clevertap-web-sdk-handlemessageevent-84695b7", + "ok": true, + "bytes_read": 3219 + }, + { + "name": "mezzanine-displayable-links-js-898630d", + "ok": true, + "bytes_read": 3117 + }, + { + "name": "cadwyn-swagger-dashboard-b424ecd", + "ok": true, + "bytes_read": 2383 + }, + { + "name": "webssh-log-status-a7a704f", + "ok": true, + "bytes_read": 1491 + }, + { + "name": "core-index-e984870", + "ok": true, + "bytes_read": 11919 + }, + { + "name": "mesh-web-sdk-openlink-7f22148", + "ok": true, + "bytes_read": 2996 + }, + { + "name": "fastmcp-create-detail-box-2a20f54", + "ok": true, + "bytes_read": 1769 + }, + { + "name": "mailgen-setupbuttonfallbacktext-7a791a4", + "ok": true, + "bytes_read": 12373 + }, + { + "name": "spotipy-do-get-880b92d", + "ok": true, + "bytes_read": 2157 + }, + { + "name": "java-html-sanitizer-stripdisallowedtags-4149cf0", + "ok": true, + "bytes_read": 9885 + }, + { + "name": "html2pdf-js-createelement-988826e", + "ok": true, + "bytes_read": 1621 + }, + { + "name": "distributed-http-get-ab72092", + "ok": true, + "bytes_read": 2426 + }, + { + "name": "beautiful-mermaid-rendernodeshape-68f3ab8", + "ok": true, + "bytes_read": 4416 + }, + { + "name": "isso-moderate-0afbfe0", + "ok": true, + "bytes_read": 5202 + }, + { + "name": "pannellum-createhotspot-9391ef8", + "ok": true, + "bytes_read": 7861 + }, + { + "name": "lxml-html-clean-call-9c5612c", + "ok": true, + "bytes_read": 16471 + }, + { + "name": "nicknames-invoke-4dde997", + "ok": true, + "bytes_read": 3206 + }, + { + "name": "vscode-lean4-replaceat-14b7a10", + "ok": true, + "bytes_read": 6711 + }, + { + "name": "express-xss-sanitizer-initializeoptions-5623009", + "ok": true, + "bytes_read": 2205 + }, + { + "name": "graby-cleanupxss-0295d82", + "ok": true, + "bytes_read": 1678 + }, + { + "name": "unhead-getstreamkey-64b5ac0", + "ok": true, + "bytes_read": 1908 + }, + { + "name": "ipl-web-postdispatch-f387e92", + "ok": true, + "bytes_read": 2430 + }, + { + "name": "livewire-markdown-editor-updatedattachments-1e60eaa", + "ok": true, + "bytes_read": 2505 + }, + { + "name": "microdot-set-cookie-99b281b", + "ok": true, + "bytes_read": 4187 + }, + { + "name": "liquidjs-strip-html-26ea285", + "ok": true, + "bytes_read": 1138 + }, + { + "name": "sveltia-cms-sanitizeentrysummary-43a6ac5", + "ok": true, + "bytes_read": 4591 + }, + { + "name": "svelte-encode-a16ebc6", + "ok": true, + "bytes_read": 3716 + }, + { + "name": "marimo-inject-service-worker-fdd55c8", + "ok": true, + "bytes_read": 5331 + }, + { + "name": "jupyterlab-git-diffheader-c6d37b8", + "ok": true, + "bytes_read": 2572 + }, + { + "name": "appium-mcp-createlocatorgeneratorui-e222bbb", + "ok": true, + "bytes_read": 9904 + }, + { + "name": "jupyterlab-updateconfig-be9303f", + "ok": true, + "bytes_read": 14052 + }, + { + "name": "file-viewer-render-ef04568", + "ok": true, + "bytes_read": 2858 + }, + { + "name": "twig-validatename-3d19a2e", + "ok": true, + "bytes_read": 1956 + }, + { + "name": "bazingajstranslationbundle-getlocales-7accee9", + "ok": true, + "bytes_read": 1647 + }, + { + "name": "nodeserver-onrequest-c4c0f01", + "ok": true, + "bytes_read": 1694 + }, + { + "name": "microweber-download-572bdc3", + "ok": true, + "bytes_read": 3554 + }, + { + "name": "binwalk-extractor-696fe34", + "ok": true, + "bytes_read": 3078 + }, + { + "name": "gatsby-onoperation-ae5a654", + "ok": true, + "bytes_read": 41337 + }, + { + "name": "codedx-plugin-checkcsvfilematches-138932b", + "ok": true, + "bytes_read": 2205 + }, + { + "name": "php-imap-fetch-88aaafb", + "ok": true, + "bytes_read": 3974 + }, + { + "name": "cypress-image-snapshot-removesnapshot-ef49519", + "ok": true, + "bytes_read": 6420 + }, + { + "name": "pf4j-extract-8e0aa19", + "ok": true, + "bytes_read": 3587 + }, + { + "name": "aws-sdk-php-buildendpoint-aebc9f8", + "ok": true, + "bytes_read": 5394 + }, + { + "name": "arrp-dumpdirect-7ea80db", + "ok": true, + "bytes_read": 2961 + }, + { + "name": "paddle-download-5c50d1a", + "ok": true, + "bytes_read": 5661 + }, + { + "name": "lektor-untrusted-to-os-path-7393d87", + "ok": true, + "bytes_read": 1112 + }, + { + "name": "unzip-stream-unzipstream-ab67989", + "ok": true, + "bytes_read": 51321 + }, + { + "name": "openapi-generator-generate-edbb021", + "ok": true, + "bytes_read": 9579 + }, + { + "name": "weave-send-local-file-f43d5fb", + "ok": true, + "bytes_read": 2171 + }, + { + "name": "solara-get-from-cache-df2fd66", + "ok": true, + "bytes_read": 2363 + }, + { + "name": "url-to-png-handleextractqueryparamsmiddleware-e4eaeca", + "ok": true, + "bytes_read": 5600 + }, + { + "name": "df-core-handleservicerequest-5435460", + "ok": true, + "bytes_read": 2927 + }, + { + "name": "simile-butterfly-getresource-537f64b", + "ok": true, + "bytes_read": 3893 + }, + { + "name": "oak-send-4b2f27e", + "ok": true, + "bytes_read": 10510 + }, + { + "name": "agentscope-delete-workflow-7d285e8", + "ok": true, + "bytes_read": 2366 + }, + { + "name": "djl-unzip-7415cc5", + "ok": true, + "bytes_read": 3927 + }, + { + "name": "carbon-resetmessages-129700e", + "ok": true, + "bytes_read": 2295 + }, + { + "name": "browsershot-seturl-e327397", + "ok": true, + "bytes_read": 1559 + }, + { + "name": "aws-sam-cli-copytree-462b4e0", + "ok": true, + "bytes_read": 4404 + }, + { + "name": "solon-find-f46e47f", + "ok": true, + "bytes_read": 3309 + }, + { + "name": "setuptools-resolve-download-filename-250a6d1", + "ok": true, + "bytes_read": 2761 + }, + { + "name": "dagster-get-notebook-data-3a3cec2", + "ok": true, + "bytes_read": 1861 + }, + { + "name": "llama-index-load-data-a86c96a", + "ok": true, + "bytes_read": 8354 + }, + { + "name": "salt-file-recv-c4ad23f", + "ok": true, + "bytes_read": 6854 + }, + { + "name": "ignite-gridlogcommandhandler-5c42c7a", + "ok": true, + "bytes_read": 8687 + }, + { + "name": "ipx-resolvefile-81693dd", + "ok": true, + "bytes_read": 2929 + }, + { + "name": "core-download-file-fe95f6e", + "ok": true, + "bytes_read": 8816 + }, + { + "name": "auth0-php-fileexists-9026da5", + "ok": true, + "bytes_read": 2059 + }, + { + "name": "tiny-scientist-review-paper-7fd4287", + "ok": true, + "bytes_read": 5297 + }, + { + "name": "vite-plugin-static-copy-vialocal-0bc6b49", + "ok": true, + "bytes_read": 3657 + }, + { + "name": "tar-fs-incwd-0bd54cd", + "ok": true, + "bytes_read": 789 + }, + { + "name": "dosage-connect-336a968", + "ok": true, + "bytes_read": 3509 + }, + { + "name": "unstructured-attachment-file-name-b01d35b", + "ok": true, + "bytes_read": 1962 + }, + { + "name": "pebble-getfile-b3451c8", + "ok": true, + "bytes_read": 2376 + }, + { + "name": "vite-plugin-react-findsourcemapurl-582fba0", + "ok": true, + "bytes_read": 5438 + }, + { + "name": "bodyparser-markasmoved-143a16f", + "ok": true, + "bytes_read": 4853 + }, + { + "name": "pnpm-getbinsfrompackagemanifest-17432ad", + "ok": true, + "bytes_read": 1830 + }, + { + "name": "wheel-unpack-7a7d2de", + "ok": true, + "bytes_read": 2468 + }, + { + "name": "openchatbi-save-report-372a7e8", + "ok": true, + "bytes_read": 4169 + }, + { + "name": "clasp-fetchremote-ba6bd66", + "ok": true, + "bytes_read": 4560 + }, + { + "name": "basic-ftp-downloadfromworkingdir-2a2a0e6", + "ok": true, + "bytes_read": 2528 + }, + { + "name": "mcp-atlassian-download-attachment-52b9b09", + "ok": true, + "bytes_read": 4661 + }, + { + "name": "bentoml-safe-extract-tarfile-4e0eb00", + "ok": true, + "bytes_read": 4817 + }, + { + "name": "dbt-common-safe-extract-e547954", + "ok": true, + "bytes_read": 2831 + }, + { + "name": "black-get-cache-key-4937fe6", + "ok": true, + "bytes_read": 3165 + }, + { + "name": "agixt-safe-join-2079ea5", + "ok": true, + "bytes_read": 2308 + }, + { + "name": "mesop-make-file-path-c6b382f", + "ok": true, + "bytes_read": 1147 + }, + { + "name": "kedro-plugins-partition-to-path-65115f7", + "ok": true, + "bytes_read": 1461 + }, + { + "name": "anthropic-sdk-typescript-validatenosymlinkescape-0ac69b3", + "ok": true, + "bytes_read": 2121 + }, + { + "name": "copier-external-data-5413062", + "ok": true, + "bytes_read": 3396 + }, + { + "name": "vite-transformmiddleware-79f002f", + "ok": true, + "bytes_read": 17975 + }, + { + "name": "nicegui-create-file-upload-d38a702", + "ok": true, + "bytes_read": 3759 + }, + { + "name": "quarkus-openapi-generator-unzip-08b4064", + "ok": true, + "bytes_read": 3177 + }, + { + "name": "excel-mcp-server-get-excel-path-f51340e", + "ok": true, + "bytes_read": 2299 + }, + { + "name": "psitransfer-getfilename-8b547bf", + "ok": true, + "bytes_read": 1356 + }, + { + "name": "pptagent-get-html-table-image-418491a", + "ok": true, + "bytes_read": 2513 + }, + { + "name": "pygeoapi-get-data-path-bf25b86", + "ok": true, + "bytes_read": 11141 + }, + { + "name": "grav-plugin-form-uploadfiles-48bacc4", + "ok": true, + "bytes_read": 17482 + }, + { + "name": "taipy-get-resource-129fd40", + "ok": true, + "bytes_read": 2241 + }, + { + "name": "jupyter-server-get-os-path-0d829f2", + "ok": true, + "bytes_read": 3868 + }, + { + "name": "apm-looks-like-legacy-apm-bundle-77d1dda", + "ok": true, + "bytes_read": 3893 + }, + { + "name": "pdm-write-to-fs-41aa5f9", + "ok": true, + "bytes_read": 3554 + }, + { + "name": "xiaomusic-music-file-88404da", + "ok": true, + "bytes_read": 5275 + }, + { + "name": "serializer-decode-0943a06", + "ok": true, + "bytes_read": 2202 + }, + { + "name": "dependency-injection-parsefile-5c5040c", + "ok": true, + "bytes_read": 3045 + }, + { + "name": "routing-loadfile-769e8e6", + "ok": true, + "bytes_read": 2825 + }, + { + "name": "silverstripe-seed-onbeforesecuritylogin-b065ebd", + "ok": true, + "bytes_read": 1468 + }, + { + "name": "urllib3-init-adb358f", + "ok": true, + "bytes_read": 2866 + }, + { + "name": "seotools-maketag-ca27cd0", + "ok": true, + "bytes_read": 1512 + }, + { + "name": "axmlrpc-parse-ad6615b", + "ok": true, + "bytes_read": 4161 + }, + { + "name": "neo4j-apoc-procedures-parsexml-c3e2a29", + "ok": true, + "bytes_read": 14813 + }, + { + "name": "keycloak-nodejs-connect-forcechecksso-190a947", + "ok": true, + "bytes_read": 4514 + }, + { + "name": "mstest-plugin-containsdata-f9b9b0c", + "ok": true, + "bytes_read": 3652 + }, + { + "name": "request-redirect-c5bcf21", + "ok": true, + "bytes_read": 5438 + }, + { + "name": "drill-xmlreader-0e88b7a", + "ok": true, + "bytes_read": 1872 + }, + { + "name": "axis-axis1-java-getservice-685c309", + "ok": true, + "bytes_read": 12130 + }, + { + "name": "cyclonedx-javascript-library-getparser-5e5e1e0", + "ok": true, + "bytes_read": 4751 + }, + { + "name": "fhir-ig-publisher-loadmappingspaces-3560de2", + "ok": true, + "bytes_read": 3636 + }, + { + "name": "fedify-lookupwebfinger-8be3c20", + "ok": true, + "bytes_read": 6166 + }, + { + "name": "local-s3-createservicefactory-d6ed756", + "ok": true, + "bytes_read": 3529 + }, + { + "name": "webdrivermanager-loadxml-125646b", + "ok": true, + "bytes_read": 1919 + }, + { + "name": "workers-oauth-provider-parseauthrequest-66de8d8", + "ok": true, + "bytes_read": 3595 + }, + { + "name": "langroid-extract-field-values-36e7e7d", + "ok": true, + "bytes_read": 6933 + }, + { + "name": "math-read-fc31c8f", + "ok": true, + "bytes_read": 1783 + }, + { + "name": "datasette-handle-404-f257ca6", + "ok": true, + "bytes_read": 9516 + }, + { + "name": "fastify-reply-from-buildurl-4d9795c", + "ok": true, + "bytes_read": 2471 + }, + { + "name": "angular-cli-joinurlparts-f086ecc", + "ok": true, + "bytes_read": 3234 + }, + { + "name": "backstage-fetchcimdmetadata-17038ab", + "ok": true, + "bytes_read": 3856 + }, + { + "name": "core-bundle-dev-app-fromurl-7904f69", + "ok": true, + "bytes_read": 4668 + } + ], + "verified": 251, + "bytes_read": 1297516 +} diff --git a/src/openultrasast/learn/sources.toml b/src/openultrasast/learn/sources.toml index fd22069..42ca283 100644 --- a/src/openultrasast/learn/sources.toml +++ b/src/openultrasast/learn/sources.toml @@ -82,6 +82,18 @@ recorded = "2026-10-03" status = "development" exclude_tiers = ["title"] +# Batch 3: more advisory fixes whose function survives the fix, weighted toward injection and untrusted_destination. +# Same slice, cache layout and checks; screening record +# benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json. +[[source]] +id = "advisory-fixes-3" +kind = "pairs" +file = "benchmarks/pairs/advisory-fixes-3/catalog.toml" +evaluation = ["benchmarks/pairs/advisory-fixes-3/verification.json"] +recorded = "2026-10-04" +status = "development" +exclude_tiers = ["title"] + [[source]] id = "adjudications" kind = "adjudications" diff --git a/tests/test_advisory_fix_pairs.py b/tests/test_advisory_fix_pairs.py index f4a5219..fb8134d 100644 --- a/tests/test_advisory_fix_pairs.py +++ b/tests/test_advisory_fix_pairs.py @@ -21,8 +21,9 @@ from openultrasast.pairs import load_pair_catalog ROOT = Path(__file__).resolve().parents[1] PAIRS = ROOT / "benchmarks" / "pairs" -# batch 1 (2026-10-01) and batch 2 (2026-10-03, functions that survive the fix): one source each, same rules -BATCHES = {"advisory-fixes": PAIRS / "advisory-fixes", "advisory-fixes-2": PAIRS / "advisory-fixes-2"} +# batch 1 (2026-10-01), batches 2 (2026-10-03) and 3 (2026-10-04, functions that survive the fix): one source each, +# same rules +BATCHES = {name: PAIRS / name for name in ("advisory-fixes", "advisory-fixes-2", "advisory-fixes-3")} SHA = re.compile(r"[0-9a-f]{40}") PERMISSIVE_OR_COPYLEFT = re.compile( r"^(MIT|BSD-[23]-Clause|Apache-2\.0|ISC|Zlib|0BSD|Unlicense|MPL-[12]\.[01]" @@ -106,10 +107,18 @@ def test_no_pair_repeats_a_repository_the_benchmarks_already_name(source_id: str PERMISSIVE = {"MIT", "BSD-2-Clause", "BSD-3-Clause", "Apache-2.0", "ISC", "MPL-2.0", "Unlicense"} -def test_batch_two_is_permissive_and_dated_against_the_cutoff() -> None: - """Batch 2 publishes permissive licences only and records each advisory's publication against the 2026-06-01 +@pytest.mark.parametrize(("source_id", "batch"), [("advisory-fixes-2", "2026-10-03"), ("advisory-fixes-3", "2026-10-04")]) +def test_later_batches_are_permissive_and_dated_against_the_cutoff(source_id: str, batch: str) -> None: + """Batches 2 and 3 publish permissive licences only and record each advisory's publication against the 2026-06-01 cutoff, so memorisation can be measured on the post-cutoff pairs.""" - for item in _raw(BATCHES["advisory-fixes-2"]): + for item in _raw(BATCHES[source_id]): assert item["license"] in PERMISSIVE, item["name"] - assert item["batch"] == "2026-10-03", item["name"] + assert item["batch"] == batch, item["name"] assert item["post_cutoff"] is (item["published_at"][:10] >= "2026-06-01"), item["name"] + + +def test_no_repository_repeats_across_batches() -> None: + seen: Counter[str] = Counter() + for folder in BATCHES.values(): + seen.update({repo_name(item["repo"]) for item in _raw(folder)}) + assert [repo for repo, n in seen.items() if n > 1] == []