{ "cases": [ { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "acacode-swagger-typescript-api-c4257c99ff0cfe5f", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "swagger-typescript-api CLI/generateApi() consuming an attacker-controlled OpenAPI spec path (e.g. `sta generate --url https://attacker.example/openapi.json`); the injected `${...}` in the spec path is interpolated into the generated method's `path: \\`...\\`` template literal and evaluated when the generated method is called.", "fix_addresses_it": false, "human_spot_check": null, "id": "acacode-swagger-typescript-api-e64e7a7e89c832b6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "lazybeforeunveil event handler reading data-vimeo/data-vimeoparams attributes from DOM elements", "fix_addresses_it": true, "human_spot_check": null, "id": "afarkas-lazysizes-7b62735d3e5d1714", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "lazybeforeunveil event handler / click handler on element with data-youtube attribute", "fix_addresses_it": true, "human_spot_check": null, "id": "afarkas-lazysizes-99fc6cf6e6f1f846", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "next-intl middleware with localePrefix: 'as-needed' (external application middleware, not a concrete in-repo route/handler)", "fix_addresses_it": true, "human_spot_check": null, "id": "amannn-next-intl-10fdf55408ba9a03", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "startWebServer -> app.listen(PORT) binding all interfaces; HTTP routes GET /api/documents, POST /api/documents, DELETE /api/documents/:id, POST /api/search-all, GET /api/config", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "andrea9293-mcp-documentation-server-0913a4303cf82c9a", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "parse() in source/modules/database/custom/index.js, invoked from database config UI; data source is shell-findOne IPC result (info['database'])", "fix_addresses_it": true, "human_spot_check": null, "id": "antswordproject-antsword-0abdb762876f58b3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "modules/database/php/index.js parse() rendering database config tree text", "fix_addresses_it": true, "human_spot_check": null, "id": "antswordproject-antsword-4b97e82397da81ee", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "checkprobe() invoked from database module UI; data source is remote server response via that.drive.core.request(that.drive.core.base.probedb())", "fix_addresses_it": true, "human_spot_check": null, "id": "antswordproject-antsword-98183d78558cfa95", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "parse() in modules/database/asp/index.js reading database config via ipcRenderer shell-findOne", "fix_addresses_it": true, "human_spot_check": null, "id": "antswordproject-antsword-b0cec123d7799276", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "SearchLayoutView.renderTypeTagList / getFilterBox (Backbone Marionette view rendering search type/tag dropdowns)", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-atlas-0ba0aadbe86a1987", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-atlas-10c9d446ebf3bb21", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "SearchResultLayoutView.getFixedDslColumn / getDaynamicColumns formatters rendering entity attributes via Backgrid Html cells; source is search API response entity attributes (e.g. name, typeName, custom attributes) rendered into DOM", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-3f751971e2a63d2e", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Header view onRender: that.$('.userName').html(Globals.userLogedIn.response.userName) renders the authenticated user's userName via .html() (DOM XSS sink); source is the logged-in user's userName from the login response, reachable when the Header view renders after authentication.", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-42a370a3cdec7d12", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "React route /search/searchResult (FilterQuery component); source: URL query string via location.search / URLSearchParams, attacker-controlled filter params (type, tag, relationshipName, entityFilters, tagFilters, relationshipFilters) rendered into Chip labels", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-4c582bc549c555a1", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.15, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-atlas-5373cc60e39f63cb", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "sanitizeHtmlContent (dashboard/src/utils/Utils.ts)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-7f7bd8d16a1151b1", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Backbone Marionette view RelationSearchResultLayoutView rendering relationship search results; data from relationship search API (getBasicRearchResult/fetch) flows into Backgrid Html cell formatters (e.g. col['label'], col['typeName'], col['name']) that build HTML strings without escaping, enabling stored XSS for an authenticated user.", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-940ab56a7aadcda1", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "ShowMoreText React component (dashboard/src/components/ShowMore/ShowMoreText.tsx)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-9ddeccc45a8bbeb5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "HtmlRenderer React component (htmlString prop)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-ea6cfd8c8ed3e117", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "CommonViewFunction.propertyTable / fetchInputOutputValue (dashboardv2/public/js/utils/CommonViewFunction.js)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-atlas-eec08160065d0b9b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-atlas-f8d76d90d767826b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "SpecificCompiler.javaSplit (invoked via SpecificCompiler.compileSchema / velocity template generation from untrusted Avro schema)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-avro-1c1ac5d9361c069c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "SpecificCompiler.javaEscape via javaSplit during specific record generation from untrusted Avro schemas", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-avro-1d43772609028459", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "SpecificCompiler.javaAnnotations(JsonProperties) invoked during SpecificCompiler code generation from Avro schema JSON (javaAnnotation property)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-avro-f133a25fc910fb31", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "execute_sql_query(sql, connection_manager, **kwargs) MCP tool convenience function", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-doris-mcp-server-58f237c099a19c43", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-freemarker-0209dc8ff7a5a0b9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-203931cda95af8bc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.95, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-29fe382661669370", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.95, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-35b46d5635d33c30", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-46458e154673da1a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-5b201fbf15fe43ca", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-68401dcb84d645a6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.3, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-6ff76988cae7dfa5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-8083f17f7cbadd46", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.3, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-9a97c39706187df2", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-9c4ae45efeed53a7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.1, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-a05c81da5a0b21df", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-a176addda844a7ce", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "getLessSpecificLocale(Locale) called during localized template lookup with attacker-controlled locale identifier", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-freemarker-a74ec0787d3280ea", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-a765c68d84f2b828", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-aace5c9941b635b3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-c0f61114ff3ab48a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.3, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-cf639b1623d15342", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-freemarker-cfc58a253de5f6bd", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-freemarker-d058151619a90d08", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-freemarker-d260924010aace8a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "TemplateCache.lookupWithLocalizedThenAcquisitionStrategy (invoked via Configuration.getTemplate with attacker-controlled Locale)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-freemarker-d3c7bc0ea1b565c4", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-d4b9c3b8b1a5b2c3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-eb721acc4b96dd7f", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-eb9b0fff47e5400b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.1, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-f10a2c2cfda93e16", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-f5ba78c9c91de7a1", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-f78f7186c5610790", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-freemarker-fabd1840fb3c1eed", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "JMXConnector.doStart() invoked via GBean lifecycle during server startup; JMX connector accepts remote RMI connections", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-geronimo-0779e8a19c60e8ad", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "JMXSecureConnector.doStart (JMX connector server startup)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-geronimo-469d656c92e703bc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "JMSSource.doProcess (JMS Source configured via Flume agent config providerUrl)", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-logging-flume-2f03541bca7f3237", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "JMSSource.doConfigure via providerUrl configuration parameter", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-logging-flume-3a9f6e6ef1ab1349", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "JMSMessageConsumer constructor via JMSSource providerUrl configuration (initialContext.lookup(destinationName))", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-logging-flume-9dd9e4ee8d0de85f", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-pdfbox-11311474dc9fddbd", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() flows into extractFile(filePath, filename, embeddedFile)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-pdfbox-3dc4e739d0307166", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "main(String[] args) CLI: args[0] PDF file path; embedded file names from PDComplexFileSpecification.getFilename() flow into extractFile", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-pdfbox-56ad35de6b5478ab", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() in PDF content reaches extractFile", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-pdfbox-7d8d6513c163f5fe", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "ExtractEmbeddedFiles example main() CLI argument (PDF file path); filename from PDComplexFileSpecification.getFilename() concatenated into extraction path", "fix_addresses_it": false, "human_spot_check": null, "id": "apache-pdfbox-d700dd5c8843f12c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "ExtractEmbeddedFiles example main() CLI argument (PDF file path); filename from PDComplexFileSpecification.getFilename() appended to extraction path in extractFile", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-pdfbox-f03695e9a3bbfb76", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "IAlarmQueryDAO.getAlarm (keyword parameter)", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-skywalking-2290116e5febf3c6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "queryBasicTraces (ITraceQueryDAO) invoked via GraphQL trace query; endpointName parameter", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-skywalking-5eb8d566abf7ce37", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "searchEndpoint(keyword, serviceId, limit) - keyword concatenated into SQL LIKE clause; no in-repo HTTP route or CLI argument shown in provided context", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-skywalking-80e3e3e53c0f37a0", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "IAlarmQueryDAO.getAlarm (keyword parameter) invoked via alarm query GraphQL/REST handler; no concrete in-repo route or attacker-controlled source shown in provided context", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-skywalking-9ea0241fb2a1d2cc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "searchServices(keyword) via metadata query API", "fix_addresses_it": true, "human_spot_check": null, "id": "apache-skywalking-a7df135a93d33dbc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "arc\\url\\Url::__construct($url)", "fix_addresses_it": true, "human_spot_check": null, "id": "ariadne-cms-arc-web-dedc841aa3fcd892", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "WxCryptUtil.extractEncryptPart(String xml) via BUILDER_LOCAL DocumentBuilder", "fix_addresses_it": true, "human_spot_check": null, "id": "binarywang-wxjava-81c6bfb8c7d2780a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "BaseWxPayResult.getXmlDoc() parsing attacker-supplied xmlString (e.g., via toMap/getXmlValue), but no concrete in-repo HTTP handler or CLI route is shown in the provided context", "fix_addresses_it": true, "human_spot_check": null, "id": "binarywang-wxjava-bb0f4f6e3747df3f", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Vue component render (b-table caption prop) - no in-repo route/handler/CLI source established", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-07356b6e97b97bc0", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "b-pagination component prop ellipsisText / firstText rendered via domProps innerHTML in makeEllipsis", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-28832e100e7f287c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "Vue component render function (b-table) using this.caption prop bound to innerHTML", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-28e8c5390cd69d63", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "b-nav-item-dropdown component render (text prop via innerHTML)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-4956693c54c51e2d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "makeEndBtns render function in src/mixins/pagination.js (btnText via props/slots)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-5c23596323e6b8a9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "pageLinkClasses (page) method in src/mixins/pagination.js", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-62335f9ab1503cb8", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "formOptions computed property in src/mixins/form-options.js (options prop)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-63c25165cde74e91", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "b-dropdown component render function (this.text prop)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-89a979a090308f7b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "render() in src/components/progress/progress-bar.js via the `label` prop rendered with domProps.innerHTML", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-961a13bdb159074a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "card-body component render function via title/subTitle props", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-9cb0f01421a910d4", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "b-form-group render function (label prop)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-a3dc3bb9b99618da", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "b-dropdown component render (this.text prop)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-ad0ba8cae6e3210c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "jumbotron component render function (props.header / props.lead)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-afa3ef454d76061d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "bootstrap-vue InputGroup component render function (props.prepend / props.append)", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-b376dace0b85c60c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "render (h) in src/components/modal/modal.js; title prop rendered via h(this.titleTag, ...) without sanitization", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-b7c3ceceb8ee2f53", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "b-table component render() -> makeHeadCells() using field.label via domProps.innerHTML", "fix_addresses_it": true, "human_spot_check": null, "id": "bootstrap-vue-bootstrap-vue-f1906edae2e32153", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "codecov/__init__.py:main() CLI entry point; attacker-controlled source: --gcov-args / --gcov-exec / --gcov-root CLI arguments (argparse) flowing into cmd string passed to try_to_run (popen)", "fix_addresses_it": true, "human_spot_check": null, "id": "codecov-codecov-python-261567376b9ecd8e", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "WebPageLoader.load(source_content) via crewai_tools.rag loaders; source is SourceContent.source URL supplied by the caller", "fix_addresses_it": true, "human_spot_check": null, "id": "crewaiinc-crewai-0c90e759dac62125", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "DOCXLoader.load -> _download_from_url (source_content.source_ref URL)", "fix_addresses_it": true, "human_spot_check": null, "id": "crewaiinc-crewai-3736ee46eb9984b5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "DocsSiteLoader.load(source) via source.source URL", "fix_addresses_it": true, "human_spot_check": null, "id": "crewaiinc-crewai-4591ac4ce34038bb", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "PDFLoader.load(source) -> _download_from_url(url, kwargs)", "fix_addresses_it": true, "human_spot_check": null, "id": "crewaiinc-crewai-4a0af130f248da07", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "MCP tool git_clone (gitCloneLogic) invoked via MCP tools/call with attacker-controlled input.targetPath/repositoryUrl/branch reaching child_process.exec", "fix_addresses_it": true, "human_spot_check": null, "id": "cyanheads-git-mcp-server-07d42f8af21c4e1d", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "MCP tool git_init (gitInitLogic) invoked via tools/call with input.initialBranch", "fix_addresses_it": true, "human_spot_check": null, "id": "cyanheads-git-mcp-server-3c306de22fb76061", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "EmailTermsView at url /terms/email; GET parameter returnTo flows via get_initial into form initial, then form_valid sets self.success_url from form.cleaned_data['returnTo'] without validation, causing open redirect", "fix_addresses_it": true, "human_spot_check": null, "id": "cyface-django-termsandconditions-1b3a86185cb651c3", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "AcceptTermsView.post at URL /terms/accept, reading request.POST['returnTo']", "fix_addresses_it": true, "human_spot_check": null, "id": "cyface-django-termsandconditions-387ba4069e5df737", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "POST /terms/accept/ with returnTo parameter handled by termsandconditions/views.py returnTo function", "fix_addresses_it": true, "human_spot_check": null, "id": "cyface-django-termsandconditions-8ee6351ba4d07811", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "POST /terms/accept/ with returnTo parameter (termsandconditions/views.py returnTo function)", "fix_addresses_it": true, "human_spot_check": null, "id": "cyface-django-termsandconditions-95885d31451074da", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "AcceptTermsView at url /terms/accept; GET parameter returnTo read via self.request.GET.get(\"returnTo\", \"/\") in get_initial", "fix_addresses_it": true, "human_spot_check": null, "id": "cyface-django-termsandconditions-d51b737f5af17360", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "CLI --input-file-type protobuf with --input/--url; _ProtoInputPreparer.__enter__ -> _write_missing_weak_imports", "fix_addresses_it": false, "human_spot_check": null, "id": "datamodel-code-generator-datamodel-code-generator-5533ebd26fe5db29", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "CLI: datamodel-code-generator --input-file-type protobuf --input (or --url); source: WEAK_IMPORT_PATTERN capture group from the proto text reaching _write_missing_weak_imports", "fix_addresses_it": true, "human_spot_check": null, "id": "datamodel-code-generator-datamodel-code-generator-bd146f812470891a", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "get_frontend_context_variables", "fix_addresses_it": true, "human_spot_check": null, "id": "django-commons-django-unicorn-12a63e34be303045", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "CLI command `convert` (docling/cli/main.py) with `--html-image-headers` and `--html-image-fetch remote|all`; attacker-controlled source is the untrusted HTML document's `` URL", "fix_addresses_it": true, "human_spot_check": null, "id": "docling-project-docling-442cf60d08eedb5a", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "HTMLBackend._render_with_browser via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled source is the untrusted HTML document's URL", "fix_addresses_it": true, "human_spot_check": null, "id": "docling-project-docling-6fdb354a87a33a5b", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "ImageResourceLoader.__init__ (headers parameter); CLI --html-image-headers with --html-image-fetch remote/all", "fix_addresses_it": true, "human_spot_check": null, "id": "docling-project-docling-79c0c9a6f809c850", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "docling-project-docling-a3a58e4798820a2f", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "HTMLBackend._route_request via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled source is the document's URL", "fix_addresses_it": true, "human_spot_check": null, "id": "docling-project-docling-e161c7347b530396", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "dromara-sureness-229b3e58be2cea98", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "dromara-sureness-fe133861b4331e26", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "dtwang-line-desktop-mcp-0211ddfcea45a218", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "CLI --http-mode --port 3000 binds Express app to 0.0.0.0 and exposes POST /mcp Streamable HTTP endpoint without authentication", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "dtwang-line-desktop-mcp-11072dcfdfa41a45", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "Express app.all('/mcp') handler in LineDesktopMCPServer.run() invoked via CLI --http-mode --port; attacker-controlled source is the unauthenticated HTTP POST to /mcp (req.body initialize / mcp-session-id header) reaching transport.handleRequest and MCP tools", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "dtwang-line-desktop-mcp-b9429141072345c4", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "initTemplateList (CLI options.template)", "fix_addresses_it": false, "human_spot_check": null, "id": "easy-team-easywebpack-cli-b9675c77904bca7d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "filegator-filegator-3e6375432d7d1672", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "filegator-filegator-a4e0e2b35d13f929", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "scopeSearch invoked via Eloquent search scope; no concrete in-repo route/handler or attacker-controlled source provided in the supplied file context", "fix_addresses_it": true, "human_spot_check": null, "id": "fiveai-cachet-29e687ca594eba8e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.35, "entry_point": "execute_module monitor.http_check {url:...}", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-2a4e38c04fd5f6be", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-34e3395590f26492", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-53361f3afc1d0761", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.15, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-720084a3ead8521c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.35, "entry_point": "execute_module graphql.query {url:...} -> _prepare_graphql_request", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-730f3f6c3f5e3112", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.15, "entry_point": "execute_module slack.send {webhook_url: attacker-controlled}", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-922d1d2f64c30590", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "execute_module http.request {url: attacker-controlled} -> http_request() -> session.request(method, url, allow_redirects=True) follows 302 into internal space", "fix_addresses_it": true, "human_spot_check": null, "id": "flytohub-flyto-core-9648472ee6b1bd21", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "execute_module http.get with attacker-controlled url parameter (http_get in src/core/modules/atomic/http/get.py)", "fix_addresses_it": true, "human_spot_check": null, "id": "flytohub-flyto-core-c57a8e72e5f62c6f", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-cf56d8dfb0fcb584", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.15, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-d56b51ea8b6eec43", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "flytohub-flyto-core-f8f7252f12890138", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "fusesource-hawtjni-18415170793563b7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Library.exractAndLoad (called from Library.load via classLoader.getResource)", "fix_addresses_it": true, "human_spot_check": null, "id": "fusesource-hawtjni-f763d2029e719e50", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "display_evaluation_run_status(eval_run_obj) called in Jupyter/Colab; error_message from eval_run_obj.error", "fix_addresses_it": false, "human_spot_check": null, "id": "googleapis-python-aiplatform-0ac10c09d9bb7ce5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "_get_inference_html(dataframe_json)", "fix_addresses_it": true, "human_spot_check": null, "id": "googleapis-python-aiplatform-ae123ecdc45075bf", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "_get_evaluation_html(eval_result_json)", "fix_addresses_it": true, "human_spot_check": null, "id": "googleapis-python-aiplatform-c97b4cfd80013853", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "_get_comparison_html(eval_result_json)", "fix_addresses_it": true, "human_spot_check": null, "id": "googleapis-python-aiplatform-d6824d56240b0069", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "Playground component constructor (props.schema) in packages/graphql-playground-react/src/components/Playground.tsx", "fix_addresses_it": true, "human_spot_check": null, "id": "graphql-graphql-playground-779f126239ce96a4", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; introspection type names reach renderType via onHasCompletion autocomplete, then injected through information.innerHTML", "fix_addresses_it": true, "human_spot_check": null, "id": "graphql-graphql-playground-8a960cf0662c724e", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "SchemaFetcher.fetchSchema via endpoint query parameter (session.endpoint) loading a malicious schema", "fix_addresses_it": true, "human_spot_check": null, "id": "graphql-graphql-playground-8ab7cfafbc027403", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "GraphQL Playground React app loaded via graphql-playground-html/middleware; endpoint query parameter (?endpoint=...) sets the schema endpoint, and the fetched introspection schema flows through props.schema into UNSAFE_componentWillReceiveProps in Playground.tsx", "fix_addresses_it": true, "human_spot_check": null, "id": "graphql-graphql-playground-94e027d23fc54155", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; onHasCompletion renders untrusted schema type names via innerHTML", "fix_addresses_it": true, "human_spot_check": null, "id": "graphql-graphql-playground-afc7c3fd32fb660f", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Guzzle Client cookie handling via CookieJar::matchesDomain (e.g. new Client(['cookies' => true]))", "fix_addresses_it": true, "human_spot_check": null, "id": "guzzle-guzzle-71918799e733c0fa", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "is_url_safe (exported helper) called by external consumers; no in-repo route/handler/CLI source shown", "fix_addresses_it": true, "human_spot_check": null, "id": "hackingrepo-dssrf-js-ecfa495c64d13a59", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "hjson-hjson-java-0100a1cb12b60b6a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-117903a04ddebe6e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> ExtractShadowStrategyTool (journal_path) -> safe_user_path", "fix_addresses_it": true, "human_spot_check": null, "id": "hkuds-vibe-trading-16a24d8276343ff1", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-1b7a462b5edd6f25", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-36bca05009805ae2", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-3eeced0e67bd3443", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-3fe5123aa283389c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-4055b927694ed3d9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.1, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-489a94725fbd4ac9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-490c1fadec0168f7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-4bc98a6c0e318002", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-53b8e8b13c96984b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-54e08745442bc15e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "POST /sessions/{session_id}/messages -> SessionService.send_message -> _run_attempt -> LLM tool registry (read_document / safe_user_path-gated tools)", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-7f6e6e7392e1389e", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-840eb07dfbe96e75", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> DocReaderTool.execute -> read_document(file_path) with attacker-controlled file_path from chat message", "fix_addresses_it": true, "human_spot_check": null, "id": "hkuds-vibe-trading-866d7a8070276364", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-925032218d1d77e4", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-9b681020685fe0e7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-a10dddba8add7fac", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "POST /sessions/{session_id}/messages -> send_message -> svc.send_message -> agent loop invoking read_document / safe_user_path-gated tools", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-ad7c628e2179fe31", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.55, "entry_point": "BacktestTool.execute -> run_backtest(run_dir) via POST /sessions/{sid}/messages LLM tool invocation; run_dir is attacker-controlled via prompt injection", "fix_addresses_it": true, "human_spot_check": null, "id": "hkuds-vibe-trading-c16e9e336b3428d7", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.55, "entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> PatternTool.execute -> run_pattern(run_dir)", "fix_addresses_it": true, "human_spot_check": null, "id": "hkuds-vibe-trading-c504e5fd82839ef8", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-c6867edb99dcb1d1", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-c92f45b95e1d0b54", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.95, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-cd0aa698868347a5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-d15ad3bf7a566ce3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "build_registry (agent/src/tools/__init__.py) - tool auto-discovery; advisory claims reachability via POST /sessions/{sid}/messages on port 8899, but no such route/handler is present in the supplied file context", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-dc628e0182f9c1ae", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-ebb08ee489b9450b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-f4657c425bc7405e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "POST /sessions/{sid}/messages -> SessionService._run_with_agent -> AgentLoop.run -> build_registry tools (read_document / safe_user_path)", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-fc64bd08539555f1", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-fefd053d0fc19401", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "hkuds-vibe-trading-ff88c73cf17f2c68", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "home-assistant-frontend-4ddc46798ca8e7d6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Lovelace Statistics Graph card (statistics-chart.ts) rendering ECharts tooltip via formatTooltip; source is entity name from getStatisticLabel/computeStateName (attacker-controlled via helper or integration-provided entity name)", "fix_addresses_it": true, "human_spot_check": null, "id": "home-assistant-frontend-588ec87d01bd562c", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "ZWave JS network visualization panel (zwave_js-network-visualization custom element) tooltip formatter rendering device names via ECharts tooltip", "fix_addresses_it": true, "human_spot_check": null, "id": "home-assistant-frontend-589375de71f6b2f2", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "home-assistant-frontend-61bf65e9dd9a81f3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Statistics Graph card / state-history-chart-timeline.ts _renderTooltip (seriesName from entity name via getStatisticLabel/computeStateName)", "fix_addresses_it": true, "human_spot_check": null, "id": "home-assistant-frontend-72bcad0f4ba8aa00", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "home-assistant-frontend-ade4d24b167a84dc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Statistics Graph card (statistics-chart.ts) rendering entity name via getStatisticLabel -> computeStateName into ECharts tooltip; attacker-controlled source is the entity name set via helper/integration", "fix_addresses_it": true, "human_spot_check": null, "id": "home-assistant-frontend-d7404ee83aa6f810", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "Statistics Graph card tooltip rendering (statistics-chart.ts _renderTooltip) via entity name from getStatisticLabel/computeStateName; the provided file is ha-sunburst-chart.ts, not the statistics chart", "fix_addresses_it": true, "human_spot_check": null, "id": "home-assistant-frontend-dbfdac609f80500c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Lovelace Statistics Graph card tooltip formatter (_renderTooltip) rendering entity name from getStatisticLabel/computeStateName; attacker-controlled source is the entity/statistic name set via helper or integration", "fix_addresses_it": true, "human_spot_check": null, "id": "home-assistant-frontend-f515548346e64ad5", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "XSLTProcessor.transform (JS-exposed @JsxFunction transformToDocument/transformToFragment) invoked from attacker-controlled webpage JavaScript in HtmlUnit browser", "fix_addresses_it": true, "human_spot_check": null, "id": "htmlunit-htmlunit-2d8f01031e36f7f1", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "is_private_url called via validate_request_url for user-provided URLs (e.g. event organizer-supplied URL fields); no concrete in-repo route/handler with attacker-controlled source is established by the provided file context", "fix_addresses_it": true, "human_spot_check": null, "id": "indico-indico-7df3dccdecfcf290", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "RemoteImageMixin.validate_remote_image via DRF serializer field 'remote_image' (URLField) on API endpoints using RemoteImageMixin; attacker-controlled source is the remote_image URL submitted in the request body", "fix_addresses_it": true, "human_spot_check": null, "id": "inventree-inventree-3c189cf58ad5161c", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "powerline segment GitStatusSegment invoked when shell prompt renders in a directory containing a malicious .git/config (core.fsmonitor)", "fix_addresses_it": true, "human_spot_check": null, "id": "jaspernbrouwer-powerline-gitstatus-02af01b55c83b1b6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "clean_data (jquery.terminal.js) invoked during terminal formatting of user input; no in-repo route/handler/CLI argument shown", "fix_addresses_it": true, "human_spot_check": null, "id": "jcubic-jquery.terminal-14e90f7dbacbca75", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "clean_data", "fix_addresses_it": true, "human_spot_check": null, "id": "jcubic-jquery.terminal-5fac75c0184dbcd6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "clean_data (jquery.terminal formatter/attribute rendering)", "fix_addresses_it": true, "human_spot_check": null, "id": "jcubic-jquery.terminal-cb10a82f25867022", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-ansible-plugin-3b5afa072c43cab3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "AnsiblePlaybookStep.AnsiblePlaybookExecution.run() invoked via the ansiblePlaybook pipeline step; extraVars parameter (step.extraVars) is attacker/user-controlled and passed to convertExtraVars", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-ansible-plugin-4904f1516a63debe", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "extraVar (Job DSL context method)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-ansible-plugin-992e550732edf17b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "appendExtraVars (invoked during Ansible build step execution; extra vars configured via job configuration form)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-ansible-plugin-bfcea0679f20d5f1", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jenkinsci-aws-codebuild-plugin-1561c6b78bc53ad9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "CodeBuilder.perform (Jenkins build step) via readResolve deserialization of persisted CodeBuilder config", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-aws-codebuild-plugin-3c24887c571b4cb0", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "CodeBuildStep.CodeBuildExecution.run (Jenkins build step)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-aws-codebuild-plugin-3d0bfc1f65a1d762", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "CodeBuilder @DataBoundConstructor (Jenkins job configuration form)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-aws-codebuild-plugin-6ad10434eea5ee64", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "CodeBuilder.perform (Jenkins Builder) - AWSClientFactory constructor with getParameterized(this.awsSecretKey)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-aws-codebuild-plugin-74b2064ce4792a4c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "AWSClientFactory constructor (credentialsType=Keys path) invoked from build configuration; no concrete in-repo route/handler shown", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-aws-codebuild-plugin-78b40b445eb31871", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "doFillCredentialsIdItems (Jenkins Stapler HTTP endpoint helper)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-aws-credentials-plugin-79ab9c6465c74964", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-configuration-as-code-plugin-26c452bafd056c70", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "SecretBuildWrapper.decorateLogger / LineTransformationOutputStream.close (Jenkins build log output stream)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-credentials-binding-plugin-912adeb590b59d23", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jenkinsci-credentials-binding-plugin-d713906e76e2660a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doCheckDependencyTrackFrontendUrl (and doTestConnection) invoked via form validation request; attacker-controlled source is the @QueryParameter value / dependencyTrackApiKey and credentials ID", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-dependency-track-plugin-673cc48b4f75ebf5", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Jenkins HTTP endpoint doCheckDependencyTrackUrl (and doTestConnection) reachable via Stapler form validation; attacker-controlled source: @QueryParameter value / dependencyTrackUrl and dependencyTrackApiKey", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-dependency-track-plugin-90b566be2c3aebff", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doTestConnection (descriptor form validation endpoint, e.g. /descriptorByName/.../testConnection) with attacker-controlled dependencyTrackUrl and dependencyTrackApiKey query parameters", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-dependency-track-plugin-9e8488d96f7c0424", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "configure(StaplerRequest, JSONObject) global configuration handler", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-gitlab-logo-plugin-2cdae87438f0fc39", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "GitlabLogoProperty.getProject() via getIconUrl()/getRepositoryUrl()", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-gitlab-logo-plugin-46246cf241510f0a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Jenkins global configuration form submission handled by DescriptorImpl.configure(StaplerRequest, JSONObject) via Stapler; attacker-controlled source is the privateToken form field in the submitted JSON form data", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-gitlab-logo-plugin-f771ba20ac33c126", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "readResolve() on PluginDescriptor during Jenkins XML deserialization of hudson.plugins.jira.JiraProjectProperty.xml", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-jira-ext-plugin-28565b34d1c8489d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "JiraClientFactoryImpl.newJiraClient()", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-jira-ext-plugin-9bc3b4180b83656a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillJenkinsSitesItems on JobImportActionDescriptor (fill field for Jenkins sites), reachable by any authenticated user with Overall/Read permission", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-job-import-plugin-07e0e7023a46cf4d", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint /jobImport/fillCredentialIdItems (doFillCredentialIdItems on JobImportActionDescriptor), reachable by any authenticated user with Overall/Read permission", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-job-import-plugin-5509a356384e862e", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "MarkupFormatter.translate(String markup, Writer output) invoked by Jenkins when rendering descriptions configured with the Markdown Formatter", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-markdown-formatter-plugin-9c93ac91e86f4cc5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "MarkupFormatter.translate invoked by Jenkins rendering of user-editable descriptions", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-markdown-formatter-plugin-dd25c90bea9a886e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "doCommenceLogin(@QueryParameter String from, @Header(\"Referer\") String referer) -> getValidRedirectUrl(from != null ? from : referer)", "fix_addresses_it": false, "human_spot_check": null, "id": "jenkinsci-oic-auth-plugin-072cfcf18988ef12", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "doOwnersSubmit(StaplerRequest req, StaplerResponse rsp) via HTTP form submission to the job ownership config page; source: req.getSubmittedForm() JSON 'owners' field", "fix_addresses_it": false, "human_spot_check": null, "id": "jenkinsci-ownership-plugin-aec8f0570f4b80f1", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "Stapler HTTP endpoint doChangeSubmit (P4Hook) reachable via Jenkins Stapler routing; attacker-controlled source: StaplerRequest parameters (_.p4port) and submitted form", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-p4-plugin-5022afedadfe8449", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "P4Hook.doChange (HTTP endpoint /p4/change via StaplerRequest)", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-p4-plugin-65a59903d43924ee", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "HTTP endpoint doBuild/doBuildSubmit on ReviewAction (urlName 'review') via StaplerRequest parameters", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-p4-plugin-85c3775c29eb0c5c", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "HTTP endpoint /review/buildSubmit (Stapler doBuildSubmit) reachable via Overall/Read authenticated user submitting form data", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-p4-plugin-a1c0ab5c3582fc3b", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "UnprotectedRootAction P4Hook at URL /p4, HTTP endpoint doEvent (and doChange) reachable without authentication; attacker-controlled source is the HTTP request body/JSON payload (req.getInputStream)", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "jenkinsci-p4-plugin-fdef12ac487474fb", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-parameterized-remote-trigger-plugin-113227759c983f0a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-parameterized-remote-trigger-plugin-1361f56765dbad32", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "setApiToken via @DataBoundSetter during Jenkins global configuration save (RemoteBuildConfiguration.xml)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-parameterized-remote-trigger-plugin-5b7b011daea8e88e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "setAuthorizationHeader(URLConnection, BuildContext) invoked during remote build trigger HTTP request; apiToken sourced from Jenkins global configuration (RemoteBuildConfiguration.xml)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-parameterized-remote-trigger-plugin-f066bf7b2ae56763", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Pipeline Maven Integration plugin Maven build step parsing maven-spy.xml from agent temporary directory (listGeneratedArtifacts)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-pipeline-maven-plugin-f7e9c244b67b36a6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "InfoParser.parseFor parsing reportFile (Selenium HTML report file) via getReportFileFor(build, testResult, seleniumReportsDir)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-seleniumhtmlreport-plugin-596bcea5f710622a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "getPom(FilePath workspace) -> MasterToSlaveFileCallable.invoke parses pom.xml (BUILD_FILE) via DocumentBuilderFactory without disabling external entities", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-semantic-versioning-plugin-7a6f61fea77b9da3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "doDownloadAttachment Stapler request handler (Jenkins Stapler route /downloadAttachment) reading request parameter \"f\"", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-tap-plugin-b1954cc1fc64febe", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jenkinsci-zap-pipeline-plugin-22b29c9f11c9c050", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "archiveZap() Jenkins Pipeline step (ArchiveZapExecution.start)", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-zap-pipeline-plugin-35e96c45d9357469", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "archiveRawReport called from ZAP Pipeline build step (ZapBuilder/ZapStep) during Jenkins build", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-zap-pipeline-plugin-5ee6ae7d06c3ad5e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "ZapAction.doDynamic (Stapler route /job///zap/... via getUrlName() returning ZapArchive.DIRECTORY_NAME), serving DirectoryBrowserSupport content; attacker-controlled source is files in the workspace/archived artifacts", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-zap-pipeline-plugin-953ab12f1f2d06d9", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "jenkinsci-zap-pipeline-plugin-f405bf70465980bc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jhipster-generator-jhipster-561dd51556f2b530", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "GET /api/?sort=... (generated reactive entity list endpoint; sort parameter)", "fix_addresses_it": true, "human_spot_check": null, "id": "jhipster-generator-jhipster-98eceaae5495db76", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jhipster-generator-jhipster-b5bedd365fd447dc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jhipster-generator-jhipster-d40433c5e5a179bb", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.97, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jhipster-generator-jhipster-e25ba8d07362b033", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "GET /api/?sort=... (generated reactive entity list endpoint; sort parameter flows into EntityManager.createOrderByFields)", "fix_addresses_it": true, "human_spot_check": null, "id": "jhipster-generator-jhipster-e4ad88d8f028b8fe", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "jhipster-generator-jhipster-ed98b23f033108c6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "jhy-jsoup-6358e99ead4eb079", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "jhy-jsoup-caf11625421e51b5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "TagSet.valueOf(String tagName, String namespace, ParseSettings settings) called during HTML parsing of untrusted input via Jsoup.parse / Cleaner with a custom Safelist", "fix_addresses_it": true, "human_spot_check": null, "id": "jhy-jsoup-fb24c11d6f1b2ae3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()", "fix_addresses_it": true, "human_spot_check": null, "id": "john-broadway-pacioli-0409fd38692653dc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "john-broadway-pacioli-17356dc985f12ca8", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()", "fix_addresses_it": true, "human_spot_check": null, "id": "john-broadway-pacioli-2ae7bec575002cc8", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); caller-controlled source: Sales Invoice Item.asset Link field in request body", "fix_addresses_it": true, "human_spot_check": null, "id": "john-broadway-pacioli-39e17ab80d48e54e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); source: caller-supplied Sales Invoice Item.asset Link in request body", "fix_addresses_it": true, "human_spot_check": null, "id": "john-broadway-pacioli-46e518f703a36dc0", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); source: caller-supplied Sales Invoice Item.asset Link in request body", "fix_addresses_it": true, "human_spot_check": null, "id": "john-broadway-pacioli-48f1f22be6ba9f48", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "pacioli CLI build_parser (broker/pacioli/cli.py)", "fix_addresses_it": false, "human_spot_check": null, "id": "john-broadway-pacioli-9f19515916d1f37b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale (item row 'asset' Link from request body) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()", "fix_addresses_it": true, "human_spot_check": null, "id": "john-broadway-pacioli-b26b532c43a68565", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "john-broadway-pacioli-b3ff7c846381ada8", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "pacioli doctor CLI subcommand (cmd_doctor)", "fix_addresses_it": false, "human_spot_check": null, "id": "john-broadway-pacioli-f63aa31ecca38c1c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "api.tools.parse_response / api.helper.get.visible_emails_post / api.helper.get.email_data_post", "fix_addresses_it": true, "human_spot_check": null, "id": "kartiktalwar-gmail.js-301ae79245460d39", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "MongoDBSaver.deleteThread(threadId)", "fix_addresses_it": true, "human_spot_check": null, "id": "langchain-ai-langgraphjs-920b675720dbc952", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "parse_env_variables via Trainer initialization reading PL_TRAINER_GPUS environment variable", "fix_addresses_it": true, "human_spot_check": null, "id": "lightning-ai-pytorch-lightning-8a9ebfbdcc58e73e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "HTTP request path parsing in Armeria server (PathAndQuery.appendOneByte) reached via FileService under a path prefix, e.g. GET /files/..%2Fsecrets.txt", "fix_addresses_it": true, "human_spot_check": null, "id": "line-armeria-143c39cfd2874e4c", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "ArmeriaHttpUtil.decodePath invoked from HTTP request path handling (e.g., FileService under /files)", "fix_addresses_it": true, "human_spot_check": null, "id": "line-armeria-1a9b7d60cd9e8330", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "HTTP request path handling in Armeria server (PathAndQuery.splitPathAndQuery invoked from request path parsing); attacker-controlled source is the request path containing %2F, e.g. /files/..%2Fsecrets.txt", "fix_addresses_it": true, "human_spot_check": null, "id": "line-armeria-3196308da59204ff", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "ArmeriaHttpUtil.decodePath (called from Armeria server request path handling)", "fix_addresses_it": true, "human_spot_check": null, "id": "line-armeria-36dfac02c436f929", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "HTTP request path handling in Armeria server (e.g., FileService under /files)", "fix_addresses_it": true, "human_spot_check": null, "id": "line-armeria-5e40f3c4fd9a04ba", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "line-armeria-7fb77b8814401e5d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "RoutingResultBuilder.rawParam called during HTTP request routing; no concrete in-repo route/handler or attacker-controlled source shown in provided context", "fix_addresses_it": true, "human_spot_check": null, "id": "line-armeria-ecc4313228868198", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "HTTP request path parsing in Armeria server (PathAndQuery.parse) invoked via FileService under a route such as /files, attacker-controlled source: request path containing %2F", "fix_addresses_it": true, "human_spot_check": null, "id": "line-armeria-fff692dc76424e72", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "livehelperchat-livehelperchat-4d161f6aa8f9499a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.2, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "livehelperchat-livehelperchat-70cbfb17db2cecb4", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "lhc_web/cli/lib/install.php step3() invoked via CLI installer (php cron.php / install script)", "fix_addresses_it": true, "human_spot_check": null, "id": "livehelperchat-livehelperchat-90e4ec70ac068666", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.3, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "livehelperchat-livehelperchat-db8669fb4edb63c2", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "ljharb-shell-quote-74ceec6e8c431f73", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "iziModal('open') plugin method invoked by page JavaScript with attacker-influenced options.title", "fix_addresses_it": false, "human_spot_check": null, "id": "marcelodolza-izimodal-afd617de248065eb", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "commandExists(commandName, callback) exported function", "fix_addresses_it": true, "human_spot_check": null, "id": "mathisonian-command-exists-5c2ea6b59177e0dc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "Pipeline.__init__ via config_file (dey_mini.yaml) ['nnet']['module']", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-modelscope-0fa875b67930ece7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "ImageViewTransform.__init__ (model_dir from config file dey_mini.yaml ['nnet']['module'])", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-modelscope-1d41167fffcc5136", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "DROEstimation.__init__ via model loading (model_dir)", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-modelscope-36d2bd78fdd5731d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Pipeline.__init__ via config_file (dey_mini.yaml) ['nnet']['module']", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-modelscope-3718dff6ca9e3eb5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "LinearAECPipeline.__init__ (pipeline instantiation via modelscope pipeline API)", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-modelscope-71fef32c90c184a3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "Model.__init__ via configuration file key ['nnet']['module']", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-modelscope-75fd1dee4ec928eb", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "PedestrainAttributeRecognitionPipeline.__init__ via pipeline(Tasks.pedestrian_attribute_recognition, model=...) with attacker-controlled model config", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-modelscope-bb25a58bfaca076c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Template._save_pil_image (static method in swift/template/base.py); no in-repo route, request handler, or CLI argument is shown reaching it with attacker-controlled image data", "fix_addresses_it": true, "human_spot_check": null, "id": "modelscope-ms-swift-600a21056f8085a7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "import_report_from_email(content) -> import_archive -> import_report; content originates from DMARC report emails sent to the rua address of a domain", "fix_addresses_it": true, "human_spot_check": null, "id": "modoboa-modoboa-dmarc-7b9ba42b6d644e40", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "import_report(content) called with XML content from emailed DMARC reports (rua address)", "fix_addresses_it": true, "human_spot_check": null, "id": "modoboa-modoboa-dmarc-9e011e2d13bc2f47", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "saveAttachments (LocalFileSystemAttachmentServiceImpl) invoked via Genie API multipart/form-data attachment upload", "fix_addresses_it": true, "human_spot_check": null, "id": "netflix-genie-3c700ed384082b01", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "HerokuAddonPool(id, app, opt) exported function; app parameter interpolated into cp.exec", "fix_addresses_it": true, "human_spot_check": null, "id": "nodef-heroku-addonpool-e3d374b9c51542a9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "unadded()", "fix_addresses_it": true, "human_spot_check": null, "id": "omrilotan-async-git-06a6c2a9fdaf1fe6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "module.exports = async function(tag) in lib/tag/index.js", "fix_addresses_it": true, "human_spot_check": null, "id": "omrilotan-async-git-0cd4fa8d294bb15c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "module.exports function in lib/modified/index.js (library API, no in-repo route/handler/CLI)", "fix_addresses_it": true, "human_spot_check": null, "id": "omrilotan-async-git-1c70190766100c0e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "lib/remote/index.js remote() (test file lib/remote/spec.js)", "fix_addresses_it": true, "human_spot_check": null, "id": "omrilotan-async-git-c2e0fe13af8ae7dc", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "remote()", "fix_addresses_it": true, "human_spot_check": null, "id": "omrilotan-async-git-e3f54204efc8569d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "openapi-generators-openapi-python-client-08eea42408cf3b85", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Project.__init__ via CLI generation from an OpenAPI document (openapi.title used to build project_dir path)", "fix_addresses_it": true, "human_spot_check": null, "id": "openapi-generators-openapi-python-client-6597f2ff2bd4d4af", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "openapi-python-client CLI generating a client from an attacker-supplied OpenAPI document (snake_case called on schema names)", "fix_addresses_it": true, "human_spot_check": null, "id": "openapi-generators-openapi-python-client-eec25cd455fc2186", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "openapi-python-client CLI generating a client from an attacker-supplied OpenAPI document (tag names flow into _build_api file paths)", "fix_addresses_it": true, "human_spot_check": null, "id": "openapi-generators-openapi-python-client-faf2d6df0e1fba6a", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": true, "human_spot_check": null, "id": "openstack-nova-4045dc3bd0ca9f47", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Bash.run (metagpt/tools/libs/terminal.py) invoked as an LLM tool; no in-repo HTTP route or CLI argument source is shown", "fix_addresses_it": true, "human_spot_check": null, "id": "paipeline-metagpt-5bf0b5683141e177", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.3, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "paipeline-metagpt-8a7c60e38d5f4edd", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "paipeline-metagpt-9e79068fd7901a91", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "Terminal.run_command (no in-repo HTTP route or CLI argument shown reaching it)", "fix_addresses_it": false, "human_spot_check": null, "id": "paipeline-metagpt-bf0e585f3114f491", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "petl.io.xml.fromxml() -> XmlView.__iter__", "fix_addresses_it": true, "human_spot_check": null, "id": "petl-developers-petl-c3a25a317f77d4e7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "petl.io.xml.fromxml() -> XmlView.__iter__ -> etree.parse(xmlf)", "fix_addresses_it": true, "human_spot_check": null, "id": "petl-developers-petl-d8f99d8829b06c72", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "petl.io.xml.fromxml", "fix_addresses_it": true, "human_spot_check": null, "id": "petl-developers-petl-fe2841388aef1fd9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "HTTP GET / handler _on_root_request_cb reading request.url.query (_state_id_)", "fix_addresses_it": true, "human_spot_check": null, "id": "posit-dev-py-shiny-3537c0dd41a40d38", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "HTTP request query string `_state_id_` parameter reaching `_load_state_qs` (bookmark restore path)", "fix_addresses_it": true, "human_spot_check": null, "id": "posit-dev-py-shiny-78e995f1fddd0cb5", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "HTTP request query string parsed by RestoreContext.from_query_string via the Shiny bookmark-restore path; attacker-controlled source is the `_state_id_` query-string parameter", "fix_addresses_it": true, "human_spot_check": null, "id": "posit-dev-py-shiny-8fd07b2eca54563e", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "posit-dev-py-shiny-c4952ae2ef71c906", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "posit-dev-py-shiny-d9a1d7c28404388d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "getErrorDiv called from fetchAndGenerateResults error handler; source is search API response error message", "fix_addresses_it": true, "human_spot_check": null, "id": "readthedocs-readthedocs-sphinx-search-391e2f80eb80c3c8", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "generateSingleResult (called from generateSuggestionsList with search backend response data)", "fix_addresses_it": true, "human_spot_check": null, "id": "readthedocs-readthedocs-sphinx-search-885af7a7682d69e3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "get_section_html", "fix_addresses_it": true, "human_spot_check": null, "id": "readthedocs-readthedocs-sphinx-search-eb34d0b4ee01b206", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.4, "entry_point": "plot(options)", "fix_addresses_it": true, "human_spot_check": null, "id": "rkesters-gnuplot-d931b1756db47945", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "language_attributes filter via cleanHtmlMarkup()", "fix_addresses_it": true, "human_spot_check": null, "id": "roots-soil-8fa3ef8a493b8d64", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Inventory.php store() method, invoked via Livewire request from the admin product inventory form; attacker-controlled source is the authenticated low-privilege panel user's Livewire action call and form state", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-02254beed509364c", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "Livewire component Shopper\\Admin\\Livewire\\Components\\Customers\\Orders (public $customer property, table()/render()); attacker-controlled source: Livewire client-side property tampering of the unlocked public ShopperUser $customer", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-047e62abed0b91fa", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Shopper\\Livewire\\Components\\Orders\\OrderNotes::leaveNotes(), invoked via Livewire update request from the order detail admin panel; attacker-controlled source is the public $notes property and the Livewire-callable leaveNotes action", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-052f88a347caf2eb", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Livewire admin component Settings/Team/Index (table recordActions DeleteAction) reachable by any authenticated panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-064f0b5f8937aae5", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "shopperlabs-shopper-0d7758a9a7d45a31", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin Order Detail component action markCompleteAction (Filament action callable by authenticated low-privilege panel user with read_orders)", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-0fd6e8d87dd0ed82", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Settings/Team/RolePermission::save() invoked via Livewire update request from the admin panel route (shopper settings team role page); attacker-controlled source is the authenticated low-privilege panel user's Livewire action call and form state", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-1112cc61420816ff", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "shopperlabs-shopper-137aa7e49095c9df", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Products\\Form\\Edit::store() invoked via Livewire update request from the admin product edit form; attacker-controlled source is the Livewire form state (data) submitted by an authenticated low-privilege panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-13fdb238d0d8e573", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin component packages/admin/src/Livewire/Pages/Order/Detail.php::capturePaymentAction (Filament action 'capturePayment' invoked by an authenticated low-privilege panel user with read_orders permission)", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-22487ec06a8cf50a", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin component packages/admin/src/Livewire/Pages/Order/Shipments.php::table() record actions (markDelivered, edit) invoked via Livewire request by an authenticated low-privilege panel user with browse_orders/read_orders permission", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-2405022067cc6870", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin component Order/Detail markPaidAction (Filament action 'markPaid') invoked by an authenticated low-privilege panel user with read_orders permission", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-29811dac402a0d13", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin component Order/Detail archiveAction (Filament action 'archive') invoked via Livewire request to the admin order detail page; attacker-controlled source is the authenticated low-privilege panel user's Livewire action call", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-2aeaefee52274ee8", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Files.php store() action, invoked via Livewire request to the product edit page; attacker-controlled source is the Livewire action call and form state from any authenticated panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-5481a94c34f42fbf", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Products\\Form\\Shipping::store() invoked via Livewire update request from the admin product shipping form; attacker-controlled source is the Livewire action call and form state ($this->data) submitted by any authenticated panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-5a3dcf2a6b6b16c8", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Settings/Team/RolePermission::createPermissionAction (admin panel route for role permissions), invoked by an authenticated low-privilege panel user with view_users permission", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-5e6161ace0cb4b97", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Carriers::createCarrierAction (admin panel route rendering the Carriers Livewire component); attacker-controlled source: authenticated low-privilege panel user invoking the createCarrier Filament action with form data", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-61e951b6bcd03186", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Livewire component packages/admin/src/Livewire/Pages/Collection/Edit.php store() action, invoked via Livewire update request from the admin collection edit page by an authenticated low-privilege panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-7cc69fb293ec0e10", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin component Settings/Team/RolePermission::generatePermissionsAction (Filament action 'generatePermissions'), invoked by an authenticated panel user with only view_users permission; source is the Livewire action request payload (resource/group_name)", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-8769d9915b8295a9", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Currencies (route /settings/currencies) - table() ToggleColumn is_enabled, EditAction edit, and grouped bulk actions enable/disable; attacker-controlled Livewire method calls (e.g. updateTableColumnState, mountTableAction, callTableBulkAction) from an authenticated low-privilege panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-88497bd11908cf4a", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "Livewire component AddVariant (packages/admin/src/Livewire/SlideOvers/AddVariant.php) form() barcode TextInput; attacker-controlled source is the barcode form field submitted via the Livewire save() action, rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-8b7021ee40c51b56", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Livewire component Settings\\Legal\\PolicyForm::store() invoked via Livewire update request from the admin panel; attacker-controlled source is the authenticated low-privilege panel user's Livewire request payload (form state) reaching $this->legal->update()", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-91023b586e4ab747", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Livewire component Shopper\\Livewire\\Components\\Settings\\Team\\Permissions::togglePermission invoked via Livewire update request from the admin panel Team/RolePermission UI", "fix_addresses_it": false, "human_spot_check": null, "id": "shopperlabs-shopper-995f958bcb3b415b", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\PaymentMethods::createPaymentAction (admin panel route for payment methods settings); attacker-controlled source: authenticated low-privilege panel user invoking the createPayment Livewire action", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-a413505de3d037f8", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Seo.php store() action, invoked via Livewire request to the product SEO form; attacker-controlled source is the Livewire component action call and form state from any authenticated panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-a82b452965e2ffe5", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.6, "entry_point": "Livewire component packages/admin/src/Livewire/SlideOvers/AddProduct.php::store() invoked via Livewire request to the AddProduct slide-over (form submit wire:target=\"store\"); attacker-controlled source is the Livewire-bound $data form state including the barcode field", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-ab37699016e7189c", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Product\\Variant::updateStockAction (admin panel product variant page); attacker-controlled source: Livewire action call with form data (sku, barcode) from an authenticated low-privilege user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-b37cd0c75b594760", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Livewire component Shopper\\Admin\\Livewire\\Components\\Products\\Form\\Inventory (form/table actions)", "fix_addresses_it": true, "human_spot_check": null, "id": "shopperlabs-shopper-cd42a8054fc4a7f9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin component Shopper\\Livewire\\Pages\\Order\\Detail::cancelOrderAction invoked via Livewire action call on the order detail page (route shopper.orders.detail); attacker-controlled source is the authenticated low-privilege panel user's Livewire action request, which only required read_orders", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-cd45e0d6604bb846", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Settings/Locations/InventoryForm::store() invoked via Livewire update request from the admin panel route shopper.settings.locations; attacker-controlled source is the Livewire form state ($this->form->getState()) submitted by an authenticated low-privilege panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-d05ad8c2776691be", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component PaymentMethods (Settings/PaymentMethods) table actions: ToggleColumn is_enabled, EditAction edit, DeleteAction delete; invoked via Livewire update endpoint by any authenticated panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-d26bdca35566e799", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire admin component Order/Detail::startProcessingAction (Filament action 'startProcessing') invoked by an authenticated low-privilege panel user with read_orders permission", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-deb90b541bcac1aa", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Team\\Index (route: shopper.settings.team.index) - createRoleAction invoked by any authenticated panel user; source: Livewire action call from client", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-df2391064e3c3332", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Livewire component Settings/Team/Permissions::removePermission invoked via Livewire action from admin panel; source is the Livewire action parameter $id", "fix_addresses_it": false, "human_spot_check": null, "id": "shopperlabs-shopper-ed89d9515bdaac41", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "Livewire component Customers\\Create::store() invoked via admin panel route shopper.customers.create (Livewire POST to /admin/customers/create); attacker-controlled source is the Livewire form state ($this->form->getState()) submitted by an authenticated low-privilege panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-f3cb66743db8d5f1", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "Livewire component packages/admin/src/Livewire/Pages/Settings/Carriers.php (table actions: ToggleColumn is_enabled, EditAction, DeleteAction) invoked via Livewire update requests by any authenticated panel user", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "shopperlabs-shopper-fddd0d6c3c4501aa", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "bootstrap-select plugin initialization/render (client-side library); no in-repo server route or CLI handler", "fix_addresses_it": true, "human_spot_check": null, "id": "snapappointments-bootstrap-select-5d3e7953302ad040", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "spatie-laravel-medialibrary-17bc134397b9d3f7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "spatie-laravel-medialibrary-9b12f440411602e2", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.95, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "supabase-auth-js-13d9df5e852b0156", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "resolveFile via loadFileDataForInput (UI server-side file resolution)", "fix_addresses_it": false, "human_spot_check": null, "id": "tensorzero-tensorzero-1df57d6b5c9fc101", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-00a60694b44cad58", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-017c730f695963d1", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-0303c786b3f9def3", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-03db63004dde1012", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-0847872016dff82d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-0b7c25791baf4ea7", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-0d903711cc0bf246", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.55, "entry_point": "POST /api/v1/schedules/:scheduleId/deactivate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.deactivate.ts), authenticated via authenticateApiRequest using an environment-scoped secret API key", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "triggerdotdev-trigger.dev-0eb72665259b13c2", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.55, "entry_point": "POST /api/v1/schedules/:scheduleId/activate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.activate.ts), authenticated via authenticateApiRequest using an environment-scoped secret API key", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "triggerdotdev-trigger.dev-124d417d0ae18fbe", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-1389b2b039433f1d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-1609ba0be33d1321", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-173943fa33a292d8", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "POST /api/v1/deployments/:deploymentId/cancel (api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment(projectId, friendlyId); attacker-controlled source: deploymentId path param + secret API key of a lower-trust environment", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "triggerdotdev-trigger.dev-2240070f2c86924b", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-23e4ffbc736b2960", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-28978c4024d4bf10", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-2ad2f0a3cde32718", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.95, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-2f8805383abee870", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "POST /api/v1/deployments/:deploymentId/cancel (action in apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts); attacker-controlled source: API key in request headers via authenticateRequest, plus deploymentId path param", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "triggerdotdev-trigger.dev-30dec4b7031de737", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-3309f58798af795d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-33568c3becc0c84c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-34d89ac9922ed6c5", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-397d55d61662dcbb", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-3b2daa8cc067a965", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-3da6ba2954fae9e2", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-428c7b244470b508", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-5224c92a3bd5124b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-52d2cb11d78d0327", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-5392f925c70f8c55", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-588437af67b5a758", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.85, "entry_point": "POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) with attacker-controlled secret API key (dev/preview env) and deploymentId param", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "triggerdotdev-trigger.dev-5b0c0ef74fdf5bc3", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-5c1e8b013b50f48d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment; attacker-controlled source: authenticated secret API key (environment) and deploymentId path param", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "triggerdotdev-trigger.dev-5f1cf28e3ac84980", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-69e5a79ca434a31b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-72c9f380f92bd8f2", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-7323929a73b6be76", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-816142e126393220", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-874f7ae9b06d875b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-92c5190a8ba1209d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-984189f717b2a3da", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-99347f6b51258e29", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-a20e065c9b6ced3b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-b2314fca2554ca64", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-b8f3fea0ac68f12c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-ca2ef47f420ef2eb", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-d7690485d67bf995", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-dcc34c0e95ea739c", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-ddd75cb2ab0e406d", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-df02f538ad370706", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-dfa82db3c18c0e1b", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "POST /api/v1/deployments/$deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment; attacker-controlled source: authenticated environment secret API key (dev/preview key) plus deploymentId path param", "fix_addresses_it": true, "human_spot_check": { "date": "2026-10-13", "decision": "accept", "reviewer": "mc" }, "id": "triggerdotdev-trigger.dev-eebfca9646e01b1c", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "accepted", "vulnerable_pre_fix": true }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-f2588e86d347fea6", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": false, "confidence": 0.05, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "triggerdotdev-trigger.dev-f809e61cae1a9f29", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Affix constructor via $.fn.affix(options) or data-spy=\"affix\" data attributes; options.target passed to $(this.options.target)", "fix_addresses_it": true, "human_spot_check": null, "id": "twbs-bootstrap-a6f8f24cd4354719", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Tooltip.prototype.init via $.fn.tooltip plugin (options.viewport / options.container)", "fix_addresses_it": true, "human_spot_check": null, "id": "twbs-bootstrap-bfa547024b92ef59", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.55, "entry_point": "Collapse.prototype.getParent (options.parent selector)", "fix_addresses_it": true, "human_spot_check": null, "id": "twbs-bootstrap-d29d2c0e551ad5e8", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.9, "entry_point": "", "fix_addresses_it": false, "human_spot_check": null, "id": "web-infra-dev-rspack-c788948210260bd9", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false }, { "advisory_cited": true, "confidence": 0.75, "entry_point": "processMessage(message, ctx) invoked from the Baileys socket message pipeline (e.g. sendMessage/ev 'messages.upsert' handling); attacker-controlled source is the incoming WAMessage.message.protocolMessage (placeholderResendMessage / PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE, HISTORY_SYNC_NOTIFICATION, APP_STATE_SYNC_KEY_SHARE) delivered over the WhatsApp protocol", "fix_addresses_it": true, "human_spot_check": null, "id": "whiskeysockets-baileys-89cd6d4edf46d286", "model": "deepseek-flash", "reachable_in_repo": true, "verdict": "pending_human", "vulnerable_pre_fix": true }, { "advisory_cited": true, "confidence": 0.35, "entry_point": "AuthService.handleCallback", "fix_addresses_it": true, "human_spot_check": null, "id": "workos-authkit-session-399c57ce0227249e", "model": "deepseek-flash", "reachable_in_repo": false, "verdict": "rejected", "vulnerable_pre_fix": false } ] }