# Advisory-fix pairs, batch 3 (2026-10-04): more (vulnerable function, fixed function) pairs where the function
# SURVIVES the fix, to roughly double the decision engine's paired data.
#
# Same rules as batch 2 (benchmarks/pairs/advisory-fixes-2/catalog.toml): a reviewed GHSA advisory (pip, npm, maven,
# composer) whose single fix commit (one parent) is linked from the advisory -- or, new here, the single commit of a
# merged pull request the advisory links (its only commit, or its squash/rebase merge commit); at most 4 non-test source
# files and 120 changed source lines, or up to 6 files / 240 lines in a second pass (`fix_lines.source_total` records
# the size, and the function's diff was read either way); the function holding the changed code lines is declared
# exactly once on both sides (the label builder's matcher, learn.excerpt.function_bounds) and its body differs. The positive is that function at `parent`,
# the negative the same function at `commit`. The function is chosen by changed lines, then its diff was read and
# kept only when the named function itself holds the fix: `provenance = "agent"`, `fix_lines` records the counts.
# Advisories whose CWEs span two families (second pass) carry the family the function's diff shows (agent-chosen).
# Weighted toward the weak families (injection, untrusted_destination); enumeration reached back to 2023 for them,
# newest first, so `post_cutoff` (published on or after 2026-06-01) is recorded per pair.
# Repositories: permissive licences only (SPDX from the API), none named anywhere else under benchmarks/ (populations
# v1/v2, every pair corpus including batches 1 and 2), no WordPress plugin, and the reserved-population test passes.
#
# Pointer pairs (vendored = false), the advisory-fixes slice and cache layout: materialize.py --catalog <this file>
# verifies the cached excerpts (verification.json beside this file). Screening record:
# benchmarks/measurements/2026-10-04-decision-engine-harvest-3/record.json. `split` alternates train/holdout by fix
# date within each family; one pair per repository.

[[pair]]
name = "fosuserbundle-refreshuser-5a36e29"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "friendsofsymfony/fosuserbundle"
cve = "GHSA-8wx3-8m4x-g5h4"
cwe = "CWE-285"
ecosystem = "composer"
published_at = "2024-05-15T21:43:23Z"
post_cutoff = false
commit = "5a36e2958068d1e6501dc8cf39bbae3ebb859d9f"
parent = "b3dc5faf0017a621537dd5ec44047be5ad5bb82e"
commit_url = "https://github.com/friendsofsymfony/fosuserbundle/commit/5a36e2958068d1e6501dc8cf39bbae3ebb859d9f"
vendored = false
host = "github"
path = "Model/UserManager.php"
mode = "name"
relpath = "Model/UserManager.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2012-07-10"
fix_lines = { in_function = 9, in_file = 9, source_total = 10 }

[[pair.expected]]
cwe = "CWE-285"
class = "missing-authorization"
path = "Model/UserManager.php"
function = "refreshUser"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-8wx3-8m4x-g5h4: FOSUserBundle User Identity Validation Vulnerability"

[[pair]]
name = "security-getresolvedindexpattern-f7cc569"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "opensearch-project/security"
cve = "CVE-2022-41918 GHSA-wmx7-x4jp-9jgg"
cwe = "CWE-863"
ecosystem = "maven"
published_at = "2023-03-07T20:04:42Z"
post_cutoff = false
commit = "f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
parent = "f75be3edaf900df6f42aec2fd41175e66af06f3b"
commit_url = "https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4"
vendored = false
host = "github"
path = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java"
mode = "name"
relpath = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-11-07"
fix_lines = { in_function = 14, in_file = 9, source_total = 15 }

[[pair.expected]]
cwe = "CWE-863"
class = "incorrect-authorization"
path = "src/main/java/org/opensearch/security/securityconf/ConfigModelV7.java"
function = "getResolvedIndexPattern"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-wmx7-x4jp-9jgg: OpenSearch has issue with fine-grained access control of indices backing data streams"

[[pair]]
name = "orocalendarbundle-checkpermissions-460a8ff"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "oroinc/orocalendarbundle"
cve = "CVE-2023-32062 GHSA-x2xm-p6vq-482g"
cwe = "CWE-284"
ecosystem = "composer"
published_at = "2023-11-27T23:29:11Z"
post_cutoff = false
commit = "460a8ffb63b10c76f2fa26d53512164851c4909b"
parent = "fa001c6b6dfbd4bd0ef7e72bd168bc978226e90a"
commit_url = "https://github.com/oroinc/orocalendarbundle/commit/460a8ffb63b10c76f2fa26d53512164851c4909b"
vendored = false
host = "github"
path = "Controller/SystemCalendarEventController.php"
mode = "name"
relpath = "Controller/SystemCalendarEventController.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-06-01"
fix_lines = { in_function = 6, in_file = 7, source_total = 7 }

[[pair.expected]]
cwe = "CWE-284"
class = "access-control"
path = "Controller/SystemCalendarEventController.php"
function = "checkPermissions"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-x2xm-p6vq-482g: OroCalendarBundle has incorrect system calendar events visibility"

[[pair]]
name = "remult-doonid-6892ae9"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "remult/remult"
cve = "CVE-2023-35167 GHSA-7hh3-3x64-v2g9"
cwe = "CWE-284"
ecosystem = "npm"
published_at = "2023-06-20T18:50:15Z"
post_cutoff = false
commit = "6892ae97134126d8710ef7302bb2fc37730994c5"
parent = "5341348ebc7b65859bfd02baf750bd999778e155"
commit_url = "https://github.com/remult/remult/commit/6892ae97134126d8710ef7302bb2fc37730994c5"
vendored = false
host = "github"
path = "projects/core/src/data-api.ts"
mode = "name"
relpath = "projects/core/src/data-api.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-06-19"
fix_lines = { in_function = 9, in_file = 8, source_total = 16 }

[[pair.expected]]
cwe = "CWE-284"
class = "access-control"
path = "projects/core/src/data-api.ts"
function = "doOnId"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-7hh3-3x64-v2g9: When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id"

[[pair]]
name = "micronaut-security-parseaudiences-9728b92"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "micronaut-projects/micronaut-security"
cve = "CVE-2023-36820 GHSA-qw22-8w9r-864h"
cwe = "CWE-284"
ecosystem = "maven"
published_at = "2023-10-05T20:55:14Z"
post_cutoff = false
commit = "9728b925221a0d87798ccf250657a3c214b7e980"
parent = "c3eeb1957a1e3d5a6b60042a349bbc93cd0809fc"
commit_url = "https://github.com/micronaut-projects/micronaut-security/commit/9728b925221a0d87798ccf250657a3c214b7e980"
vendored = false
host = "github"
path = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java"
mode = "name"
relpath = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-06-23"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-284"
class = "access-control"
path = "security-oauth2/src/main/java/io/micronaut/security/oauth2/client/IdTokenClaimsValidator.java"
function = "parseAudiences"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-qw22-8w9r-864h: io.micronaut.security:micronaut-security-oauth2 has invalid IdTokenClaimsValidator logic on aud"

[[pair]]
name = "servicenow-devops-plugin-dochecktoolid-67192e2"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/servicenow-devops-plugin"
cve = "CVE-2023-3442 GHSA-cj2x-r74q-vcx9"
cwe = "CWE-862"
ecosystem = "maven"
published_at = "2023-07-26T21:30:19Z"
post_cutoff = false
commit = "67192e24099787ad732b41d581f20714d4253921"
parent = "d7d2422b016995402dd245d9c9c5c2f4cf00c691"
commit_url = "https://github.com/jenkinsci/servicenow-devops-plugin/commit/67192e24099787ad732b41d581f20714d4253921"
vendored = false
host = "github"
path = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java"
mode = "name"
relpath = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-06-30"
fix_lines = { in_function = 2, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "src/main/java/io/jenkins/plugins/config/DevOpsConfiguration.java"
function = "doCheckToolId"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-cj2x-r74q-vcx9: Missing authorization in Jenkins Plug-in for ServiceNow "

[[pair]]
name = "synapse-received-remote-receipt-63d28a8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "matrix-org/synapse"
cve = "CVE-2023-42453 GHSA-7565-cq32-vx2x"
cwe = "CWE-285"
ecosystem = "pip"
published_at = "2023-09-26T19:20:38Z"
post_cutoff = false
commit = "63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881"
parent = "4663d555021ce53c57e418eb1ee4445eab276bc4"
commit_url = "https://github.com/matrix-org/synapse/commit/63d28a88c1d18c64ea7e23b6dd7483e6d5dcf881"
vendored = false
host = "github"
path = "synapse/handlers/receipts.py"
mode = "name"
relpath = "synapse/handlers/receipts.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-09-18"
fix_lines = { in_function = 10, in_file = 24, source_total = 30 }

[[pair.expected]]
cwe = "CWE-285"
class = "missing-authorization"
path = "synapse/handlers/receipts.py"
function = "_received_remote_receipt"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-7565-cq32-vx2x: matrix-synapse vulnerable to improper validation of receipts allows forged read receipts"

[[pair]]
name = "strapi-plugin-protected-populate-protectpopulate-0544106"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "strapi-community/strapi-plugin-protected-populate"
cve = "CVE-2023-48218 GHSA-6h67-934r-82g7"
cwe = "CWE-863"
ecosystem = "npm"
published_at = "2023-11-20T21:01:43Z"
post_cutoff = false
commit = "05441066d64e09dd55937d9f089962e9ebe2fb39"
parent = "14f392f4d07bfaa7c28c63153a0f369d563f7360"
commit_url = "https://github.com/strapi-community/strapi-plugin-protected-populate/commit/05441066d64e09dd55937d9f089962e9ebe2fb39"
vendored = false
host = "github"
path = "server/middlewares/helpers/protect-route.js"
mode = "name"
relpath = "server/middlewares/helpers/protect-route.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-11-13"
fix_lines = { in_function = 8, in_file = 6, source_total = 11 }

[[pair.expected]]
cwe = "CWE-863"
class = "incorrect-authorization"
path = "server/middlewares/helpers/protect-route.js"
function = "protectPopulate"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-6h67-934r-82g7: Bypass of field access control in strapi-plugin-protected-populate"

[[pair]]
name = "scriptler-plugin-doshowscript-5addb5f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/scriptler-plugin"
cve = "CVE-2023-50765 GHSA-4j42-6xfx-h754"
cwe = "CWE-862"
ecosystem = "maven"
published_at = "2023-12-13T18:31:04Z"
post_cutoff = false
commit = "5addb5f9e68596abdba216e61cf714c2767b874b"
parent = "bfa9b3085865d1cb9dce714770e87c4f2651fbf6"
commit_url = "https://github.com/jenkinsci/scriptler-plugin/commit/5addb5f9e68596abdba216e61cf714c2767b874b"
vendored = false
host = "github"
path = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java"
mode = "name"
relpath = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-12-12"
fix_lines = { in_function = 5, in_file = 8, source_total = 46 }

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "src/main/java/org/jenkinsci/plugins/scriptler/ScriptlerManagement.java"
function = "doShowScript"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-4j42-6xfx-h754: Missing permission check in Jenkins Scriptler Plugin"

[[pair]]
name = "undici-shouldremoveheader-6805746"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "nodejs/undici"
cve = "CVE-2024-30260 GHSA-m4v8-wqvr-p9f7"
cwe = "CWE-285"
ecosystem = "npm"
published_at = "2024-04-04T14:20:39Z"
post_cutoff = false
commit = "6805746680d27a5369d7fb67bc05f95a28247d75"
parent = "ee5f892f3955eaca37730ed30349153ba203e9cd"
commit_url = "https://github.com/nodejs/undici/commit/6805746680d27a5369d7fb67bc05f95a28247d75"
vendored = false
host = "github"
path = "lib/handler/redirect-handler.js"
mode = "name"
relpath = "lib/handler/redirect-handler.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-04-02"
fix_lines = { in_function = 4, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-285"
class = "missing-authorization"
path = "lib/handler/redirect-handler.js"
function = "shouldRemoveHeader"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-m4v8-wqvr-p9f7: Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline"

[[pair]]
name = "silverstripe-reports-handleaction-0351106"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "silverstripe/silverstripe-reports"
cve = "CVE-2024-29885 GHSA-89q6-98xx-4ffw"
cwe = "CWE-863"
ecosystem = "composer"
published_at = "2024-07-17T14:26:31Z"
post_cutoff = false
commit = "0351106c18ad4246d983b5f4e082c09c382121f4"
parent = "2b55d91bb307ee6b542136d5cc7c9524e2385cc4"
commit_url = "https://github.com/silverstripe/silverstripe-reports/commit/0351106c18ad4246d983b5f4e082c09c382121f4"
vendored = false
host = "github"
path = "code/ReportAdmin.php"
mode = "name"
relpath = "code/ReportAdmin.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-07-16"
fix_lines = { in_function = 3, in_file = 3, source_total = 3 }

[[pair.expected]]
cwe = "CWE-863"
class = "incorrect-authorization"
path = "code/ReportAdmin.php"
function = "handleAction"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-89q6-98xx-4ffw: Silverstripe Reports are still accessible even when `canView()` returns false"

[[pair]]
name = "flask-cors-get-cors-headers-7ae310c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "corydolphin/flask-cors"
cve = "CVE-2024-6221 GHSA-hxwh-jpp2-84pm"
cwe = "CWE-284"
ecosystem = "pip"
published_at = "2024-08-18T21:31:07Z"
post_cutoff = false
commit = "7ae310c56ac30e0b94fb42129aa377bf633256ec"
parent = "f25c6b2ed243457a64567a8fe40e5df6da0cb3dc"
commit_url = "https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec"
vendored = false
host = "github"
path = "flask_cors/core.py"
mode = "name"
relpath = "flask_cors/core.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-08-30"
fix_lines = { in_function = 3, in_file = 5, source_total = 26 }

[[pair.expected]]
cwe = "CWE-284"
class = "access-control"
path = "flask_cors/core.py"
function = "get_cors_headers"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-hxwh-jpp2-84pm: Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default"

[[pair]]
name = "matrix-js-sdk-getvisiblerooms-43c72d5"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "matrix-org/matrix-js-sdk"
cve = "CVE-2025-59160 GHSA-mp7c-m3rh-r56v"
cwe = "CWE-862"
ecosystem = "npm"
published_at = "2025-09-16T20:18:57Z"
post_cutoff = false
commit = "43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4"
parent = "ff89c9ec426939530a9df3bc8112ecca4b3f4e52"
commit_url = "https://github.com/matrix-org/matrix-js-sdk/commit/43c72d5bf5e2d0a26b3b4f71092e7cb39d4137c4"
vendored = false
host = "github"
path = "src/client.ts"
mode = "name"
relpath = "src/client.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-09-16"
fix_lines = { in_function = 18, in_file = 14, source_total = 21 }

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "src/client.ts"
function = "getVisibleRooms"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-mp7c-m3rh-r56v: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another"

[[pair]]
name = "strimzi-kafka-operator-generaterolebindingforrole-c8a1493"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "strimzi/strimzi-kafka-operator"
cve = "CVE-2025-66623 GHSA-xrhh-hx36-485q"
cwe = "CWE-863"
ecosystem = "maven"
published_at = "2025-12-05T22:02:37Z"
post_cutoff = false
commit = "c8a14935e99c91eb0dd865431f46515da9f82ccc"
parent = "e90f2b08c4ff711b2d90581b6bcdf0f59af28d98"
commit_url = "https://github.com/strimzi/strimzi-kafka-operator/commit/c8a14935e99c91eb0dd865431f46515da9f82ccc"
vendored = false
host = "github"
path = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java"
mode = "name"
relpath = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-12-02"
fix_lines = { in_function = 26, in_file = 48, source_total = 90 }

[[pair.expected]]
cwe = "CWE-863"
class = "incorrect-authorization"
path = "cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaConnectCluster.java"
function = "generateRoleBindingForRole"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-xrhh-hx36-485q: Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands"

[[pair]]
name = "bagisto-reorder-b2b1cf6"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "bagisto/bagisto"
cve = "CVE-2026-21447 GHSA-x5rw-qvvp-5cgm"
cwe = "CWE-284"
ecosystem = "composer"
published_at = "2026-01-02T22:50:47Z"
post_cutoff = false
commit = "b2b1cf62577245d03a68532478cffbe321df74d3"
parent = "349062ce772d8ac79bc2cd817c43d626efa71907"
commit_url = "https://github.com/bagisto/bagisto/commit/b2b1cf62577245d03a68532478cffbe321df74d3"
vendored = false
host = "github"
path = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php"
mode = "name"
relpath = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-12-23"
fix_lines = { in_function = 6, in_file = 6, source_total = 7 }

[[pair.expected]]
cwe = "CWE-284"
class = "access-control"
path = "packages/Webkul/Shop/src/Http/Controllers/Customer/Account/OrderController.php"
function = "reorder"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-x5rw-qvvp-5cgm: Bagisto has IDOR in Customer Order Reorder Functionality"

[[pair]]
name = "froshplatformadminer-index-c4dd6c3"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "friendsofshopware/froshplatformadminer"
cve = "CVE-2026-25878 GHSA-f339-246p-wwjp"
cwe = "CWE-306"
ecosystem = "composer"
published_at = "2026-02-10T00:22:05Z"
post_cutoff = false
commit = "c4dd6c3462af178b3a7d146d3c651c2c253e902b"
parent = "b1d5b0e41b4bef17171b11f05379cac002b4dc77"
commit_url = "https://github.com/friendsofshopware/froshplatformadminer/commit/c4dd6c3462af178b3a7d146d3c651c2c253e902b"
vendored = false
host = "github"
path = "src/Controller/AdminerController.php"
mode = "name"
relpath = "src/Controller/AdminerController.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-07"
fix_lines = { in_function = 8, in_file = 10, source_total = 11 }

[[pair.expected]]
cwe = "CWE-306"
class = "missing-authentication"
path = "src/Controller/AdminerController.php"
function = "index"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-f339-246p-wwjp: FroshAdminer Adminer UI is accessible without admin session"

[[pair]]
name = "azure-blob-actionloadcontainerdata-cf69db4"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "craftcms/azure-blob"
cve = "CVE-2026-32268 GHSA-q6fm-p73f-x862"
cwe = "CWE-862"
ecosystem = "composer"
published_at = "2026-03-16T18:44:38Z"
post_cutoff = false
commit = "cf69db45f393b3508a32f89ac8235554a2f026ff"
parent = "5f21c2694cb10f791ac5bf2834b122053d856020"
commit_url = "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff"
vendored = false
host = "github"
path = "src/controllers/DefaultController.php"
mode = "name"
relpath = "src/controllers/DefaultController.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-18"
fix_lines = { in_function = 1, in_file = 1, source_total = 1 }

[[pair.expected]]
cwe = "CWE-862"
class = "missing-authorization"
path = "src/controllers/DefaultController.php"
function = "actionLoadContainerData"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-q6fm-p73f-x862: Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability"

[[pair]]
name = "connect-cms-update-7c99517"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "opensource-workshop/connect-cms"
cve = "CVE-2026-32300 GHSA-qr6x-wvxr-8hm9"
cwe = "CWE-285"
ecosystem = "composer"
published_at = "2026-03-23T20:39:10Z"
post_cutoff = false
commit = "7c9951738c62a1d51b91e9956d1eb756c5d52cce"
parent = "c04dc40f814eff891915752ef1ec00ba6612441c"
commit_url = "https://github.com/opensource-workshop/connect-cms/commit/7c9951738c62a1d51b91e9956d1eb756c5d52cce"
vendored = false
host = "github"
path = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php"
mode = "name"
relpath = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-20"
fix_lines = { in_function = 9, in_file = 9, source_total = 16 }

[[pair.expected]]
cwe = "CWE-285"
class = "missing-authorization"
path = "app/Plugins/Mypage/ProfileMypage/ProfileMypage.php"
function = "update"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-qr6x-wvxr-8hm9: Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information"

[[pair]]
name = "parse-server-gethandler-053109b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "parse-community/parse-server"
cve = "CVE-2026-34784 GHSA-hpm8-9qx6-jvwv"
cwe = "CWE-285"
ecosystem = "npm"
published_at = "2026-04-01T23:09:14Z"
post_cutoff = false
commit = "053109b3ee71815bc39ed84116c108ff9edbf337"
parent = "83e794919635ff8b6c86bed8b640222d1c973e03"
commit_url = "https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337"
vendored = false
host = "github"
path = "src/Routers/FilesRouter.js"
mode = "name"
relpath = "src/Routers/FilesRouter.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-30"
fix_lines = { in_function = 14, in_file = 32, source_total = 36 }

[[pair.expected]]
cwe = "CWE-285"
class = "missing-authorization"
path = "src/Routers/FilesRouter.js"
function = "getHandler"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-hpm8-9qx6-jvwv: Parser Server's streaming file download bypasses afterFind file trigger authorization"

[[pair]]
name = "openclaw-resolvecommandauthorization-2aa93d4"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "openclaw/openclaw"
cve = "GHSA-p3pv-c954-9m6f"
cwe = "CWE-863"
ecosystem = "npm"
published_at = "2026-05-11T18:31:46Z"
post_cutoff = false
commit = "2aa93d44a1b2c7058c371f261fda2b5d4de4a882"
parent = "4fdd005b88967a2eca5e20b600b8ffae3ce57b39"
commit_url = "https://github.com/openclaw/openclaw/commit/2aa93d44a1b2c7058c371f261fda2b5d4de4a882"
vendored = false
host = "github"
path = "src/auto-reply/command-auth.ts"
mode = "name"
relpath = "src/auto-reply/command-auth.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-21"
fix_lines = { in_function = 4, in_file = 3, source_total = 4 }

[[pair.expected]]
cwe = "CWE-863"
class = "incorrect-authorization"
path = "src/auto-reply/command-auth.ts"
function = "resolveCommandAuthorization"
mechanism = "missing_auth_guard"
family = "access_control"
evidence = "GHSA-p3pv-c954-9m6f: Duplicate Advisory: OpenClaw: Owner-enforced commands could accept wildcard channel senders as command owners"

[[pair]]
name = "snappy-prepareoutput-1ee6360"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "knplabs/snappy"
cve = "CVE-2023-28115 GHSA-gq6w-q6wh-jggc"
cwe = "CWE-502"
ecosystem = "composer"
published_at = "2023-03-17T18:24:24Z"
post_cutoff = false
commit = "1ee6360cbdbea5d09705909a150df7963a88efd6"
parent = "cef6d3fd349236312e822e99957a0fbbac3f2cba"
commit_url = "https://github.com/knplabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6"
vendored = false
host = "github"
path = "src/Knp/Snappy/AbstractGenerator.php"
mode = "name"
relpath = "src/Knp/Snappy/AbstractGenerator.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-03-17"
fix_lines = { in_function = 3, in_file = 4, source_total = 4 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "src/Knp/Snappy/AbstractGenerator.php"
function = "prepareOutput"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-gq6w-q6wh-jggc: PHAR deserialization allowing remote code execution"

[[pair]]
name = "llama-hub-init-c01416e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "run-llama/llama-hub"
cve = "CVE-2024-23730 GHSA-297x-2qf3-jrj3"
cwe = "CWE-502"
ecosystem = "pip"
published_at = "2024-01-21T18:30:34Z"
post_cutoff = false
commit = "c01416e737c7747a213a79881b8308c41d043515"
parent = "2247b1b14cd2f4f54c7d95e46bada2d51371e786"
commit_url = "https://github.com/run-llama/llama-hub/commit/c01416e737c7747a213a79881b8308c41d043515"
vendored = false
host = "github"
path = "llama_hub/tools/openapi/base.py"
mode = "name"
relpath = "llama_hub/tools/openapi/base.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-01-07"
fix_lines = { in_function = 2, in_file = 1, source_total = 4 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "llama_hub/tools/openapi/base.py"
function = "__init__"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-297x-2qf3-jrj3: Unsafe yaml deserialization in llama-hub"

[[pair]]
name = "ngrinder-read-85efa4a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "naver/ngrinder"
cve = "CVE-2024-28213 GHSA-j7jm-8gf5-frcm"
cwe = "CWE-502"
ecosystem = "maven"
published_at = "2024-03-07T06:30:31Z"
post_cutoff = false
commit = "85efa4a075354e077a700262ef78e2e9119881bf"
parent = "1c6ba7ca5d9d2976cca7829f69c7d2b3e8ab3d51"
commit_url = "https://github.com/naver/ngrinder/commit/85efa4a075354e077a700262ef78e2e9119881bf"
vendored = false
host = "github"
path = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java"
mode = "name"
relpath = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-02-23"
fix_lines = { in_function = 14, in_file = 20, source_total = 29 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "ngrinder-core/src/main/java/net/grinder/communication/Connector.java"
function = "read"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-j7jm-8gf5-frcm: nGrinder vulnerable to unsafe Java objects deserialization"

[[pair]]
name = "qiskit-ibm-runtime-object-hook-b78fca1"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "qiskit/qiskit-ibm-runtime"
cve = "CVE-2024-29032 GHSA-x4x5-jv3x-9c7m"
cwe = "CWE-502"
ecosystem = "pip"
published_at = "2024-03-20T15:44:22Z"
post_cutoff = false
commit = "b78fca114133051805d00043a404b25a33835f4d"
parent = "1cba6967e7af156e9d9f610db7753419138c732a"
commit_url = "https://github.com/qiskit/qiskit-ibm-runtime/commit/b78fca114133051805d00043a404b25a33835f4d"
vendored = false
host = "github"
path = "qiskit_ibm_runtime/utils/json.py"
mode = "name"
relpath = "qiskit_ibm_runtime/utils/json.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-03-18"
fix_lines = { in_function = 4, in_file = 3, source_total = 4 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "qiskit_ibm_runtime/utils/json.py"
function = "object_hook"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-x4x5-jv3x-9c7m: `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code"

[[pair]]
name = "invokeai-torch-load-file-756008d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "invoke-ai/invokeai"
cve = "CVE-2024-12029 GHSA-mcrp-whpw-jp68"
cwe = "CWE-502"
ecosystem = "pip"
published_at = "2025-03-21T15:32:15Z"
post_cutoff = false
commit = "756008dc5899081c5aa51e5bd8f24c1b3975a59e"
parent = "965cd76e338e1959efd0eea3d760846e86c6e1e5"
commit_url = "https://github.com/invoke-ai/invokeai/commit/756008dc5899081c5aa51e5bd8f24c1b3975a59e"
vendored = false
host = "github"
path = "invokeai/app/services/model_load/model_load_default.py"
mode = "name"
relpath = "invokeai/app/services/model_load/model_load_default.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-11-26"
fix_lines = { in_function = 2, in_file = 1, source_total = 8 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "invokeai/app/services/model_load/model_load_default.py"
function = "torch_load_file"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-mcrp-whpw-jp68: InvokeAI Deserialization of Untrusted Data vulnerability"

[[pair]]
name = "jackrabbit-getrepository-7a31909"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/jackrabbit"
cve = "CVE-2025-58782 GHSA-cxvc-g8f2-4gmm"
cwe = "CWE-502"
ecosystem = "maven"
published_at = "2025-09-08T09:31:09Z"
post_cutoff = false
commit = "7a319093c9864111bb86c9895148e580e0f8259a"
parent = "5fb875247f2c859ca72114c0ecd22a70192045a3"
commit_url = "https://github.com/apache/jackrabbit/commit/7a319093c9864111bb86c9895148e580e0f8259a"
vendored = false
host = "github"
path = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java"
mode = "name"
relpath = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-04-08"
fix_lines = { in_function = 35, in_file = 34, source_total = 138 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "jackrabbit-jcr-commons/src/main/java/org/apache/jackrabbit/commons/repository/JNDIRepositoryFactory.java"
function = "getRepository"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-cxvc-g8f2-4gmm: Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data"

[[pair]]
name = "inspiremusic-load-784cbf8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "funaudiollm/inspiremusic"
cve = "CVE-2025-5148 GHSA-pgp9-g5q8-j3wp"
cwe = "CWE-502"
ecosystem = "pip"
published_at = "2025-05-25T12:30:24Z"
post_cutoff = false
commit = "784cbf8dde2cf1456ff808aeba23177e1810e7a9"
parent = "bf32364bcb0d136497ca69f9db622e9216b029dd"
commit_url = "https://github.com/funaudiollm/inspiremusic/commit/784cbf8dde2cf1456ff808aeba23177e1810e7a9"
vendored = false
host = "github"
path = "inspiremusic/cli/model.py"
mode = "name"
relpath = "inspiremusic/cli/model.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-05-09"
fix_lines = { in_function = 4, in_file = 3, source_total = 6 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "inspiremusic/cli/model.py"
function = "load"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-pgp9-g5q8-j3wp: FunAudioLLM InspireMusic deserialization vulnerability"

[[pair]]
name = "datachain-deserialize-914b956"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "iterative/datachain"
cve = "CVE-2025-61677 GHSA-6px8-mr29-cj4r"
cwe = "CWE-502"
ecosystem = "pip"
published_at = "2025-10-02T16:24:46Z"
post_cutoff = false
commit = "914b95610620d50c8d9bee506ccbfa7d4d57fdc0"
parent = "de34d6cb19b3c0a17fff03318d2c6dd53ec960bf"
commit_url = "https://github.com/iterative/datachain/commit/914b95610620d50c8d9bee506ccbfa7d4d57fdc0"
vendored = false
host = "github"
path = "src/datachain/data_storage/serializer.py"
mode = "name"
relpath = "src/datachain/data_storage/serializer.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-10-01"
fix_lines = { in_function = 30, in_file = 106, source_total = 169 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "src/datachain/data_storage/serializer.py"
function = "deserialize"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-6px8-mr29-cj4r: DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables"

[[pair]]
name = "ray-deserialize-with-fallback-c02bd31"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "ray-project/ray"
cve = "CVE-2026-41486 GHSA-mw35-8rx3-xf9r"
cwe = "CWE-502"
ecosystem = "pip"
published_at = "2026-04-24T16:15:00Z"
post_cutoff = false
commit = "c02bd31ae31996805868baa446a131a8d304525f"
parent = "ba6fbf1c8328b56d454ed1b875abe1c197afefd7"
commit_url = "https://github.com/ray-project/ray/commit/c02bd31ae31996805868baa446a131a8d304525f"
vendored = false
host = "github"
path = "python/ray/data/_internal/tensor_extensions/arrow.py"
mode = "name"
relpath = "python/ray/data/_internal/tensor_extensions/arrow.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-27"
fix_lines = { in_function = 20, in_file = 30, source_total = 47 }

[[pair.expected]]
cwe = "CWE-502"
class = "insecure-deserialization"
path = "python/ray/data/_internal/tensor_extensions/arrow.py"
function = "_deserialize_with_fallback"
mechanism = "source_reaches_sink"
family = "deserialization"
evidence = "GHSA-mw35-8rx3-xf9r: Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization"

[[pair]]
name = "yii2-jqgrid-widget-addsearchoptionsrecursively-a117e0f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "himiklab/yii2-jqgrid-widget"
cve = "CVE-2014-125051 GHSA-7mg5-rw39-q67f"
cwe = "CWE-89"
ecosystem = "composer"
published_at = "2023-01-06T18:30:19Z"
post_cutoff = false
commit = "a117e0f2df729e3ff726968794d9a5ac40e660b9"
parent = "55460df283454951c257411d563b2b8118d6b299"
commit_url = "https://github.com/himiklab/yii2-jqgrid-widget/commit/a117e0f2df729e3ff726968794d9a5ac40e660b9"
vendored = false
host = "github"
path = "JqGridAction.php"
mode = "name"
relpath = "JqGridAction.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2014-10-06"
fix_lines = { in_function = 3, in_file = 3, source_total = 3 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "JqGridAction.php"
function = "addSearchOptionsRecursively"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-7mg5-rw39-q67f: himiklab yii2-jqgrid-widget vulnerable to SQL Injection"

[[pair]]
name = "postgraas-server-create-postgres-db-7cd8d01"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "blue-yonder/postgraas_server"
cve = "CVE-2018-25088 GHSA-vghm-8cjp-hjw6"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2023-07-18T15:30:36Z"
post_cutoff = false
commit = "7cd8d016edc74a78af0d81c948bfafbcc93c937c"
parent = "bd4f1b88e7008a3abd4dbe05c26e7b20bbb99649"
commit_url = "https://github.com/blue-yonder/postgraas_server/commit/7cd8d016edc74a78af0d81c948bfafbcc93c937c"
vendored = false
host = "github"
path = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py"
mode = "name"
relpath = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2018-02-01"
fix_lines = { in_function = 26, in_file = 26, source_total = 33 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "postgraas_server/backends/postgres_cluster/postgres_cluster_driver.py"
function = "create_postgres_db"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-vghm-8cjp-hjw6: postgraas-server vulnerable to SQL injection"

[[pair]]
name = "xmlseclibs-processrefnode-6490326"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "robrichards/xmlseclibs"
cve = "GHSA-2g98-f9jv-w8c5"
cwe = "CWE-91"
ecosystem = "composer"
published_at = "2024-05-20T18:06:52Z"
post_cutoff = false
commit = "649032643f7aac493e91ca318da0339aec72aa4a"
parent = "222303db07bef97b948f4882d98294d9facaddb4"
commit_url = "https://github.com/robrichards/xmlseclibs/commit/649032643f7aac493e91ca318da0339aec72aa4a"
vendored = false
host = "github"
path = "src/XMLSecurityDSig.php"
mode = "name"
relpath = "src/XMLSecurityDSig.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2018-02-15"
fix_lines = { in_function = 4, in_file = 3, source_total = 40 }

[[pair.expected]]
cwe = "CWE-91"
class = "xml-injection"
path = "src/XMLSecurityDSig.php"
function = "processRefNode"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-2g98-f9jv-w8c5: robrichards/xmlseclibs XPath injection"

[[pair]]
name = "propel2-applylimit-cd23d73"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "propelorm/propel2"
cve = "GHSA-7vw7-qx38-37vr"
cwe = "CWE-89"
ecosystem = "composer"
published_at = "2024-05-20T17:34:33Z"
post_cutoff = false
commit = "cd23d7384a15cfe203e23b3a835c8ab1d81d9246"
parent = "c64c0d61a36544c8f7cb9073c039715ba9cc343a"
commit_url = "https://github.com/propelorm/propel2/commit/cd23d7384a15cfe203e23b3a835c8ab1d81d9246"
vendored = false
host = "github"
path = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php"
mode = "name"
relpath = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2018-02-16"
fix_lines = { in_function = 2, in_file = 3, source_total = 3 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "src/Propel/Runtime/Adapter/Pdo/MysqlAdapter.php"
function = "applyLimit"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-7vw7-qx38-37vr: Propel2 SQL injection possible with limit() on MySQL"

[[pair]]
name = "propel-applylimit-b720932"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "propelorm/propel"
cve = "GHSA-7g7c-qhf3-x59p"
cwe = "CWE-89"
ecosystem = "composer"
published_at = "2024-05-20T17:36:28Z"
post_cutoff = false
commit = "b72093201f8e225410f62a246653ac039e31c90a"
parent = "3f7a284906ce3e402bcb101938270842fdad71fa"
commit_url = "https://github.com/propelorm/propel/commit/b72093201f8e225410f62a246653ac039e31c90a"
vendored = false
host = "github"
path = "runtime/lib/adapter/DBMySQL.php"
mode = "name"
relpath = "runtime/lib/adapter/DBMySQL.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2019-11-04"
fix_lines = { in_function = 2, in_file = 3, source_total = 10 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "runtime/lib/adapter/DBMySQL.php"
function = "applyLimit"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-7g7c-qhf3-x59p: propel/propel1 SQL injection possible with limit() on MySQL"

[[pair]]
name = "node-gry-exec-5108446"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "ionicabizau/node-gry"
cve = "CVE-2020-36650 GHSA-w5mw-f2hq-5fw8"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2023-01-11T18:30:27Z"
post_cutoff = false
commit = "5108446c1e23960d65e8b973f1d9486f9f9dbd6c"
parent = "e6eea8e6ef0a72e144d3ce3eb883bd5940be0886"
commit_url = "https://github.com/ionicabizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c"
vendored = false
host = "github"
path = "lib/index.js"
mode = "name"
relpath = "lib/index.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2020-04-03"
fix_lines = { in_function = 8, in_file = 17, source_total = 25 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "lib/index.js"
function = "exec"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-w5mw-f2hq-5fw8: gry vulnerable to Command Injection"

[[pair]]
name = "json-logic-js-arrayunique-c1dd82f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "jwadhams/json-logic-js"
cve = "CVE-2021-4329 GHSA-67j4-2mh6-8627"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2023-03-05T21:30:15Z"
post_cutoff = false
commit = "c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227"
parent = "17e9fedcd6864aa94d5ae48eca259a9677d4dfe2"
commit_url = "https://github.com/jwadhams/json-logic-js/commit/c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227"
vendored = false
host = "github"
path = "logic.js"
mode = "name"
relpath = "logic.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2021-03-30"
fix_lines = { in_function = 6, in_file = 6, source_total = 9 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "logic.js"
function = "arrayUnique"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-67j4-2mh6-8627: json-logic-js Command Injection vulnerability"

[[pair]]
name = "yii2-gii-validatemessagecategory-ed61e0d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "yiisoft/yii2-gii"
cve = "CVE-2020-36655 GHSA-3mpg-q26j-83j5"
cwe = "CWE-94"
ecosystem = "composer"
published_at = "2023-01-21T03:30:28Z"
post_cutoff = false
commit = "ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b"
parent = "94f9c6d24c42137ca53f51bb023b19c1fd19bedf"
commit_url = "https://github.com/yiisoft/yii2-gii/commit/ed61e0d85f43e23f79d7c9d1b4e5e5c09a32ce4b"
vendored = false
host = "github"
path = "src/Generator.php"
mode = "name"
relpath = "src/Generator.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2021-05-06"
fix_lines = { in_function = 8, in_file = 6, source_total = 8 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "src/Generator.php"
function = "validateMessageCategory"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-3mpg-q26j-83j5: Command injection in yiisoft/yii2-gii"

[[pair]]
name = "spring-module-core-getschema-d374a5f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "folio-org/spring-module-core"
cve = "CVE-2022-4963 GHSA-4h5h-p23f-hjqf"
cwe = "CWE-89"
ecosystem = "maven"
published_at = "2024-03-21T03:36:44Z"
post_cutoff = false
commit = "d374a5f77e6b58e36f0e0e4419be18b95edcd7ff"
parent = "e93b5ddd3022b81abf8ae81da8d3a740186f456e"
commit_url = "https://github.com/folio-org/spring-module-core/commit/d374a5f77e6b58e36f0e0e4419be18b95edcd7ff"
vendored = false
host = "github"
path = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java"
mode = "name"
relpath = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-11-21"
fix_lines = { in_function = 6, in_file = 8, source_total = 19 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "tenant/src/main/java/org/folio/spring/tenant/service/SchemaService.java"
function = "getSchema"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-4h5h-p23f-hjqf: SQL injection in Folio Spring Module Core"

[[pair]]
name = "window-control-sendkeys-075c854"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "bruno-robert/window-control"
cve = "CVE-2022-25926 GHSA-9mjx-wfqp-j5ph"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2023-01-04T18:30:59Z"
post_cutoff = false
commit = "075c854534a749d887655a906759f5a7eee95173"
parent = "3954822ef3f0307745cdbff21a965278dd0a357b"
commit_url = "https://github.com/bruno-robert/window-control/commit/075c854534a749d887655a906759f5a7eee95173"
vendored = false
host = "github"
path = "index.js"
mode = "name"
relpath = "index.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-01-02"
fix_lines = { in_function = 6, in_file = 10, source_total = 14 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "index.js"
function = "sendKeys"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-9mjx-wfqp-j5ph: window-control vulnerable to Command Injection due to improper input sanitization"

[[pair]]
name = "snowflake-connector-nodejs-convertrawvariant-0c9622a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "snowflakedb/snowflake-connector-nodejs"
cve = "CVE-2023-34232 GHSA-h53w-7qw7-vh5c"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2023-06-09T22:53:51Z"
post_cutoff = false
commit = "0c9622ae12cd7d627df404b73a783b4a5f60728a"
parent = "ca2f5e6e49caeafb1f882ab873c3dbab5dde67dc"
commit_url = "https://github.com/snowflakedb/snowflake-connector-nodejs/commit/0c9622ae12cd7d627df404b73a783b4a5f60728a"
vendored = false
host = "github"
path = "lib/connection/result/column.js"
mode = "name"
relpath = "lib/connection/result/column.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-04-17"
fix_lines = { in_function = 2, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "lib/connection/result/column.js"
function = "convertRawVariant"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-h53w-7qw7-vh5c: Snowflake NodeJS Driver vulnerable to Command Injection"

[[pair]]
name = "node-git-commit-info-gitcommitinfo-f7c491e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "jpeer264/node-git-commit-info"
cve = "CVE-2023-26134 GHSA-h42j-mrmp-9369"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2023-06-28T06:30:22Z"
post_cutoff = false
commit = "f7c491ede51f886a988af9b266797cb24591d18c"
parent = "8b456acbc919e98a9f04b399c1581bbf213d83bd"
commit_url = "https://github.com/jpeer264/node-git-commit-info/commit/f7c491ede51f886a988af9b266797cb24591d18c"
vendored = false
host = "github"
path = "index.ts"
mode = "name"
relpath = "index.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-06-08"
fix_lines = { in_function = 3, in_file = 5, source_total = 5 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "index.ts"
function = "gitCommitInfo"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-h42j-mrmp-9369: git-commit-info vulnerable to Command Injection"

[[pair]]
name = "numexpr-stringtoexpression-4b2d89c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "pydata/numexpr"
cve = "CVE-2023-39631 GHSA-f73w-4m7g-ch9x"
cwe = "CWE-94"
ecosystem = "pip"
published_at = "2023-09-01T18:30:41Z"
post_cutoff = false
commit = "4b2d89cf14e75030d27629925b9998e1e91d23c7"
parent = "74d597398ba3c379c196e469d40f516de110eaa5"
commit_url = "https://github.com/pydata/numexpr/commit/4b2d89cf14e75030d27629925b9998e1e91d23c7"
vendored = false
host = "github"
path = "numexpr/necompiler.py"
mode = "name"
relpath = "numexpr/necompiler.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-07-22"
fix_lines = { in_function = 2, in_file = 22, source_total = 26 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "numexpr/necompiler.py"
function = "stringToExpression"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-f73w-4m7g-ch9x: Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library"

[[pair]]
name = "scancode-io-fetch-docker-image-07ec0de"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "nexb/scancode.io"
cve = "CVE-2023-39523 GHSA-2ggp-cmvm-f62f"
cwe = "CWE-77"
ecosystem = "pip"
published_at = "2023-08-09T14:41:23Z"
post_cutoff = false
commit = "07ec0de1964b14bf085a1c9a27ece2b61ab6105c"
parent = "2f5a6cce23058684633326fc27b0f052a218b64e"
commit_url = "https://github.com/nexb/scancode.io/commit/07ec0de1964b14bf085a1c9a27ece2b61ab6105c"
vendored = false
host = "github"
path = "scanpipe/pipes/fetch.py"
mode = "name"
relpath = "scanpipe/pipes/fetch.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-08-07"
fix_lines = { in_function = 3, in_file = 6, source_total = 8 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "scanpipe/pipes/fetch.py"
function = "fetch_docker_image"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-2ggp-cmvm-f62f: ScanCode.io command injection in docker image fetch process"

[[pair]]
name = "dcnnt-py-main-b4021d7"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "cyanomiko/dcnnt-py"
cve = "CVE-2023-1000 GHSA-8p42-7597-p2f6"
cwe = "CWE-77"
ecosystem = "pip"
published_at = "2024-04-27T09:30:33Z"
post_cutoff = false
commit = "b4021d784a97e25151a5353aa763a741e9a148f5"
parent = "4084ea18f96d9a953315f5555fca45f26639b8be"
commit_url = "https://github.com/cyanomiko/dcnnt-py/commit/b4021d784a97e25151a5353aa763a741e9a148f5"
vendored = false
host = "github"
path = "dcnnt/plugins/notifications.py"
mode = "name"
relpath = "dcnnt/plugins/notifications.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-08-14"
fix_lines = { in_function = 2, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "dcnnt/plugins/notifications.py"
function = "main"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-8p42-7597-p2f6: dcnnt-py is vulnerable to command injection via Notification Handler"

[[pair]]
name = "find-exec-isexec-74fb108"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "shime/find-exec"
cve = "CVE-2023-40582 GHSA-95rp-6gqp-6622"
cwe = "CWE-78"
ecosystem = "npm"
published_at = "2023-08-30T20:08:58Z"
post_cutoff = false
commit = "74fb108097c229b03d6dba4cce81e36aa364b51c"
parent = "934ae934713bcb7bb9d6264030672d0c974cb541"
commit_url = "https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c"
vendored = false
host = "github"
path = "index.js"
mode = "name"
relpath = "index.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-08-24"
fix_lines = { in_function = 2, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "index.js"
function = "isExec"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-95rp-6gqp-6622: Command Injection Vulnerability in find-exec"

[[pair]]
name = "blamer-git-0965877"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "kucherenko/blamer"
cve = "CVE-2023-26143 GHSA-6f9p-g466-f8v8"
cwe = "CWE-88"
ecosystem = "npm"
published_at = "2023-09-19T06:30:17Z"
post_cutoff = false
commit = "0965877f115753371a2570f10a63c455d2b2cde3"
parent = "530d2152bb96a6ac240f47f78d9dccd2e84487b9"
commit_url = "https://github.com/kucherenko/blamer/commit/0965877f115753371a2570f10a63c455d2b2cde3"
vendored = false
host = "github"
path = "src/vcs/git.ts"
mode = "name"
relpath = "src/vcs/git.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-09-17"
fix_lines = { in_function = 3, in_file = 6, source_total = 6 }

[[pair.expected]]
cwe = "CWE-88"
class = "argument-injection"
path = "src/vcs/git.ts"
function = "git"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-6f9p-g466-f8v8:  blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API"

[[pair]]
name = "php-heic-to-jpg-convert-852bc21"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "maestroerror/php-heic-to-jpg"
cve = "CVE-2024-48514 GHSA-g8v9-c8m3-942v"
cwe = "CWE-94"
ecosystem = "composer"
published_at = "2024-10-24T18:30:44Z"
post_cutoff = false
commit = "852bc210d302884e2635ba60b1b460b53afe5463"
parent = "5cfd76452915aad37666ecba7b67087aab9268cf"
commit_url = "https://github.com/maestroerror/php-heic-to-jpg/commit/852bc210d302884e2635ba60b1b460b53afe5463"
vendored = false
host = "github"
path = "src/HeicToJpg.php"
mode = "name"
relpath = "src/HeicToJpg.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-02-09"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "src/HeicToJpg.php"
function = "convert"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-g8v9-c8m3-942v: Remote code execution in php-heic-to-jpg"

[[pair]]
name = "pyansys-geometry-start-program-f82346b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "ansys/pyansys-geometry"
cve = "CVE-2024-29189 GHSA-38jr-29fh-w9vm"
cwe = "CWE-78"
ecosystem = "pip"
published_at = "2024-03-25T19:37:46Z"
post_cutoff = false
commit = "f82346b9432b06532e84f3278125f5879b4e9f3f"
parent = "138ae18f810b3e556f90ca12164fc68bc76f063c"
commit_url = "https://github.com/ansys/pyansys-geometry/commit/f82346b9432b06532e84f3278125f5879b4e9f3f"
vendored = false
host = "github"
path = "src/ansys/geometry/core/connection/product_instance.py"
mode = "name"
relpath = "src/ansys/geometry/core/connection/product_instance.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-03-21"
fix_lines = { in_function = 1, in_file = 4, source_total = 4 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "src/ansys/geometry/core/connection/product_instance.py"
function = "_start_program"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-38jr-29fh-w9vm: ansys-geometry-core OS Command Injection vulnerability"

[[pair]]
name = "sagemaker-python-sdk-capture-dependencies-2d873d5"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "aws/sagemaker-python-sdk"
cve = "CVE-2024-34073 GHSA-7pc3-pr3q-58vg"
cwe = "CWE-78"
ecosystem = "pip"
published_at = "2024-05-03T20:26:03Z"
post_cutoff = false
commit = "2d873d53f708ea570fc2e2a6974f8c3097fe9df5"
parent = "d27836eab1575d90db676ab2667b4816eaf45af0"
commit_url = "https://github.com/aws/sagemaker-python-sdk/commit/2d873d53f708ea570fc2e2a6974f8c3097fe9df5"
vendored = false
host = "github"
path = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py"
mode = "name"
relpath = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-04-02"
fix_lines = { in_function = 6, in_file = 4, source_total = 7 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "src/sagemaker/serve/save_retrive/version_1_0_0/save/utils.py"
function = "capture_dependencies"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-7pc3-pr3q-58vg: sagemaker-python-sdk Command Injection vulnerability"

[[pair]]
name = "node-mysql2-readcodefor-7d4b098"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "sidorares/node-mysql2"
cve = "CVE-2024-21511 GHSA-4rch-2fh8-94vw"
cwe = "CWE-94"
ecosystem = "npm"
published_at = "2024-04-23T06:30:47Z"
post_cutoff = false
commit = "7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713"
parent = "2efd6ab397a1af0ae2b198c6761473ccfbcd8da5"
commit_url = "https://github.com/sidorares/node-mysql2/commit/7d4b098c7e29d5a6cb9eac2633bfcc2f0f1db713"
vendored = false
host = "github"
path = "lib/parsers/binary_parser.js"
mode = "name"
relpath = "lib/parsers/binary_parser.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-04-21"
fix_lines = { in_function = 4, in_file = 2, source_total = 8 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "lib/parsers/binary_parser.js"
function = "readCodeFor"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-4rch-2fh8-94vw: MySQL2 for Node Arbitrary Code Injection"

[[pair]]
name = "pymysql-escape-dict-521e400"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "pymysql/pymysql"
cve = "CVE-2024-36039 GHSA-v9hf-5j83-6xpp"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2024-05-21T18:31:23Z"
post_cutoff = false
commit = "521e40050cb386a499f68f483fefd144c493053c"
parent = "7f032a699d55340f05101deb4d7d4f63db4adc11"
commit_url = "https://github.com/pymysql/pymysql/commit/521e40050cb386a499f68f483fefd144c493053c"
vendored = false
host = "github"
path = "pymysql/converters.py"
mode = "name"
relpath = "pymysql/converters.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-05-21"
fix_lines = { in_function = 6, in_file = 5, source_total = 6 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "pymysql/converters.py"
function = "escape_dict"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-v9hf-5j83-6xpp: PyMySQL SQL Injection vulnerability"

[[pair]]
name = "mindsdb-dispatch-update-11a4db7"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "mindsdb/mindsdb"
cve = "CVE-2024-45851 GHSA-wf9g-c67g-h4ch"
cwe = "CWE-94"
ecosystem = "pip"
published_at = "2024-09-12T15:33:01Z"
post_cutoff = false
commit = "11a4db792ad36cf704f7307c7602128b17752c80"
parent = "ff120b08f45a4b15a313f7723ea0f2d8aa4be87c"
commit_url = "https://github.com/mindsdb/mindsdb/commit/11a4db792ad36cf704f7307c7602128b17752c80"
vendored = false
host = "github"
path = "mindsdb/integrations/libs/vectordatabase_handler.py"
mode = "name"
relpath = "mindsdb/integrations/libs/vectordatabase_handler.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-07-24"
fix_lines = { in_function = 2, in_file = 1, source_total = 17 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "mindsdb/integrations/libs/vectordatabase_handler.py"
function = "_dispatch_update"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-wf9g-c67g-h4ch: MindsDB Eval Injection vulnerability"

[[pair]]
name = "haystack-validate-template-6c25a5c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "deepset-ai/haystack"
cve = "CVE-2024-41950 GHSA-hx9v-6r9f-w677"
cwe = "CWE-1336"
ecosystem = "pip"
published_at = "2024-07-31T18:50:41Z"
post_cutoff = false
commit = "6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e"
parent = "c077f4cc79a009d72a59399478f9cc78202c8ef5"
commit_url = "https://github.com/deepset-ai/haystack/commit/6c25a5c73e83aa32c3241ba84a5cbb3ac0e8a89e"
vendored = false
host = "github"
path = "haystack/components/builders/dynamic_chat_prompt_builder.py"
mode = "name"
relpath = "haystack/components/builders/dynamic_chat_prompt_builder.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-07-26"
fix_lines = { in_function = 6, in_file = 5, source_total = 18 }

[[pair.expected]]
cwe = "CWE-1336"
class = "template-injection"
path = "haystack/components/builders/dynamic_chat_prompt_builder.py"
function = "_validate_template"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-hx9v-6r9f-w677: Insecure Jinja2 templates rendered in Haystack Components can lead to RCE"

[[pair]]
name = "fides-render-829cbd9"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "ethyca/fides"
cve = "CVE-2024-45053 GHSA-c34r-238x-f7qx"
cwe = "CWE-94"
ecosystem = "pip"
published_at = "2024-09-04T18:07:17Z"
post_cutoff = false
commit = "829cbd9cb5ef9c814fbac1ed6800e8d939d359c5"
parent = "e9174b771155abc0ff3faf1fb7b8b76836788617"
commit_url = "https://github.com/ethyca/fides/commit/829cbd9cb5ef9c814fbac1ed6800e8d939d359c5"
vendored = false
host = "github"
path = "src/fides/api/service/messaging/message_dispatch_service.py"
mode = "name"
relpath = "src/fides/api/service/messaging/message_dispatch_service.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-09-03"
fix_lines = { in_function = 6, in_file = 6, source_total = 64 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "src/fides/api/service/messaging/message_dispatch_service.py"
function = "_render"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-c34r-238x-f7qx: Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine"

[[pair]]
name = "torchgeo-get-weight-1a98078"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "torchgeo/torchgeo"
cve = "CVE-2024-49048 GHSA-ghq9-vc6f-8qjf"
cwe = "CWE-94"
ecosystem = "pip"
published_at = "2026-04-01T00:03:56Z"
post_cutoff = false
commit = "1a980788cb7089a1115f3b786c7daa9dd47d7d7a"
parent = "da691c4568b0ab98ea74bb736081622fb98d23c9"
commit_url = "https://github.com/torchgeo/torchgeo/commit/1a980788cb7089a1115f3b786c7daa9dd47d7d7a"
vendored = false
host = "github"
path = "torchgeo/models/api.py"
mode = "name"
relpath = "torchgeo/models/api.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-09-28"
fix_lines = { in_function = 9, in_file = 11, source_total = 13 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "torchgeo/models/api.py"
function = "get_weight"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-ghq9-vc6f-8qjf: TorchGeo Remote Code Execution Vulnerability"

[[pair]]
name = "plotai-run-bdcfb13"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "mljar/plotai"
cve = "CVE-2025-1497 GHSA-2hmp-5wqg-f24h"
cwe = "CWE-77"
ecosystem = "pip"
published_at = "2025-03-10T15:30:47Z"
post_cutoff = false
commit = "bdcfb13484f0b85703a4c1ddfd71cb21840e7fde"
parent = "7a95b06812af120141c84f6bc28551ac5586f9b9"
commit_url = "https://github.com/mljar/plotai/commit/bdcfb13484f0b85703a4c1ddfd71cb21840e7fde"
vendored = false
host = "github"
path = "plotai/code/executor.py"
mode = "name"
relpath = "plotai/code/executor.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-02-14"
fix_lines = { in_function = 1, in_file = 6, source_total = 7 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "plotai/code/executor.py"
function = "run"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-2hmp-5wqg-f24h: PlotAI eval vulnerability"

[[pair]]
name = "matrix-appservice-irc-settopic-74f02c8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "matrix-org/matrix-appservice-irc"
cve = "CVE-2025-27146 GHSA-5mvm-89c9-9gm5"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2025-02-25T18:29:34Z"
post_cutoff = false
commit = "74f02c8e11f16ed1b355700092c1aa9c036a11bd"
parent = "062f3ace8b08e86e9f63c004ffdb85942af1b94e"
commit_url = "https://github.com/matrix-org/matrix-appservice-irc/commit/74f02c8e11f16ed1b355700092c1aa9c036a11bd"
vendored = false
host = "github"
path = "src/irc/BridgedClient.ts"
mode = "name"
relpath = "src/irc/BridgedClient.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-02-25"
fix_lines = { in_function = 5, in_file = 6, source_total = 8 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "src/irc/BridgedClient.ts"
function = "setTopic"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-5mvm-89c9-9gm5: Matrix IRC Bridge allows IRC command injection to own puppeted user"

[[pair]]
name = "conductor-initengine-e981650"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "conductor-oss/conductor"
cve = "CVE-2025-26074 GHSA-8gqp-hr9g-pg62"
cwe = "CWE-78"
ecosystem = "maven"
published_at = "2025-06-30T18:31:50Z"
post_cutoff = false
commit = "e9816501df1e364a3d39d7fe37d6e167c40eaa1b"
parent = "5976cad67bab4204e3ec4b2edd6f6831623c7c9a"
commit_url = "https://github.com/conductor-oss/conductor/commit/e9816501df1e364a3d39d7fe37d6e167c40eaa1b"
vendored = false
host = "github"
path = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java"
mode = "name"
relpath = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-04-01"
fix_lines = { in_function = 6, in_file = 5, source_total = 26 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java"
function = "initEngine"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-8gqp-hr9g-pg62: Conductor vulnerable to OS command injection through unrestricted access to Java classes"

[[pair]]
name = "amplify-codegen-ui-buildbindingexpression-ca98c38"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "aws-amplify/amplify-codegen-ui"
cve = "CVE-2025-4318 GHSA-hf3j-86p7-mfw8"
cwe = "CWE-95"
ecosystem = "npm"
published_at = "2026-07-30T20:57:24Z"
post_cutoff = true
commit = "ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6"
parent = "bbc3435e592aaf9a96ad231d5468784d8e95f4c9"
commit_url = "https://github.com/aws-amplify/amplify-codegen-ui/commit/ca98c38b7c3d69ae7c94d2f62b51e32e8165dae6"
vendored = false
host = "github"
path = "packages/codegen-ui-react/lib/react-component-render-helper.ts"
mode = "name"
relpath = "packages/codegen-ui-react/lib/react-component-render-helper.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-04-10"
fix_lines = { in_function = 19, in_file = 103, source_total = 157 }

[[pair.expected]]
cwe = "CWE-95"
class = "code-injection"
path = "packages/codegen-ui-react/lib/react-component-render-helper.ts"
function = "buildBindingExpression"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-hf3j-86p7-mfw8: AWS Amplify Studio UI Component Properties Has an Input Validation Issue"

[[pair]]
name = "jeecgboot-ispass-ddf0f61"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "jeecgboot/jeecgboot"
cve = "CVE-2025-51825 GHSA-gj8w-ffq9-6828"
cwe = "CWE-89"
ecosystem = "maven"
published_at = "2025-08-22T15:33:05Z"
post_cutoff = false
commit = "ddf0f61ae59d217b59884921a98a0bc69b143f41"
parent = "4042579167ed2760b43fabc0fc03dc4e9b9ce767"
commit_url = "https://github.com/jeecgboot/jeecgboot/commit/ddf0f61ae59d217b59884921a98a0bc69b143f41"
vendored = false
host = "github"
path = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java"
mode = "name"
relpath = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-05-27"
fix_lines = { in_function = 10, in_file = 24, source_total = 72 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "jeecg-boot/jeecg-boot-base-core/src/main/java/org/jeecg/common/util/security/AbstractQueryBlackListHandler.java"
function = "isPass"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-gj8w-ffq9-6828: JeecgBoot SQL Injection Vulnerability"

[[pair]]
name = "larecipe-replacelinks-c1d0d56"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "saleem-hadad/larecipe"
cve = "CVE-2025-53833 GHSA-jv7x-xhv2-p5v2"
cwe = "CWE-1336"
ecosystem = "composer"
published_at = "2025-07-14T21:22:01Z"
post_cutoff = false
commit = "c1d0d56889655ce5f2645db5acf0e78d5fc3b36b"
parent = "a5bd62b9ee2c9e15dee97a5cb7026736c8467269"
commit_url = "https://github.com/saleem-hadad/larecipe/commit/c1d0d56889655ce5f2645db5acf0e78d5fc3b36b"
vendored = false
host = "github"
path = "src/Models/Documentation.php"
mode = "name"
relpath = "src/Models/Documentation.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-07-14"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-1336"
class = "template-injection"
path = "src/Models/Documentation.php"
function = "replaceLinks"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-jv7x-xhv2-p5v2: LaRecipe is vulnerable to Server-Side Template Injection attacks"

[[pair]]
name = "sequa-mcp-redirecttoauthorization-e569815"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "sequa-ai/sequa-mcp"
cve = "CVE-2025-10619 GHSA-9pw5-wx67-q964"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2025-09-17T21:30:43Z"
post_cutoff = false
commit = "e569815854166db5f71c2e722408f8957fb9e804"
parent = "aa343a5013d274c88eca48be703531ea8d621195"
commit_url = "https://github.com/sequa-ai/sequa-mcp/commit/e569815854166db5f71c2e722408f8957fb9e804"
vendored = false
host = "github"
path = "src/helpers/node-oauth-client-provider.ts"
mode = "name"
relpath = "src/helpers/node-oauth-client-provider.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-09-09"
fix_lines = { in_function = 6, in_file = 7, source_total = 8 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "src/helpers/node-oauth-client-provider.ts"
function = "redirectToAuthorization"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-9pw5-wx67-q964: @sequa-ai/sequa-mcp has Command Injection vulnerability"

[[pair]]
name = "flink-cdc-tableexists-d576618"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/flink-cdc"
cve = "CVE-2025-62228 GHSA-wqm3-w3p6-xjgm"
cwe = "CWE-89"
ecosystem = "maven"
published_at = "2025-10-09T15:31:03Z"
post_cutoff = false
commit = "d5766187a9a4b191820e10238d4594ae665cdb89"
parent = "85a79aae2676d571fa952377055edcfafabd973e"
commit_url = "https://github.com/apache/flink-cdc/commit/d5766187a9a4b191820e10238d4594ae665cdb89"
vendored = false
host = "github"
path = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java"
mode = "name"
relpath = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-09-18"
fix_lines = { in_function = 21, in_file = 51, source_total = 77 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "flink-cdc-connect/flink-cdc-pipeline-connectors/flink-cdc-pipeline-connector-oceanbase/src/main/java/org/apache/flink/cdc/connectors/oceanbase/catalog/OceanBaseMySQLCatalog.java"
function = "tableExists"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-wqm3-w3p6-xjgm: Apache Flink CDC is vulnerable to SQL Injection through maliciously crafted identifiers"

[[pair]]
name = "hive-deletetablecolumnstatistics-c18d0df"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/hive"
cve = "CVE-2025-62728 GHSA-932v-x9x2-vq29"
cwe = "CWE-89"
ecosystem = "maven"
published_at = "2025-11-26T09:31:22Z"
post_cutoff = false
commit = "c18d0df2702130cf5d0f050e516eb8999aa56301"
parent = "770e70c98360ac0b029db46675e0dc5cd0e9040c"
commit_url = "https://github.com/apache/hive/commit/c18d0df2702130cf5d0f050e516eb8999aa56301"
vendored = false
host = "github"
path = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java"
mode = "name"
relpath = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-11-03"
fix_lines = { in_function = 17, in_file = 32, source_total = 44 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/MetaStoreDirectSql.java"
function = "deleteTableColumnStatistics"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-932v-x9x2-vq29: Hive Metastore Server is vulnerable to SQL Injection"

[[pair]]
name = "mcp-server-kubernetes-execinpod-d091107"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "flux159/mcp-server-kubernetes"
cve = "CVE-2025-66404 GHSA-wvxp-jp4w-w8wg"
cwe = "CWE-77"
ecosystem = "npm"
published_at = "2025-12-03T20:44:45Z"
post_cutoff = false
commit = "d091107ff92d9ffad1b3c295092f142d6578c48b"
parent = "0ab947f41c81a6a553f1c2acd733321d7a35f129"
commit_url = "https://github.com/flux159/mcp-server-kubernetes/commit/d091107ff92d9ffad1b3c295092f142d6578c48b"
vendored = false
host = "github"
path = "src/tools/exec_in_pod.ts"
mode = "name"
relpath = "src/tools/exec_in_pod.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-11-30"
fix_lines = { in_function = 30, in_file = 48, source_total = 65 }

[[pair.expected]]
cwe = "CWE-77"
class = "command-injection"
path = "src/tools/exec_in_pod.ts"
function = "execInPod"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-wvxp-jp4w-w8wg: mcp-server-kubernetes has potential security issue in exec_in_pod tool"

[[pair]]
name = "mcp-watch-clonerepo-e7da78c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "kapilduraphe/mcp-watch"
cve = "CVE-2025-66401 GHSA-27m7-ffhq-jqrm"
cwe = "CWE-78"
ecosystem = "npm"
published_at = "2025-12-02T00:38:14Z"
post_cutoff = false
commit = "e7da78c5b4b960f8b66c254059ad9ebc544a91a6"
parent = "0fca7228bd313ae5aa938d61311377e88ce6e682"
commit_url = "https://github.com/kapilduraphe/mcp-watch/commit/e7da78c5b4b960f8b66c254059ad9ebc544a91a6"
vendored = false
host = "github"
path = "src/scanner/McpScanner.ts"
mode = "name"
relpath = "src/scanner/McpScanner.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-11-30"
fix_lines = { in_function = 8, in_file = 9, source_total = 11 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "src/scanner/McpScanner.ts"
function = "cloneRepo"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-27m7-ffhq-jqrm: MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL"

[[pair]]
name = "elysia-get-26935bf"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "elysiajs/elysia"
cve = "CVE-2025-66457 GHSA-8vch-m3f4-q8jf"
cwe = "CWE-94"
ecosystem = "npm"
published_at = "2025-12-09T17:12:05Z"
post_cutoff = false
commit = "26935bf76ebc43b4a43d48b173fc853de43bb51e"
parent = "94f8528e0e093028868877e215f79f5ca21c519b"
commit_url = "https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e"
vendored = false
host = "github"
path = "src/compose.ts"
mode = "name"
relpath = "src/compose.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-12-01"
fix_lines = { in_function = 20, in_file = 20, source_total = 36 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "src/compose.ts"
function = "get"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-8vch-m3f4-q8jf: Elysia affected by arbitrary code injection through cookie config"

[[pair]]
name = "parsl-workflow-resources-013a928"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "parsl/parsl"
cve = "CVE-2026-21892 GHSA-f2mf-q878-gh58"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2026-01-06T18:04:21Z"
post_cutoff = false
commit = "013a928461e70f38a33258bd525a351ed828e974"
parent = "2c37ae3e75137095302dac5f9cd3ca956cb51a47"
commit_url = "https://github.com/parsl/parsl/commit/013a928461e70f38a33258bd525a351ed828e974"
vendored = false
host = "github"
path = "parsl/monitoring/visualization/views.py"
mode = "name"
relpath = "parsl/monitoring/visualization/views.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-05"
fix_lines = { in_function = 8, in_file = 8, source_total = 14 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "parsl/monitoring/visualization/views.py"
function = "workflow_resources"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-f2mf-q878-gh58: Parsl Monitoring Visualization Vulnerable to SQL Injection"

[[pair]]
name = "workers-sdk-handler-99b1f32"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "cloudflare/workers-sdk"
cve = "CVE-2026-0933 GHSA-36p8-mvp6-cv38"
cwe = "CWE-78"
ecosystem = "npm"
published_at = "2026-01-21T23:00:35Z"
post_cutoff = false
commit = "99b1f328a9afe181b49f1114ed47f15f6d25f0be"
parent = "e98c95aa22938f5ab6c3c1befe91350b9dc2ba0c"
commit_url = "https://github.com/cloudflare/workers-sdk/commit/99b1f328a9afe181b49f1114ed47f15f6d25f0be"
vendored = false
host = "github"
path = "packages/wrangler/src/pages/deploy.ts"
mode = "name"
relpath = "packages/wrangler/src/pages/deploy.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-01-13"
fix_lines = { in_function = 7, in_file = 7, source_total = 9 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "packages/wrangler/src/pages/deploy.ts"
function = "handler"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-36p8-mvp6-cv38: Wrangler affected by OS Command Injection in `wrangler pages deploy`"

[[pair]]
name = "django-add-filtered-relation-005d60d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "django/django"
cve = "CVE-2026-1312 GHSA-6426-9fv3-65x8"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2026-02-03T15:30:24Z"
post_cutoff = false
commit = "005d60d97c4dfb117503bdb6f2facfcaf9315d84"
parent = "69065ca869b0970dff8fdd8fafb390bf8b3bf222"
commit_url = "https://github.com/django/django/commit/005d60d97c4dfb117503bdb6f2facfcaf9315d84"
vendored = false
host = "github"
path = "django/db/models/sql/query.py"
mode = "name"
relpath = "django/db/models/sql/query.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-03"
fix_lines = { in_function = 5, in_file = 5, source_total = 5 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "django/db/models/sql/query.py"
function = "add_filtered_relation"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-6426-9fv3-65x8: Django has an SQL Injection issue"

[[pair]]
name = "webhooks-init-8834499"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "craftcms/webhooks"
cve = "CVE-2026-32261 GHSA-8wg7-wm29-2rvg"
cwe = "CWE-1336"
ecosystem = "composer"
published_at = "2026-03-16T18:11:23Z"
post_cutoff = false
commit = "88344991a68b07145567c46dfd0ae3328c521f62"
parent = "d7904f55b8e53286b620cf7257e8a39d120a61ad"
commit_url = "https://github.com/craftcms/webhooks/commit/88344991a68b07145567c46dfd0ae3328c521f62"
vendored = false
host = "github"
path = "src/Plugin.php"
mode = "name"
relpath = "src/Plugin.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-13"
fix_lines = { in_function = 8, in_file = 4, source_total = 8 }

[[pair.expected]]
cwe = "CWE-1336"
class = "template-injection"
path = "src/Plugin.php"
function = "init"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-8wg7-wm29-2rvg: RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin"

[[pair]]
name = "git-js-preventuploadpack-1effd8e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "steveukx/git-js"
cve = "CVE-2026-28291 GHSA-jcxm-m3jx-f287"
cwe = "CWE-78"
ecosystem = "npm"
published_at = "2026-04-13T16:35:37Z"
post_cutoff = false
commit = "1effd8e5012a5da05a9776512fac3e39b11f2d2d"
parent = "1402490d14f4125b08f3b2d6c86d3baa0feae6fb"
commit_url = "https://github.com/steveukx/git-js/commit/1effd8e5012a5da05a9776512fac3e39b11f2d2d"
vendored = false
host = "github"
path = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts"
mode = "name"
relpath = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-21"
fix_lines = { in_function = 2, in_file = 7, source_total = 8 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "simple-git/src/lib/plugins/block-unsafe-operations-plugin.ts"
function = "preventUploadPack"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-jcxm-m3jx-f287: simple-git Affected by Command Execution via Option-Parsing Bypass"

[[pair]]
name = "ormar-query-aggr-function-a03bae1"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "collerek/ormar"
cve = "CVE-2026-26198 GHSA-xxh2-68g9-8jqr"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2026-02-23T22:12:17Z"
post_cutoff = false
commit = "a03bae14fe01358d3eaf7e319fcd5db2e4956b16"
parent = "ef95d3214daf9ccfd5591ae51d8b2fbe4b66c633"
commit_url = "https://github.com/collerek/ormar/commit/a03bae14fe01358d3eaf7e319fcd5db2e4956b16"
vendored = false
host = "github"
path = "ormar/queryset/queryset.py"
mode = "name"
relpath = "ormar/queryset/queryset.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-22"
fix_lines = { in_function = 7, in_file = 6, source_total = 7 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "ormar/queryset/queryset.py"
function = "_query_aggr_function"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-xxh2-68g9-8jqr: ormar is vulnerable to SQL Injection through aggregate functions min() and max()"

[[pair]]
name = "intake-expand-defaults-d0c0b6b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "BSD-2-Clause"
repo = "intake/intake"
cve = "CVE-2026-33310 GHSA-37g4-qqqv-7m99"
cwe = "CWE-78"
ecosystem = "pip"
published_at = "2026-03-19T17:46:54Z"
post_cutoff = false
commit = "d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b"
parent = "67e0303735a60cf0f261e34c68139d0d3aa48c87"
commit_url = "https://github.com/intake/intake/commit/d0c0b6b57c1cb3f73880655ded4a9b0e18e1fd1b"
vendored = false
host = "github"
path = "intake/catalog/utils.py"
mode = "name"
relpath = "intake/catalog/utils.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-09"
fix_lines = { in_function = 4, in_file = 8, source_total = 21 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "intake/catalog/utils.py"
function = "expand_defaults"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-37g4-qqqv-7m99: Intake has a Command Injection via shell() Expansion in Parameter Defaults"

[[pair]]
name = "openhands-get-git-diff-698cfc2"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "openhands/openhands"
cve = "CVE-2026-33718 GHSA-7h8w-hj9j-8rjw"
cwe = "CWE-78"
ecosystem = "pip"
published_at = "2026-03-25T21:54:55Z"
post_cutoff = false
commit = "698cfc2520cdc50eac5fa869c6c1ba5c8fee9e13"
parent = "83561701939fe70577e74c4aeb5acd2f7f8f7da3"
commit_url = "https://github.com/openhands/openhands/commit/698cfc2520cdc50eac5fa869c6c1ba5c8fee9e13"
vendored = false
host = "github"
path = "openhands/runtime/utils/git_diff.py"
mode = "name"
relpath = "openhands/runtime/utils/git_diff.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-09"
fix_lines = { in_function = 18, in_file = 17, source_total = 35 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "openhands/runtime/utils/git_diff.py"
function = "get_git_diff"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-7h8w-hj9j-8rjw: OpenHands is Vulnerable to Command Injection through its Git Diff Handler"

[[pair]]
name = "scitokens-getkeyinfo-3dba108"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "scitokens/scitokens"
cve = "CVE-2026-32714 GHSA-rh5m-2482-966c"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2026-03-31T22:49:15Z"
post_cutoff = false
commit = "3dba108853f2f4a6c0f2325c03779bf083c41cf2"
parent = "66b075c35da18f8364276553513a53c596b4b8e3"
commit_url = "https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2"
vendored = false
host = "github"
path = "src/scitokens/utils/keycache.py"
mode = "name"
relpath = "src/scitokens/utils/keycache.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-13"
fix_lines = { in_function = 12, in_file = 18, source_total = 31 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "src/scitokens/utils/keycache.py"
function = "getkeyinfo"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-rh5m-2482-966c: SciTokens is vulnerable to SQL Injection in KeyCache"

[[pair]]
name = "langchain-get-template-variables-6bab0ba"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "langchain-ai/langchain"
cve = "CVE-2026-40087 GHSA-926x-3r5x-gfhw"
cwe = "CWE-1336"
ecosystem = "pip"
published_at = "2026-04-08T21:51:32Z"
post_cutoff = false
commit = "6bab0ba3c12328008ddca3e0d54ff5a6151cd27b"
parent = "4fe869f1c336e1df9fe3a6bd37f39a4d354a8608"
commit_url = "https://github.com/langchain-ai/langchain/commit/6bab0ba3c12328008ddca3e0d54ff5a6151cd27b"
vendored = false
host = "github"
path = "libs/core/langchain_core/prompts/string.py"
mode = "name"
relpath = "libs/core/langchain_core/prompts/string.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-08"
fix_lines = { in_function = 23, in_file = 71, source_total = 95 }

[[pair.expected]]
cwe = "CWE-1336"
class = "template-injection"
path = "libs/core/langchain_core/prompts/string.py"
function = "get_template_variables"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-926x-3r5x-gfhw: LangChain has incomplete f-string validation in prompt templates"

[[pair]]
name = "math-codegen-interpreter-4bb52d3"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "mauriciopoppe/math-codegen"
cve = "CVE-2026-41507 GHSA-p6x5-p4xf-cc4r"
cwe = "CWE-94"
ecosystem = "npm"
published_at = "2026-04-17T22:31:45Z"
post_cutoff = false
commit = "4bb52d3030683362b3559ee8dd91350555a05f6b"
parent = "abfc95c214245b06f3ceb2583393b003d1cd13eb"
commit_url = "https://github.com/mauriciopoppe/math-codegen/commit/4bb52d3030683362b3559ee8dd91350555a05f6b"
vendored = false
host = "github"
path = "lib/Interpreter.js"
mode = "name"
relpath = "lib/Interpreter.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-09"
fix_lines = { in_function = 4, in_file = 5, source_total = 16 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "lib/Interpreter.js"
function = "Interpreter"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-p6x5-p4xf-cc4r: Remote Code Execution (RCE) via String Literal Injection into math-codegen"

[[pair]]
name = "amazon-redshift-python-driver-vector-in-69a69df"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "aws/amazon-redshift-python-driver"
cve = "CVE-2026-8838 GHSA-29h4-r29x-hchv"
cwe = "CWE-94"
ecosystem = "pip"
published_at = "2026-05-29T19:32:28Z"
post_cutoff = false
commit = "69a69dfdead75918e20384da52bcd760ded8dbca"
parent = "2c1dd5b9aca1945a1b8e01b2359075d9e8b0e77c"
commit_url = "https://github.com/aws/amazon-redshift-python-driver/commit/69a69dfdead75918e20384da52bcd760ded8dbca"
vendored = false
host = "github"
path = "redshift_connector/utils/type_utils.py"
mode = "name"
relpath = "redshift_connector/utils/type_utils.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-05-18"
fix_lines = { in_function = 5, in_file = 24, source_total = 25 }

[[pair.expected]]
cwe = "CWE-94"
class = "code-injection"
path = "redshift_connector/utils/type_utils.py"
function = "vector_in"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-29h4-r29x-hchv: amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection"

[[pair]]
name = "yt-dlp-prepare-outtmpl-5faffa9"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Unlicense"
repo = "yt-dlp/yt-dlp"
cve = "GHSA-69qj-pvh9-c5wg"
cwe = "CWE-78"
ecosystem = "pip"
published_at = "2026-06-16T22:29:14Z"
post_cutoff = true
commit = "5faffa999fd33b373d47773e8ee639d072accec2"
parent = "7aac95eae663be82cffeaf2a8c1193a5e349e401"
commit_url = "https://github.com/yt-dlp/yt-dlp/commit/5faffa999fd33b373d47773e8ee639d072accec2"
vendored = false
host = "github"
path = "yt_dlp/YoutubeDL.py"
mode = "name"
relpath = "yt_dlp/YoutubeDL.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-06"
fix_lines = { in_function = 10, in_file = 22, source_total = 53 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "yt_dlp/YoutubeDL.py"
function = "prepare_outtmpl"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-69qj-pvh9-c5wg: yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp"

[[pair]]
name = "wsgidav-exists-record-by-primary-key-6f35776"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "mar10/wsgidav"
cve = "CVE-2026-55509 GHSA-p6gw-4frg-j7jw"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2026-08-28T18:12:17Z"
post_cutoff = true
commit = "6f35776c9188f130ab044ce557015d51aaa83500"
parent = "67abdbd7d622fcf29aefdfbd0c9910de9e0c8b3d"
commit_url = "https://github.com/mar10/wsgidav/commit/6f35776c9188f130ab044ce557015d51aaa83500"
vendored = false
host = "github"
path = "wsgidav/samples/mysql_dav_provider.py"
mode = "name"
relpath = "wsgidav/samples/mysql_dav_provider.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-27"
fix_lines = { in_function = 40, in_file = 112, source_total = 140 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "wsgidav/samples/mysql_dav_provider.py"
function = "_exists_record_by_primary_key"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-p6gw-4frg-j7jw: WsgiDAV MySQL provider has a blind SQL injection"

[[pair]]
name = "dynatrace-mcp-generatedqlsearchentitycommand-15d3546"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "dynatrace-oss/dynatrace-mcp"
cve = "GHSA-pqh8-p93p-2rx7"
cwe = "CWE-943"
ecosystem = "npm"
published_at = "2026-07-31T15:56:12Z"
post_cutoff = true
commit = "15d3546c0618ffbaeaeca477337e08e92f2151bc"
parent = "35db4695ce24f19d5326edee5a86e9ba39e13f69"
commit_url = "https://github.com/dynatrace-oss/dynatrace-mcp/commit/15d3546c0618ffbaeaeca477337e08e92f2151bc"
vendored = false
host = "github"
path = "src/capabilities/find-monitored-entity-by-name.ts"
mode = "name"
relpath = "src/capabilities/find-monitored-entity-by-name.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-07-14"
fix_lines = { in_function = 3, in_file = 6, source_total = 82 }

[[pair.expected]]
cwe = "CWE-943"
class = "query-injection"
path = "src/capabilities/find-monitored-entity-by-name.ts"
function = "generateDqlSearchEntityCommand"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-pqh8-p93p-2rx7: @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL"

[[pair]]
name = "agno-delete-by-metadata-6780513"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "agno-agi/agno"
cve = "CVE-2026-10105 GHSA-82m5-3pcp-hccq"
cwe = "CWE-89"
ecosystem = "pip"
published_at = "2026-05-29T18:31:34Z"
post_cutoff = false
commit = "678051366f14fe21de347b58a400bd707d5bebea"
parent = "f2fdceeb735f68bf750aae9b4bc4de9ebde7e0fa"
commit_url = "https://github.com/agno-agi/agno/commit/678051366f14fe21de347b58a400bd707d5bebea"
vendored = false
host = "github"
path = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py"
mode = "name"
relpath = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-07-27"
fix_lines = { in_function = 20, in_file = 21, source_total = 26 }

[[pair.expected]]
cwe = "CWE-89"
class = "sqli"
path = "libs/agno/agno/vectordb/clickhouse/clickhousedb.py"
function = "delete_by_metadata"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-82m5-3pcp-hccq: agno contains a SQL injection vulnerability"

[[pair]]
name = "virtualenv-quote-d721ff1"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "pypa/virtualenv"
cve = "CVE-2026-102937 GHSA-x78j-v8h9-3j2q"
cwe = "CWE-78"
ecosystem = "pip"
published_at = "2026-10-01T15:08:29Z"
post_cutoff = true
commit = "d721ff140ce4afdc2a9b76751e4584e25d9fbea6"
parent = "087a2ef8bd3aa15b562a3558b1068f603e50f77a"
commit_url = "https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6"
vendored = false
host = "github"
path = "src/virtualenv/activation/batch/__init__.py"
mode = "name"
relpath = "src/virtualenv/activation/batch/__init__.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-09-18"
fix_lines = { in_function = 10, in_file = 63, source_total = 127 }

[[pair.expected]]
cwe = "CWE-78"
class = "command-injection"
path = "src/virtualenv/activation/batch/__init__.py"
function = "quote"
mechanism = "source_reaches_sink"
family = "injection"
evidence = "GHSA-x78j-v8h9-3j2q: virtualenv: Command injection via --prompt in activate.bat (batch activator)"

[[pair]]
name = "zend-form-createattributesstring-6fe4031"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "zendframework/zend-form"
cve = "GHSA-gvpp-6jrj-5pqc"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2024-06-07T21:58:34Z"
post_cutoff = false
commit = "6fe40314e8e3477494aadd03d62573bd1c212bd1"
parent = "6afef49dae54bf68330825f6f6f3463a7bb992e9"
commit_url = "https://github.com/zendframework/zend-form/commit/6fe40314e8e3477494aadd03d62573bd1c212bd1"
vendored = false
host = "github"
path = "src/View/Helper/AbstractHelper.php"
mode = "name"
relpath = "src/View/Helper/AbstractHelper.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2014-04-15"
fix_lines = { in_function = 7, in_file = 8, source_total = 10 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/View/Helper/AbstractHelper.php"
function = "createAttributesString"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-gvpp-6jrj-5pqc: Zend-Form vulnerable to Cross-site Scripting"

[[pair]]
name = "zendframework-htmlattribs-1dd4f8c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "zendframework/zendframework"
cve = "GHSA-8q77-cv62-jj38"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2024-06-07T20:04:04Z"
post_cutoff = false
commit = "1dd4f8cede07469390eef1e629f808349fa1b5ea"
parent = "692a9d1f8f0d6b30bfd848241febd9d5e180d93a"
commit_url = "https://github.com/zendframework/zendframework/commit/1dd4f8cede07469390eef1e629f808349fa1b5ea"
vendored = false
host = "github"
path = "library/Zend/View/Helper/AbstractHtmlElement.php"
mode = "name"
relpath = "library/Zend/View/Helper/AbstractHtmlElement.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2014-04-15"
fix_lines = { in_function = 8, in_file = 11, source_total = 36 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "library/Zend/View/Helper/AbstractHtmlElement.php"
function = "htmlAttribs"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-8q77-cv62-jj38: Zendframework has potential Cross-site Scripting vector in multiple view helpers"

[[pair]]
name = "scnsocialauth-invoke-4a00966"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "socalnick/scnsocialauth"
cve = "GHSA-g6f5-4w43-2x63"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2024-05-29T13:04:32Z"
post_cutoff = false
commit = "4a00966c41bc37251586d007564c5c891eba3700"
parent = "d255c32fe80c30bf936164736e6e7c1bf72773cf"
commit_url = "https://github.com/socalnick/scnsocialauth/commit/4a00966c41bc37251586d007564c5c891eba3700"
vendored = false
host = "github"
path = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php"
mode = "name"
relpath = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2015-01-16"
fix_lines = { in_function = 17, in_file = 15, source_total = 20 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/ScnSocialAuth/View/Helper/SocialSignInButton.php"
function = "__invoke"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-g6f5-4w43-2x63: ScnSocialAuth Cross-site Scripting vulnerability in login redirect param"

[[pair]]
name = "ldapcherry-check-auth-6f98076"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "kakwa/ldapcherry"
cve = "CVE-2019-25095 GHSA-vq8w-x8v7-f88m"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2023-01-05T09:30:28Z"
post_cutoff = false
commit = "6f98076281e9452fdb1adcd1bcbb70a6f968ade9"
parent = "1ed654c91bf2caeedbad34944bf837b6c21a2292"
commit_url = "https://github.com/kakwa/ldapcherry/commit/6f98076281e9452fdb1adcd1bcbb70a6f968ade9"
vendored = false
host = "github"
path = "ldapcherry/__init__.py"
mode = "name"
relpath = "ldapcherry/__init__.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2019-01-02"
fix_lines = { in_function = 10, in_file = 12, source_total = 23 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "ldapcherry/__init__.py"
function = "_check_auth"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-vq8w-x8v7-f88m: LdapCherry Cross-site Scripting vulnerbaility"

[[pair]]
name = "framework-attributestostring-ae4d790"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "laravel/framework"
cve = "GHSA-vr95-p7q6-8m9q"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2024-05-15T22:16:06Z"
post_cutoff = false
commit = "ae4d790e99f3b743bc49984d37c9ca70adc62cd7"
parent = "bd67cc22af6fbc1f5745b0e3ce79e0a12b092048"
commit_url = "https://github.com/laravel/framework/commit/ae4d790e99f3b743bc49984d37c9ca70adc62cd7"
vendored = false
host = "github"
path = "src/Illuminate/View/Compilers/ComponentTagCompiler.php"
mode = "name"
relpath = "src/Illuminate/View/Compilers/ComponentTagCompiler.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2020-03-13"
fix_lines = { in_function = 6, in_file = 21, source_total = 40 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/Illuminate/View/Compilers/ComponentTagCompiler.php"
function = "attributesToString"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-vr95-p7q6-8m9q: Laravel Cross-site Scripting (XSS) vulnerability in blade templating"

[[pair]]
name = "vditor-fixfirefoxarrowuptable-1b2382d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "vanessa219/vditor"
cve = "CVE-2021-32855 GHSA-vfmp-9999-6wqj"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2023-02-21T15:30:23Z"
post_cutoff = false
commit = "1b2382d7f8a4ee509d9245db4450d926a0b24146"
parent = "30891f9bac9d0c3571fd16c58065a14c7f0bc90c"
commit_url = "https://github.com/vanessa219/vditor/commit/1b2382d7f8a4ee509d9245db4450d926a0b24146"
vendored = false
host = "github"
path = "src/ts/util/fixBrowserBehavior.ts"
mode = "name"
relpath = "src/ts/util/fixBrowserBehavior.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2021-09-21"
fix_lines = { in_function = 1, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/ts/util/fixBrowserBehavior.ts"
function = "fixFirefoxArrowUpTable"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-vfmp-9999-6wqj: Vditor Cross-site Scripting vulnerability"

[[pair]]
name = "jquery-minicolors-init-ef13482"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "claviska/jquery-minicolors"
cve = "CVE-2021-32850 GHSA-crh5-vv2v-c82q"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2023-02-21T00:30:20Z"
post_cutoff = false
commit = "ef134824a7f4110ada53ea6c173111a4fa2f48f3"
parent = "707b80383c192250772386e7f590abc0835cd510"
commit_url = "https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3"
vendored = false
host = "github"
path = "jquery.minicolors.js"
mode = "name"
relpath = "jquery.minicolors.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2021-11-24"
fix_lines = { in_function = 3, in_file = 2, source_total = 5 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "jquery.minicolors.js"
function = "init"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-crh5-vv2v-c82q: @claviska/jquery-minicolors vulnerable to Cross-site Scripting"

[[pair]]
name = "mind-elixir-core-creatediv-0734852"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "ssshooter/mind-elixir-core"
cve = "CVE-2021-32851 GHSA-m22q-97p5-79v2"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2023-02-21T00:30:20Z"
post_cutoff = false
commit = "073485269ac83af24371f35bd08507defa885655"
parent = "6d5c5c66d583d9b486b03c4b56e026c6fdd1d69b"
commit_url = "https://github.com/ssshooter/mind-elixir-core/commit/073485269ac83af24371f35bd08507defa885655"
vendored = false
host = "github"
path = "src/plugin/nodeMenu.ts"
mode = "name"
relpath = "src/plugin/nodeMenu.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2021-11-25"
fix_lines = { in_function = 15, in_file = 11, source_total = 42 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/plugin/nodeMenu.ts"
function = "createDiv"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-m22q-97p5-79v2: Mind-elixir Cross-site Scripting vulnerability"

[[pair]]
name = "eslint-detailed-reporter-renderissue-505c190"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "mportuga/eslint-detailed-reporter"
cve = "CVE-2022-4942 GHSA-4xr4-89m5-46c7"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2023-04-20T06:30:17Z"
post_cutoff = false
commit = "505c190efd4905990db6207863bdcbd9b1d7e1bd"
parent = "f19967fb85454b3ded7e89cd27b0826a40f45283"
commit_url = "https://github.com/mportuga/eslint-detailed-reporter/commit/505c190efd4905990db6207863bdcbd9b1d7e1bd"
vendored = false
host = "github"
path = "lib/template-generator.js"
mode = "name"
relpath = "lib/template-generator.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2022-06-02"
fix_lines = { in_function = 2, in_file = 12, source_total = 15 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "lib/template-generator.js"
function = "renderIssue"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-4xr4-89m5-46c7: eslint-detailed-reporter vulnerable to cross-site scripting"

[[pair]]
name = "sanitize-url-decodehtmlcharacters-d4bdc89"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "braintree/sanitize-url"
cve = "CVE-2022-48345 GHSA-q8gg-vj6m-hgmj"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2023-02-24T06:30:16Z"
post_cutoff = false
commit = "d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c"
parent = "b70161daebd9523590fc6feda017d0489a8f6002"
commit_url = "https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c"
vendored = false
host = "github"
path = "src/index.ts"
mode = "name"
relpath = "src/index.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-10-20"
fix_lines = { in_function = 1, in_file = 3, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/index.ts"
function = "decodeHtmlCharacters"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-q8gg-vj6m-hgmj: @braintree/sanitize-url Cross-site Scripting vulnerability"

[[pair]]
name = "modoboa-identities-eef9ab7"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "ISC"
repo = "modoboa/modoboa"
cve = "CVE-2023-0519 GHSA-jm3m-wr3p-hjrq"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2023-01-27T00:30:18Z"
post_cutoff = false
commit = "eef9ab72b5305578a3ad7a7463bd284aa645e98b"
parent = "718ee4370701c715a62edab3b206ed1b469f73d4"
commit_url = "https://github.com/modoboa/modoboa/commit/eef9ab72b5305578a3ad7a7463bd284aa645e98b"
vendored = false
host = "github"
path = "modoboa/admin/static/admin/js/admin.js"
mode = "name"
relpath = "modoboa/admin/static/admin/js/admin.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-01-26"
fix_lines = { in_function = 2, in_file = 1, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "modoboa/admin/static/admin/js/admin.js"
function = "Identities"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-jm3m-wr3p-hjrq: Cross-site Scripting in modoboa"

[[pair]]
name = "jquery-validation-delegate-7a490d8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "jquery-validation/jquery-validation"
cve = "CVE-2025-3573 GHSA-rrj2-ph5q-jxw2"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2025-04-15T06:30:34Z"
post_cutoff = false
commit = "7a490d8f39bd988027568ddcf51755e1f4688902"
parent = "cfe74a19b671b0983b3b13dbf959619cfe926de9"
commit_url = "https://github.com/jquery-validation/jquery-validation/commit/7a490d8f39bd988027568ddcf51755e1f4688902"
vendored = false
host = "github"
path = "src/core.js"
mode = "name"
relpath = "src/core.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-02-01"
fix_lines = { in_function = 14, in_file = 12, source_total = 15 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/core.js"
function = "delegate"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-rrj2-ph5q-jxw2: jquery-validation vulnerable to Cross-site Scripting"

[[pair]]
name = "archiva-checkparamchars-d62e81c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/archiva"
cve = "CVE-2023-28158 GHSA-qf34-f43r-gv9p"
cwe = "CWE-79"
ecosystem = "maven"
published_at = "2023-03-29T15:30:17Z"
post_cutoff = false
commit = "d62e81c7e75f617cf01d2a75952a2c857758f8c4"
parent = "4d93c1f457e3a285e84a46f25fceee1c0d2bd615"
commit_url = "https://github.com/apache/archiva/commit/d62e81c7e75f617cf01d2a75952a2c857758f8c4"
vendored = false
host = "github"
path = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java"
mode = "name"
relpath = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-03-14"
fix_lines = { in_function = 10, in_file = 19, source_total = 29 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java"
function = "checkParamChars"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-qf34-f43r-gv9p: Apache Archiva vulnerable to privilege escalation via stored cross-site scripting (XSS)"

[[pair]]
name = "silverstripe-form-capture-details-5b3aa39"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "bigfork/silverstripe-form-capture"
cve = "CVE-2023-28851 GHSA-38h6-gmr2-j4wx"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2023-04-03T21:06:31Z"
post_cutoff = false
commit = "5b3aa39dd1eef042f173167b0fa4d3f717971772"
parent = "9da789e26e38cac8f09d20fca7b36f7b3678a28c"
commit_url = "https://github.com/bigfork/silverstripe-form-capture/commit/5b3aa39dd1eef042f173167b0fa4d3f717971772"
vendored = false
host = "github"
path = "src/Model/CapturedFormSubmission.php"
mode = "name"
relpath = "src/Model/CapturedFormSubmission.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-03-31"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/Model/CapturedFormSubmission.php"
function = "Details"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-38h6-gmr2-j4wx: Silverstripe Form Capture vulnerable to stored cross-site-scripting"

[[pair]]
name = "whatsapp-chat-exporter-create-html-bfdc68c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "knugihk/whatsapp-chat-exporter"
cve = "GHSA-8c6x-g4fw-8rf4"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2023-07-10T21:54:36Z"
post_cutoff = false
commit = "bfdc68cd6ad53ceecf132773f9aaba50dd80fe79"
parent = "594a04adbcfbf7b4e6185348fd77cb7ae77f4452"
commit_url = "https://github.com/knugihk/whatsapp-chat-exporter/commit/bfdc68cd6ad53ceecf132773f9aaba50dd80fe79"
vendored = false
host = "github"
path = "Whatsapp_Chat_Exporter/extract.py"
mode = "name"
relpath = "Whatsapp_Chat_Exporter/extract.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-06-15"
fix_lines = { in_function = 2, in_file = 1, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "Whatsapp_Chat_Exporter/extract.py"
function = "create_html"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-8c6x-g4fw-8rf4: Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats."

[[pair]]
name = "ckeditor-wordcount-plugin-strip-0f03b3e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "w8tcha/ckeditor-wordcount-plugin"
cve = "CVE-2023-37905 GHSA-q9w4-w667-qqj4"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2023-07-10T21:54:03Z"
post_cutoff = false
commit = "0f03b3e5b7c1409998a13aba3a95396e6fa349d8"
parent = "d5a876dcb3093539f1b0a3270b640cf93fe78cf0"
commit_url = "https://github.com/w8tcha/ckeditor-wordcount-plugin/commit/0f03b3e5b7c1409998a13aba3a95396e6fa349d8"
vendored = false
host = "github"
path = "wordcount/plugin.js"
mode = "name"
relpath = "wordcount/plugin.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-07-08"
fix_lines = { in_function = 5, in_file = 5, source_total = 8 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "wordcount/plugin.js"
function = "strip"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-q9w4-w667-qqj4: ckeditor-wordcount-plugin vulnerable to Cross-site Scripting in Source Mode of Editor"

[[pair]]
name = "critters-createdocument-7757902"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "googlechromelabs/critters"
cve = "CVE-2023-3481 GHSA-cx3j-qqxj-9597"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2023-08-11T18:57:53Z"
post_cutoff = false
commit = "7757902c9e0b3285d516359b3cb602cd9d50d80e"
parent = "c663a2431a9956d7f7c2be2554f4c0d82f32999a"
commit_url = "https://github.com/googlechromelabs/critters/commit/7757902c9e0b3285d516359b3cb602cd9d50d80e"
vendored = false
host = "github"
path = "packages/critters/src/dom.js"
mode = "name"
relpath = "packages/critters/src/dom.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-08-04"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/critters/src/dom.js"
function = "createDocument"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-cx3j-qqxj-9597: Critters Cross-site Scripting Vulnerability"

[[pair]]
name = "mjml-python-parse-84c495d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "felixschwarz/mjml-python"
cve = "CVE-2024-26151 GHSA-578p-fxmm-6229"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2024-02-22T21:40:59Z"
post_cutoff = false
commit = "84c495da20a91640a1ca551ace17df7f3be644aa"
parent = "3308bbae0d36b048f89eb5057d2c2a6a87e868da"
commit_url = "https://github.com/felixschwarz/mjml-python/commit/84c495da20a91640a1ca551ace17df7f3be644aa"
vendored = false
host = "github"
path = "mjml/mjml2html.py"
mode = "name"
relpath = "mjml/mjml2html.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-11-17"
fix_lines = { in_function = 2, in_file = 3, source_total = 5 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "mjml/mjml2html.py"
function = "parse"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-578p-fxmm-6229: Potentially untrusted input is rendered as HTML in final output"

[[pair]]
name = "apollo-client-nextjs-transportdatatojs-b92bc42"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "apollographql/apollo-client-nextjs"
cve = "CVE-2024-23841 GHSA-rv8p-rr2h-fgpg"
cwe = "CWE-80"
ecosystem = "npm"
published_at = "2024-01-30T20:57:45Z"
post_cutoff = false
commit = "b92bc42abd5f8e17d4db361c36bd08e4f541a46b"
parent = "4271a8c1d06ba089b5de4da59ff8258f7528ede3"
commit_url = "https://github.com/apollographql/apollo-client-nextjs/commit/b92bc42abd5f8e17d4db361c36bd08e4f541a46b"
vendored = false
host = "github"
path = "package/src/ssr/dataTransport.ts"
mode = "name"
relpath = "package/src/ssr/dataTransport.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-01-30"
fix_lines = { in_function = 4, in_file = 3, source_total = 29 }

[[pair.expected]]
cwe = "CWE-80"
class = "xss"
path = "package/src/ssr/dataTransport.ts"
function = "transportDataToJS"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-rv8p-rr2h-fgpg: @apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability"

[[pair]]
name = "urql-transportdatatojs-4b7011b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "urql-graphql/urql"
cve = "CVE-2024-24556 GHSA-qhjf-hm5j-335w"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2024-01-30T20:57:28Z"
post_cutoff = false
commit = "4b7011b70d5718728ff912d02a4dbdc7f703540d"
parent = "b4c46f2dd8eb43186ac21861a5ce6df958463479"
commit_url = "https://github.com/urql-graphql/urql/commit/4b7011b70d5718728ff912d02a4dbdc7f703540d"
vendored = false
host = "github"
path = "packages/next-urql/src/DataHydrationContext.ts"
mode = "name"
relpath = "packages/next-urql/src/DataHydrationContext.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-01-30"
fix_lines = { in_function = 2, in_file = 2, source_total = 27 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/next-urql/src/DataHydrationContext.ts"
function = "transportDataToJS"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-qhjf-hm5j-335w: @urql/next Cross-site Scripting vulnerability"

[[pair]]
name = "dependency-check-plugin-transform-b3b286a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "jenkinsci/dependency-check-plugin"
cve = "CVE-2024-28153 GHSA-9pp4-mx6x-xh36"
cwe = "CWE-79"
ecosystem = "maven"
published_at = "2024-03-06T18:30:38Z"
post_cutoff = false
commit = "b3b286a9615603f0294eb740193d153d843fae3a"
parent = "20f4e50e9576b8a08d6b71782334a31c961d684b"
commit_url = "https://github.com/jenkinsci/dependency-check-plugin/commit/b3b286a9615603f0294eb740193d153d843fae3a"
vendored = false
host = "github"
path = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java"
mode = "name"
relpath = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-02-05"
fix_lines = { in_function = 32, in_file = 65, source_total = 86 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/main/java/org/jenkinsci/plugins/DependencyCheck/transformer/FindingsTransformer.java"
function = "transform"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-9pp4-mx6x-xh36: Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability"

[[pair]]
name = "send-sendstream-ae4f298"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "pillarjs/send"
cve = "CVE-2024-43799 GHSA-m6fv-jmcg-4jfg"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2024-09-10T19:42:41Z"
post_cutoff = false
commit = "ae4f2989491b392ae2ef3b0015a019770ae65d35"
parent = "b69cbb3dc4c09c37917d08a4c13fcd1bac97ade5"
commit_url = "https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35"
vendored = false
host = "github"
path = "index.js"
mode = "name"
relpath = "index.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-09-10"
fix_lines = { in_function = 3, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "index.js"
function = "SendStream"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-m6fv-jmcg-4jfg: send vulnerable to template injection that can lead to XSS"

[[pair]]
name = "serve-static-createredirectdirectorylistener-0c11fad"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "expressjs/serve-static"
cve = "CVE-2024-43800 GHSA-cm22-4g7w-348p"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2024-09-10T19:42:33Z"
post_cutoff = false
commit = "0c11fad159898cdc69fd9ab63269b72468ecaf6b"
parent = "9b5a12a76f4d70530d2d2a8c7742e9158ed3c0a4"
commit_url = "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b"
vendored = false
host = "github"
path = "index.js"
mode = "name"
relpath = "index.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-09-10"
fix_lines = { in_function = 3, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "index.js"
function = "createRedirectDirectoryListener"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-cm22-4g7w-348p: serve-static vulnerable to template injection that can lead to XSS"

[[pair]]
name = "layui-getpath-f756b41"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "layui/layui"
cve = "CVE-2024-47075 GHSA-j827-6rgf-9629"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2024-09-26T17:54:24Z"
post_cutoff = false
commit = "f756b41d63bf3d488a2cb042918638c9851bf2b0"
parent = "5e707cec12b4a52dfb2057b662e8bf4edd3693f3"
commit_url = "https://github.com/layui/layui/commit/f756b41d63bf3d488a2cb042918638c9851bf2b0"
vendored = false
host = "github"
path = "src/layui.js"
mode = "name"
relpath = "src/layui.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-09-23"
fix_lines = { in_function = 4, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/layui.js"
function = "getPath"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-j827-6rgf-9629: Layui has DOM Clobbering gadgets that leads to Cross-site Scripting"

[[pair]]
name = "vue-i18n-ismessageast-72f0d32"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "intlify/vue-i18n"
cve = "CVE-2024-52809 GHSA-9r9m-ffp6-9x4v"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2024-12-02T17:26:20Z"
post_cutoff = false
commit = "72f0d323006fc7363b18cab62d4522dadd874411"
parent = "554cc24818179588f77a6d92071ad91b24fd46a3"
commit_url = "https://github.com/intlify/vue-i18n/commit/72f0d323006fc7363b18cab62d4522dadd874411"
vendored = false
host = "github"
path = "packages/core-base/src/compilation.ts"
mode = "name"
relpath = "packages/core-base/src/compilation.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-11-28"
fix_lines = { in_function = 9, in_file = 17, source_total = 201 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/core-base/src/compilation.ts"
function = "isMessageAST"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-9r9m-ffp6-9x4v: vue-i18n has cross-site scripting vulnerability with prototype pollution"

[[pair]]
name = "simplexlsx-readthemecolors-71a5e3d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "shuchkin/simplexlsx"
cve = "CVE-2024-56364 GHSA-r87q-fj25-f8jf"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2024-12-23T18:18:54Z"
post_cutoff = false
commit = "71a5e3d40d14e33161f8a40b3fd02de542218ef0"
parent = "0044a4c917037f7613bcd81c7766339a35b9832a"
commit_url = "https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0"
vendored = false
host = "github"
path = "src/SimpleXLSXEx.php"
mode = "name"
relpath = "src/SimpleXLSXEx.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-12-21"
fix_lines = { in_function = 8, in_file = 5, source_total = 10 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/SimpleXLSXEx.php"
function = "readThemeColors"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-r87q-fj25-f8jf: Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx"

[[pair]]
name = "dom-expressions-replace-521f75d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "ryansolid/dom-expressions"
cve = "CVE-2025-27108 GHSA-hw62-58pr-7wc5"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2025-02-25T17:49:57Z"
post_cutoff = false
commit = "521f75dfa89ed24161646e7007d9d7d21da07767"
parent = "828f9e9cef5e0482d904ae4f6ec1069dba378a44"
commit_url = "https://github.com/ryansolid/dom-expressions/commit/521f75dfa89ed24161646e7007d9d7d21da07767"
vendored = false
host = "github"
path = "packages/dom-expressions/src/server.js"
mode = "name"
relpath = "packages/dom-expressions/src/server.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-01-07"
fix_lines = { in_function = 5, in_file = 8, source_total = 11 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/dom-expressions/src/server.js"
function = "replace"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-hw62-58pr-7wc5: DOM Expressions has a Cross-Site Scripting (XSS) vulnerability due to improper use of string.replace"

[[pair]]
name = "jte-javascriptblock-a6fb00d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "casid/jte"
cve = "CVE-2025-23026 GHSA-vh22-6c6h-rm8q"
cwe = "CWE-79"
ecosystem = "maven"
published_at = "2025-01-13T16:57:59Z"
post_cutoff = false
commit = "a6fb00d53c7b8dbb86de933215dbe1b9191a57f1"
parent = "0c7d4ad7a135d169b2db85062d827279e6d86aaf"
commit_url = "https://github.com/casid/jte/commit/a6fb00d53c7b8dbb86de933215dbe1b9191a57f1"
vendored = false
host = "github"
path = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java"
mode = "name"
relpath = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-01-13"
fix_lines = { in_function = 2, in_file = 4, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "jte-runtime/src/main/java/gg/jte/html/escape/Escape.java"
function = "javaScriptBlock"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-vh22-6c6h-rm8q: jte's HTML templates containing Javascript template strings are subject to XSS"

[[pair]]
name = "felix-dev-rendercontent-87513ea"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/felix-dev"
cve = "CVE-2025-25247 GHSA-4c37-7m5h-c8m9"
cwe = "CWE-79"
ecosystem = "maven"
published_at = "2025-02-10T12:30:45Z"
post_cutoff = false
commit = "87513ea3533fdb79d9e2b251410bf2bfbd63941e"
parent = "c9df37190eddd3a8af4262956436880a3acb8c90"
commit_url = "https://github.com/apache/felix-dev/commit/87513ea3533fdb79d9e2b251410bf2bfbd63941e"
vendored = false
host = "github"
path = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java"
mode = "name"
relpath = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-02-02"
fix_lines = { in_function = 2, in_file = 3, source_total = 6 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "webconsole/src/main/java/org/apache/felix/webconsole/internal/core/ServicesServlet.java"
function = "renderContent"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-4c37-7m5h-c8m9: Apache Felix Webconsole: XSS in services console"

[[pair]]
name = "label-studio-upload-example-using-config-8cf6958"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "humansignal/label-studio"
cve = "CVE-2025-25296 GHSA-wpq5-3366-mqw4"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2025-02-14T15:23:03Z"
post_cutoff = false
commit = "8cf6958e1e27ef6a03ed287e674470975d340885"
parent = "54f454e3abfe919b3016f369582da6aff1440aea"
commit_url = "https://github.com/humansignal/label-studio/commit/8cf6958e1e27ef6a03ed287e674470975d340885"
vendored = false
host = "github"
path = "label_studio/projects/views.py"
mode = "name"
relpath = "label_studio/projects/views.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-02-04"
fix_lines = { in_function = 4, in_file = 4, source_total = 6 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "label_studio/projects/views.py"
function = "upload_example_using_config"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-wpq5-3366-mqw4: Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint"

[[pair]]
name = "vega-replace-694560c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "vega/vega"
cve = "CVE-2025-27793 GHSA-963h-3v39-3pqf"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2025-03-27T18:00:24Z"
post_cutoff = false
commit = "694560c0aa576df8b6c5f0f7d202ac82233e6966"
parent = "560aeecbbe99edb3022071fbe8c756d04f2e57bc"
commit_url = "https://github.com/vega/vega/commit/694560c0aa576df8b6c5f0f7d202ac82233e6966"
vendored = false
host = "github"
path = "packages/vega-functions/src/functions/sequence.js"
mode = "name"
relpath = "packages/vega-functions/src/functions/sequence.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-02-14"
fix_lines = { in_function = 1, in_file = 3, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/vega-functions/src/functions/sequence.js"
function = "replace"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-963h-3v39-3pqf: Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]"

[[pair]]
name = "htmlsanitizer-makesanitizedcopy-af6d2a7"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "jitbit/htmlsanitizer"
cve = "CVE-2025-29771 GHSA-vhv4-fh94-jm5x"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2025-03-14T19:54:52Z"
post_cutoff = false
commit = "af6d2a78877e7277cd01c825b7fb50edb5956963"
parent = "79975a1defa648f40625100cf68462d74d6d5ec7"
commit_url = "https://github.com/jitbit/htmlsanitizer/commit/af6d2a78877e7277cd01c825b7fb50edb5956963"
vendored = false
host = "github"
path = "HtmlSanitizer.js"
mode = "name"
relpath = "HtmlSanitizer.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-03-12"
fix_lines = { in_function = 1, in_file = 1, source_total = 1 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "HtmlSanitizer.js"
function = "makeSanitizedCopy"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-vhv4-fh94-jm5x: JS Html Sanitizer allows XSS when used with contentEditable"

[[pair]]
name = "jsondiffpatch-typeformatttererrorformatter-0e374b5"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "benjamine/jsondiffpatch"
cve = "CVE-2025-9910 GHSA-33vc-wfww-vjfv"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2025-09-11T06:30:23Z"
post_cutoff = false
commit = "0e374b5dd8d7879b329a9fc18affbd46ad50dd14"
parent = "3cb442637b156eaab4a7f3c9f342c0b9168030aa"
commit_url = "https://github.com/benjamine/jsondiffpatch/commit/0e374b5dd8d7879b329a9fc18affbd46ad50dd14"
vendored = false
host = "github"
path = "packages/jsondiffpatch/src/formatters/html.ts"
mode = "name"
relpath = "packages/jsondiffpatch/src/formatters/html.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-03-24"
fix_lines = { in_function = 11, in_file = 15, source_total = 21 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/jsondiffpatch/src/formatters/html.ts"
function = "typeFormattterErrorFormatter"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-33vc-wfww-vjfv: jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin"

[[pair]]
name = "django-tomselect-prepare-results-0990ed3"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "omenapps/django-tomselect"
cve = "GHSA-785h-76cm-cpmf"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2025-03-26T20:34:02Z"
post_cutoff = false
commit = "0990ed36c8874f9d42fa9deff7734bf8dcd46d40"
parent = "d9859b2e7c10a9af29a9f4fe676b6967cd6ca1a3"
commit_url = "https://github.com/omenapps/django-tomselect/commit/0990ed36c8874f9d42fa9deff7734bf8dcd46d40"
vendored = false
host = "github"
path = "src/django_tomselect/autocompletes.py"
mode = "name"
relpath = "src/django_tomselect/autocompletes.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-03-26"
fix_lines = { in_function = 7, in_file = 12, source_total = 157 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/django_tomselect/autocompletes.py"
function = "prepare_results"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-785h-76cm-cpmf: Django TomSelect incomplete escaping of dangerous characters in widget attributes"

[[pair]]
name = "unopim-getrules-49d5f6a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "unopim/unopim"
cve = "CVE-2025-55742 GHSA-xr97-25v7-hc2q"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2025-08-21T14:25:23Z"
post_cutoff = false
commit = "49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"
parent = "b5e169e65725e0d80b6c79d57e62a25e1af6a3c3"
commit_url = "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"
vendored = false
host = "github"
path = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php"
mode = "name"
relpath = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-04-01"
fix_lines = { in_function = 10, in_file = 9, source_total = 26 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/Webkul/DataTransfer/src/Validators/JobInstances/Import/ProductJobValidator.php"
function = "getRules"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-xr97-25v7-hc2q: UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality"

[[pair]]
name = "cloudbees-jenkins-advisor-plugin-executeinternal-4b456b3"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/cloudbees-jenkins-advisor-plugin"
cve = "CVE-2025-47885 GHSA-xrpq-4g9w-qrwj"
cwe = "CWE-79"
ecosystem = "maven"
published_at = "2025-05-14T21:31:20Z"
post_cutoff = false
commit = "4b456b3110d1504d7dce8e7fca84c4e8793650e6"
parent = "4a0914b416ad664bb3b9b07505d0d657b0d32d31"
commit_url = "https://github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/4b456b3110d1504d7dce8e7fca84c4e8793650e6"
vendored = false
host = "github"
path = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java"
mode = "name"
relpath = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-05-05"
fix_lines = { in_function = 6, in_file = 7, source_total = 10 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/main/java/com/cloudbees/jenkins/plugins/advisor/BundleUpload.java"
function = "executeInternal"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-xrpq-4g9w-qrwj: Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting"

[[pair]]
name = "clevertap-web-sdk-handlemessageevent-84695b7"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "clevertap/clevertap-web-sdk"
cve = "CVE-2026-26861 GHSA-j5mf-6rh3-rhgg"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-02-27T18:31:06Z"
post_cutoff = false
commit = "84695b726a751614ddc3a4f71382c239c5833e03"
parent = "5e4504572136c9b918f3fe084303bd5f73d3f008"
commit_url = "https://github.com/clevertap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03"
vendored = false
host = "github"
path = "src/modules/visualBuilder/pageBuilder.js"
mode = "name"
relpath = "src/modules/visualBuilder/pageBuilder.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-05-28"
fix_lines = { in_function = 6, in_file = 5, source_total = 26 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/modules/visualBuilder/pageBuilder.js"
function = "handleMessageEvent"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-j5mf-6rh3-rhgg: CleverTap Web SDK  is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function"

[[pair]]
name = "mezzanine-displayable-links-js-898630d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "BSD-2-Clause"
repo = "stephenmcd/mezzanine"
cve = "CVE-2025-6050 GHSA-7pr5-w74r-jjj7"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2025-06-17T12:31:15Z"
post_cutoff = false
commit = "898630d8df48cf3ddb8b9942f59168b93216e3f8"
parent = "245473493057c08911852ea8c82db4818ad6c9be"
commit_url = "https://github.com/stephenmcd/mezzanine/commit/898630d8df48cf3ddb8b9942f59168b93216e3f8"
vendored = false
host = "github"
path = "mezzanine/core/views.py"
mode = "name"
relpath = "mezzanine/core/views.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-06-04"
fix_lines = { in_function = 2, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "mezzanine/core/views.py"
function = "displayable_links_js"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-7pr5-w74r-jjj7: Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function"

[[pair]]
name = "cadwyn-swagger-dashboard-b424ecd"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "zmievsa/cadwyn"
cve = "CVE-2025-53528 GHSA-2gxp-6r36-m97r"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2025-07-21T14:08:40Z"
post_cutoff = false
commit = "b424ecd57cd8dabbc8fe39b8f8ccafea629c7728"
parent = "5a6e2b7f009f33d93ea26a50156523ba3e4c42ca"
commit_url = "https://github.com/zmievsa/cadwyn/commit/b424ecd57cd8dabbc8fe39b8f8ccafea629c7728"
vendored = false
host = "github"
path = "cadwyn/applications.py"
mode = "name"
relpath = "cadwyn/applications.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-07-05"
fix_lines = { in_function = 2, in_file = 3, source_total = 5 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "cadwyn/applications.py"
function = "swagger_dashboard"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-2gxp-6r36-m97r: Cadwyn vulnerable to XSS on the docs page"

[[pair]]
name = "webssh-log-status-a7a704f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "huashengdun/webssh"
cve = "CVE-2025-7885 GHSA-9cg4-9hv5-3376"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2025-07-20T12:30:27Z"
post_cutoff = false
commit = "a7a704f111391c82efc1bacf89693ff45bda7f5f"
parent = "1cf19c71861a0df4dcbad67b6544224bbe616be1"
commit_url = "https://github.com/huashengdun/webssh/commit/a7a704f111391c82efc1bacf89693ff45bda7f5f"
vendored = false
host = "github"
path = "webssh/static/js/main.js"
mode = "name"
relpath = "webssh/static/js/main.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-07-27"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "webssh/static/js/main.js"
function = "log_status"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-9cg4-9hv5-3376: WebSSH Cross-site Scripting vulnerability"

[[pair]]
name = "core-index-e984870"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "gp247net/core"
cve = "CVE-2025-57407 GHSA-46v4-5mc8-q2cf"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2025-09-23T18:30:22Z"
post_cutoff = false
commit = "e9848706b41d835ca3d668cb1554650403e86da1"
parent = "8c2d98e786ec01cd1841a9ccaa083f7e0e9a0f20"
commit_url = "https://github.com/gp247net/core/commit/e9848706b41d835ca3d668cb1554650403e86da1"
vendored = false
host = "github"
path = "src/Controllers/AdminLogController.php"
mode = "name"
relpath = "src/Controllers/AdminLogController.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-08-05"
fix_lines = { in_function = 2, in_file = 1, source_total = 5 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/Controllers/AdminLogController.php"
function = "index"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-46v4-5mc8-q2cf: GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability"

[[pair]]
name = "mesh-web-sdk-openlink-7f22148"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "frontfin/mesh-web-sdk"
cve = "CVE-2025-59430 GHSA-vh3f-qppr-j97f"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2025-09-22T21:09:27Z"
post_cutoff = false
commit = "7f22148516d58e21a8b7670dde927d614c0d15c2"
parent = "cf013b85ab95d64c63cbe46d6cb14695474924e7"
commit_url = "https://github.com/frontfin/mesh-web-sdk/commit/7f22148516d58e21a8b7670dde927d614c0d15c2"
vendored = false
host = "github"
path = "packages/link/src/Link.ts"
mode = "name"
relpath = "packages/link/src/Link.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-09-10"
fix_lines = { in_function = 6, in_file = 7, source_total = 7 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/link/src/Link.ts"
function = "openLink"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-vh3f-qppr-j97f: Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink"

[[pair]]
name = "fastmcp-create-detail-box-2a20f54"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "jlowin/fastmcp"
cve = "CVE-2025-62800 GHSA-mxxr-jv3v-6pgc"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2025-10-29T15:38:29Z"
post_cutoff = false
commit = "2a20f54617a37213ed83894a8c2f0ac38a2e83a3"
parent = "541822f07ff28b196bde09d3818fea0579becd86"
commit_url = "https://github.com/jlowin/fastmcp/commit/2a20f54617a37213ed83894a8c2f0ac38a2e83a3"
vendored = false
host = "github"
path = "src/fastmcp/utilities/ui.py"
mode = "name"
relpath = "src/fastmcp/utilities/ui.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-10-14"
fix_lines = { in_function = 4, in_file = 7, source_total = 13 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/fastmcp/utilities/ui.py"
function = "create_detail_box"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-mxxr-jv3v-6pgc: FastMCP vulnerable to reflected XSS in client's callback page"

[[pair]]
name = "mailgen-setupbuttonfallbacktext-7a791a4"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "eladnava/mailgen"
cve = "CVE-2025-62380 GHSA-q4w9-x3rv-4c8j"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2025-10-15T19:29:36Z"
post_cutoff = false
commit = "7a791a424ff3a3f7783f8750919f1e98639924a8"
parent = "cedddb6a672bf047d98b0053677310583d55ea45"
commit_url = "https://github.com/eladnava/mailgen/commit/7a791a424ff3a3f7783f8750919f1e98639924a8"
vendored = false
host = "github"
path = "index.js"
mode = "name"
relpath = "index.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-10-15"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "index.js"
function = "setupButtonFallbackText"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-q4w9-x3rv-4c8j: Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails"

[[pair]]
name = "spotipy-do-get-880b92d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "spotipy-dev/spotipy"
cve = "CVE-2025-66040 GHSA-r77h-rpp9-w2xm"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2025-12-01T19:07:26Z"
post_cutoff = false
commit = "880b92d7243dcf2b83bf31dc365a858d8b5e6767"
parent = "a91d9feb516a4360503dca9cfe63a35927b9befa"
commit_url = "https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767"
vendored = false
host = "github"
path = "spotipy/oauth2.py"
mode = "name"
relpath = "spotipy/oauth2.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-11-26"
fix_lines = { in_function = 2, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "spotipy/oauth2.py"
function = "do_GET"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-r77h-rpp9-w2xm: Spotipy has a XSS vulnerability in its OAuth callback server"

[[pair]]
name = "java-html-sanitizer-stripdisallowedtags-4149cf0"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "owasp/java-html-sanitizer"
cve = "CVE-2025-66021 GHSA-g9gq-3pfx-2gw2"
cwe = "CWE-79"
ecosystem = "maven"
published_at = "2025-11-25T22:10:17Z"
post_cutoff = false
commit = "4149cf02ba84db13e8e9d7ee1b01b3f47238e072"
parent = "b98cdf1cd5e156a6259b01aa8cdc7372c6efde1e"
commit_url = "https://github.com/owasp/java-html-sanitizer/commit/4149cf02ba84db13e8e9d7ee1b01b3f47238e072"
vendored = false
host = "github"
path = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java"
mode = "name"
relpath = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-12-22"
fix_lines = { in_function = 26, in_file = 19, source_total = 31 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "owasp-java-html-sanitizer/src/main/java/org/owasp/html/ElementAndAttributePolicyBasedSanitizerPolicy.java"
function = "stripDisallowedTags"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-g9gq-3pfx-2gw2: OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization "

[[pair]]
name = "html2pdf-js-createelement-988826e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "ekoopmans/html2pdf.js"
cve = "CVE-2026-22787 GHSA-w8x4-x68c-m6fc"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-01-14T16:53:10Z"
post_cutoff = false
commit = "988826e336035b39a8608182d7b73c0e3cd78c7b"
parent = "f6dc70fdaa814f7b83d1e8059279814d5b46013e"
commit_url = "https://github.com/ekoopmans/html2pdf.js/commit/988826e336035b39a8608182d7b73c0e3cd78c7b"
vendored = false
host = "github"
path = "src/utils.js"
mode = "name"
relpath = "src/utils.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-12"
fix_lines = { in_function = 10, in_file = 10, source_total = 13 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/utils.js"
function = "createElement"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-w8x4-x68c-m6fc: html2pdf.js contains a cross-site scripting vulnerability"

[[pair]]
name = "distributed-http-get-ab72092"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "dask/distributed"
cve = "CVE-2026-23528 GHSA-c336-7962-wfj2"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2026-01-16T16:58:16Z"
post_cutoff = false
commit = "ab72092a8a938923c2bb51a2cd14ca26614827fa"
parent = "f4cfecc48856d5f0fbf7f840fbecdb17544fd30e"
commit_url = "https://github.com/dask/distributed/commit/ab72092a8a938923c2bb51a2cd14ca26614827fa"
vendored = false
host = "github"
path = "distributed/http/proxy.py"
mode = "name"
relpath = "distributed/http/proxy.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-01-16"
fix_lines = { in_function = 2, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "distributed/http/proxy.py"
function = "http_get"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-c336-7962-wfj2: Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard"

[[pair]]
name = "beautiful-mermaid-rendernodeshape-68f3ab8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "lukilabs/beautiful-mermaid"
cve = "CVE-2026-26226 GHSA-cgmm-x5ww-q5cr"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-02-13T18:31:25Z"
post_cutoff = false
commit = "68f3ab8c9658e7f4a3b749e06a6b96e4c3f55db1"
parent = "83ab883b6826aa5c9df26843883bdbe89ceae7cf"
commit_url = "https://github.com/lukilabs/beautiful-mermaid/commit/68f3ab8c9658e7f4a3b749e06a6b96e4c3f55db1"
vendored = false
host = "github"
path = "src/renderer.ts"
mode = "name"
relpath = "src/renderer.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-29"
fix_lines = { in_function = 6, in_file = 4, source_total = 8 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/renderer.ts"
function = "renderNodeShape"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-cgmm-x5ww-q5cr: beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS)"

[[pair]]
name = "isso-moderate-0afbfe0"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "isso-comments/isso"
cve = "CVE-2026-27469 GHSA-9fww-8cpr-q66r"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2026-02-24T16:03:04Z"
post_cutoff = false
commit = "0afbfe0691ee237963e8fb0b2ee01c9e55ca2144"
parent = "09cddc1940c837cbd46559db49459d20f670cd16"
commit_url = "https://github.com/isso-comments/isso/commit/0afbfe0691ee237963e8fb0b2ee01c9e55ca2144"
vendored = false
host = "github"
path = "isso/views/comments.py"
mode = "name"
relpath = "isso/views/comments.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-19"
fix_lines = { in_function = 10, in_file = 26, source_total = 27 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "isso/views/comments.py"
function = "moderate"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-9fww-8cpr-q66r: Isso affected by Stored XSS via comment website field"

[[pair]]
name = "pannellum-createhotspot-9391ef8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "mpetroff/pannellum"
cve = "CVE-2026-27210 GHSA-8423-w5wx-h2r6"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-02-19T20:44:48Z"
post_cutoff = false
commit = "9391ef8da6a6a98c6a9f8c97f101adb900523681"
parent = "bb19235ac074df05c545c8d2d2235916d2aef0b8"
commit_url = "https://github.com/mpetroff/pannellum/commit/9391ef8da6a6a98c6a9f8c97f101adb900523681"
vendored = false
host = "github"
path = "src/js/pannellum.js"
mode = "name"
relpath = "src/js/pannellum.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-19"
fix_lines = { in_function = 8, in_file = 13, source_total = 14 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/js/pannellum.js"
function = "createHotSpot"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-8423-w5wx-h2r6: Pannellum has a XSS vulnerability in hot spot attributes"

[[pair]]
name = "lxml-html-clean-call-9c5612c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "fedora-python/lxml_html_clean"
cve = "CVE-2026-28350 GHSA-xvp8-3mhv-424c"
cwe = "CWE-116"
ecosystem = "pip"
published_at = "2026-03-02T19:35:52Z"
post_cutoff = false
commit = "9c5612ca33b941eec4178abf8a5294b103403f34"
parent = "2ef732667ddbc74ea59847bcf24b75809aaeed3b"
commit_url = "https://github.com/fedora-python/lxml_html_clean/commit/9c5612ca33b941eec4178abf8a5294b103403f34"
vendored = false
host = "github"
path = "lxml_html_clean/clean.py"
mode = "name"
relpath = "lxml_html_clean/clean.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-27"
fix_lines = { in_function = 2, in_file = 6, source_total = 6 }

[[pair.expected]]
cwe = "CWE-116"
class = "improper-encoding"
path = "lxml_html_clean/clean.py"
function = "__call__"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-xvp8-3mhv-424c: lxml-html-clean has <base> tag injection through default Cleaner configuration"

[[pair]]
name = "nicknames-invoke-4dde997"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "flarum/nicknames"
cve = "CVE-2026-30913 GHSA-3c4m-j3g4-hh25"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2026-03-10T00:56:30Z"
post_cutoff = false
commit = "4dde99729abdce8f6e2a7437c86e38735fdcca28"
parent = "7985676fea59adc4628a1f0ba42ea93afc9be498"
commit_url = "https://github.com/flarum/nicknames/commit/4dde99729abdce8f6e2a7437c86e38735fdcca28"
vendored = false
host = "github"
path = "src/AddNicknameValidation.php"
mode = "name"
relpath = "src/AddNicknameValidation.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-06"
fix_lines = { in_function = 5, in_file = 7, source_total = 20 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/AddNicknameValidation.php"
function = "__invoke"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-3c4m-j3g4-hh25: flarum/nicknames extension has display name injection in notification emails (autolink & markdown)"

[[pair]]
name = "vscode-lean4-replaceat-14b7a10"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "leanprover/vscode-lean4"
cve = "CVE-2026-32732 GHSA-6ggm-pwr9-r5h2"
cwe = "CWE-80"
ecosystem = "npm"
published_at = "2026-03-16T16:39:55Z"
post_cutoff = false
commit = "14b7a105c89d2819c5e78970fd258393f76453bb"
parent = "a884fa075489c3401e3702ad78aaa45a98a0841a"
commit_url = "https://github.com/leanprover/vscode-lean4/commit/14b7a105c89d2819c5e78970fd258393f76453bb"
vendored = false
host = "github"
path = "lean4-unicode-input-component/src/index.ts"
mode = "name"
relpath = "lean4-unicode-input-component/src/index.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-11"
fix_lines = { in_function = 4, in_file = 13, source_total = 17 }

[[pair.expected]]
cwe = "CWE-80"
class = "xss"
path = "lean4-unicode-input-component/src/index.ts"
function = "replaceAt"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-6ggm-pwr9-r5h2: XSS in @leanprover/unicode-input-component"

[[pair]]
name = "express-xss-sanitizer-initializeoptions-5623009"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "ahmedadelfahim/express-xss-sanitizer"
cve = "CVE-2026-33979 GHSA-3843-rr4g-m8jq"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-03-27T17:56:45Z"
post_cutoff = false
commit = "5623009ef11dcf095c163a38dea07b9cc22ad19f"
parent = "62d6542a2a57298da7a2e02de623454007e4f6d6"
commit_url = "https://github.com/ahmedadelfahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f"
vendored = false
host = "github"
path = "lib/sanitize.js"
mode = "name"
relpath = "lib/sanitize.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-25"
fix_lines = { in_function = 4, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "lib/sanitize.js"
function = "initializeOptions"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-3843-rr4g-m8jq: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)"

[[pair]]
name = "unhead-getstreamkey-64b5ac0"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "unjs/unhead"
cve = "GHSA-x7mm-9vvv-64w8"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-04-10T22:09:39Z"
post_cutoff = false
commit = "64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6"
parent = "17c123eb9e8974bf72973246efdf26a199fd11bd"
commit_url = "https://github.com/unjs/unhead/commit/64b5ac0aa30cc256ea6677ce3dc4f132f81b2ff6"
vendored = false
host = "github"
path = "packages/unhead/src/stream/server.ts"
mode = "name"
relpath = "packages/unhead/src/stream/server.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-10"
fix_lines = { in_function = 4, in_file = 20, source_total = 21 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/unhead/src/stream/server.ts"
function = "getStreamKey"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-x7mm-9vvv-64w8: unhead: Streaming SSR `streamKey` injected into inline script without identifier validation"

[[pair]]
name = "ipl-web-postdispatch-f387e92"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "icinga/ipl-web"
cve = "CVE-2026-42224 GHSA-55wf-5m3q-6jjf"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2026-04-29T21:01:55Z"
post_cutoff = false
commit = "f387e92504d7a03bb857d1aee9b7410e06dd065d"
parent = "b0fa6ea09f7269b7616e0ae6c9ec50035679bb23"
commit_url = "https://github.com/icinga/ipl-web/commit/f387e92504d7a03bb857d1aee9b7410e06dd065d"
vendored = false
host = "github"
path = "src/Compat/CompatController.php"
mode = "name"
relpath = "src/Compat/CompatController.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-21"
fix_lines = { in_function = 4, in_file = 3, source_total = 4 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/Compat/CompatController.php"
function = "postDispatch"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-55wf-5m3q-6jjf: ipl/web is vulnerable to reflected XSS by malformed search requests"

[[pair]]
name = "livewire-markdown-editor-updatedattachments-1e60eaa"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "mckenziearts/livewire-markdown-editor"
cve = "GHSA-gxxh-8vcj-w2mh"
cwe = "CWE-79"
ecosystem = "composer"
published_at = "2026-05-04T22:11:05Z"
post_cutoff = false
commit = "1e60eaa5781e89704e112425f832774be85cd71f"
parent = "cfd07048019694d2aaeaa9247a63991703173858"
commit_url = "https://github.com/mckenziearts/livewire-markdown-editor/commit/1e60eaa5781e89704e112425f832774be85cd71f"
vendored = false
host = "github"
path = "src/Livewire/MarkdownEditor.php"
mode = "name"
relpath = "src/Livewire/MarkdownEditor.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-24"
fix_lines = { in_function = 11, in_file = 43, source_total = 73 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/Livewire/MarkdownEditor.php"
function = "updatedAttachments"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-gxxh-8vcj-w2mh: livewire-markdown-editor has arbitrary file upload that allows stored XSS via attachment handler"

[[pair]]
name = "microdot-set-cookie-99b281b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "miguelgrinberg/microdot"
cve = "CVE-2026-42874 GHSA-7wc8-wvc4-m498"
cwe = "CWE-113"
ecosystem = "pip"
published_at = "2026-05-05T18:35:20Z"
post_cutoff = false
commit = "99b281b45faef8472410f2d56bfef496dfbd95d5"
parent = "da91d4272aa2fb5efcc81bf823947737e031d0f8"
commit_url = "https://github.com/miguelgrinberg/microdot/commit/99b281b45faef8472410f2d56bfef496dfbd95d5"
vendored = false
host = "github"
path = "src/microdot/microdot.py"
mode = "name"
relpath = "src/microdot/microdot.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-24"
fix_lines = { in_function = 2, in_file = 3, source_total = 4 }

[[pair.expected]]
cwe = "CWE-113"
class = "header-injection"
path = "src/microdot/microdot.py"
function = "set_cookie"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-7wc8-wvc4-m498: Microdot has HTTP response splitting in Response.set_cookie()"

[[pair]]
name = "liquidjs-strip-html-26ea285"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "harttle/liquidjs"
cve = "CVE-2026-44644 GHSA-2qv6-9wx5-cwv4"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-05-27T00:09:12Z"
post_cutoff = false
commit = "26ea2856c7a90aec892b98d94a9b7a3e18539045"
parent = "a55f543f49aea8f769e680b0d115aa903952efd0"
commit_url = "https://github.com/harttle/liquidjs/commit/26ea2856c7a90aec892b98d94a9b7a3e18539045"
vendored = false
host = "github"
path = "src/filters/html.ts"
mode = "name"
relpath = "src/filters/html.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-03"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/filters/html.ts"
function = "strip_html"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-2qv6-9wx5-cwv4: LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS"

[[pair]]
name = "sveltia-cms-sanitizeentrysummary-43a6ac5"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "sveltia/sveltia-cms"
cve = "GHSA-97r8-rf7q-wmjw"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-05-18T13:43:50Z"
post_cutoff = false
commit = "43a6ac5d0182a503400d8ce1ac156e08f537b1b2"
parent = "bb403947508f0070a93938878153530771c1b405"
commit_url = "https://github.com/sveltia/sveltia-cms/commit/43a6ac5d0182a503400d8ce1ac156e08f537b1b2"
vendored = false
host = "github"
path = "src/lib/services/contents/entry/summary.js"
mode = "name"
relpath = "src/lib/services/contents/entry/summary.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-05-11"
fix_lines = { in_function = 7, in_file = 9, source_total = 10 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/lib/services/contents/entry/summary.js"
function = "sanitizeEntrySummary"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-97r8-rf7q-wmjw: Sveltia CMS: Stored XSS in entry summary rendering via entity-decoded HTML"

[[pair]]
name = "svelte-encode-a16ebc6"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "sveltejs/svelte"
cve = "GHSA-f3cj-j4f6-wq85"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-05-14T20:30:09Z"
post_cutoff = false
commit = "a16ebc67bbcf8f708360195687e1b2719463e1a4"
parent = "d2375e2ebcab5c88feb5652f1a9d621b8f06b259"
commit_url = "https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4"
vendored = false
host = "github"
path = "packages/svelte/src/internal/server/hydratable.js"
mode = "name"
relpath = "packages/svelte/src/internal/server/hydratable.js"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-14"
fix_lines = { in_function = 5, in_file = 8, source_total = 19 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/svelte/src/internal/server/hydratable.js"
function = "encode"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-f3cj-j4f6-wq85: Svelte: SSR XSS via Insecure Promise Serialization in hydratable"

[[pair]]
name = "jupyterlab-git-diffheader-c6d37b8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "jupyterlab/jupyterlab-git"
cve = "CVE-2026-54527 GHSA-f962-v9hr-pfg5"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2026-06-19T19:36:04Z"
post_cutoff = true
commit = "c6d37b88f36aa59aee317930b95e427fb9d6b09b"
parent = "af267598e7437993c02a14101db41c75809a7f88"
commit_url = "https://github.com/jupyterlab/jupyterlab-git/commit/c6d37b88f36aa59aee317930b95e427fb9d6b09b"
vendored = false
host = "github"
path = "src/components/diff/NotebookDiff.ts"
mode = "name"
relpath = "src/components/diff/NotebookDiff.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-06-17"
fix_lines = { in_function = 23, in_file = 14, source_total = 36 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/components/diff/NotebookDiff.ts"
function = "diffHeader"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-f962-v9hr-pfg5: jupyterlab-git extension: Stored XSS leading to RCE"

[[pair]]
name = "appium-mcp-createlocatorgeneratorui-e222bbb"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "appium/appium-mcp"
cve = "GHSA-x975-rgx4-5fh4"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-06-19T21:43:14Z"
post_cutoff = true
commit = "e222bbbd6fe2b656a320efcd143563f08061a83d"
parent = "1655fbd41f462f43dc49fd78f15727db0e2fb6c3"
commit_url = "https://github.com/appium/appium-mcp/commit/e222bbbd6fe2b656a320efcd143563f08061a83d"
vendored = false
host = "github"
path = "src/ui/mcp-ui-utils.ts"
mode = "name"
relpath = "src/ui/mcp-ui-utils.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-06-18"
fix_lines = { in_function = 14, in_file = 26, source_total = 33 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "src/ui/mcp-ui-utils.ts"
function = "createLocatorGeneratorUI"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-x975-rgx4-5fh4: appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)"

[[pair]]
name = "jupyterlab-updateconfig-be9303f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "jupyterlab/jupyterlab"
cve = "CVE-2026-73417 GHSA-pppj-hq3g-57pj"
cwe = "CWE-79"
ecosystem = "pip"
published_at = "2026-07-22T23:16:18Z"
post_cutoff = true
commit = "be9303f5bcd5308eaeae953c5a3c903046682c2c"
parent = "a555fe1dcb4a4d6b135236ae89319a9f303780d9"
commit_url = "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
vendored = false
host = "github"
path = "packages/notebook-extension/src/index.ts"
mode = "name"
relpath = "packages/notebook-extension/src/index.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-07-21"
fix_lines = { in_function = 13, in_file = 7, source_total = 87 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/notebook-extension/src/index.ts"
function = "updateConfig"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-pppj-hq3g-57pj: JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)"

[[pair]]
name = "file-viewer-render-ef04568"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "flyfish-dev/file-viewer"
cve = "CVE-2026-91127 GHSA-3753-m2x2-q623"
cwe = "CWE-79"
ecosystem = "npm"
published_at = "2026-09-18T17:19:42Z"
post_cutoff = true
commit = "ef045680f8d9830a3eee9612f7df46a734361b07"
parent = "772ae40de07e48134de0449997cb4924b0cde3e4"
commit_url = "https://github.com/flyfish-dev/file-viewer/commit/ef045680f8d9830a3eee9612f7df46a734361b07"
vendored = false
host = "github"
path = "packages/renderers/word/src/wordDoc.ts"
mode = "name"
relpath = "packages/renderers/word/src/wordDoc.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-08-24"
fix_lines = { in_function = 14, in_file = 13, source_total = 160 }

[[pair.expected]]
cwe = "CWE-79"
class = "xss"
path = "packages/renderers/word/src/wordDoc.ts"
function = "render"
mechanism = "source_reaches_sink"
family = "output_encoding"
evidence = "GHSA-3753-m2x2-q623: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer"

[[pair]]
name = "bazingajstranslationbundle-getlocales-7accee9"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "willdurand/bazingajstranslationbundle"
cve = "GHSA-x86x-qhf8-f37w"
cwe = "CWE-22"
ecosystem = "composer"
published_at = "2024-06-07T22:20:27Z"
post_cutoff = false
commit = "7accee93569c3f3d2379f035a41ece66522801fc"
parent = "df6c0fd603c0192ebc5584991a52a1092c5f60bd"
commit_url = "https://github.com/willdurand/bazingajstranslationbundle/commit/7accee93569c3f3d2379f035a41ece66522801fc"
vendored = false
host = "github"
path = "Controller/Controller.php"
mode = "name"
relpath = "Controller/Controller.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2014-07-29"
fix_lines = { in_function = 3, in_file = 4, source_total = 22 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "Controller/Controller.php"
function = "getLocales"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-x86x-qhf8-f37w: willdurand/js-translation-bundle potential path traversal attack and remote code injection"

[[pair]]
name = "nodeserver-onrequest-c4c0f01"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "youngerheart/nodeserver"
cve = "CVE-2020-36651 GHSA-3fwq-qv5v-2wxf"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2023-01-18T03:31:17Z"
post_cutoff = false
commit = "c4c0f0138ab5afbac58e03915d446680421bde28"
parent = "56b51bd4bdff640a4eb2e16e8558ce7b709a95b6"
commit_url = "https://github.com/youngerheart/nodeserver/commit/c4c0f0138ab5afbac58e03915d446680421bde28"
vendored = false
host = "github"
path = "nodeserver.js"
mode = "name"
relpath = "nodeserver.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2020-08-21"
fix_lines = { in_function = 2, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "nodeserver.js"
function = "onRequest"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-3fwq-qv5v-2wxf: Path Traversal in web-node-server"

[[pair]]
name = "microweber-download-572bdc3"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "microweber/microweber"
cve = "CVE-2025-34076 GHSA-j64v-xh5w-8hqj"
cwe = "CWE-22"
ecosystem = "composer"
published_at = "2025-07-02T21:32:00Z"
post_cutoff = false
commit = "572bdc36b5b47923790016f6b961c8df53226855"
parent = "b71f9e2a2c8b1f96ea54d6d894452585f424e509"
commit_url = "https://github.com/microweber/microweber/commit/572bdc36b5b47923790016f6b961c8df53226855"
vendored = false
host = "github"
path = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php"
mode = "name"
relpath = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2022-02-03"
fix_lines = { in_function = 7, in_file = 11, source_total = 12 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/MicroweberPackages/Backup/Http/Controllers/Admin/BackupController.php"
function = "download"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-j64v-xh5w-8hqj: Microweber CMS API has authenticated local file inclusion vulnerability"

[[pair]]
name = "binwalk-extractor-696fe34"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "refirmlabs/binwalk"
cve = "CVE-2022-4510 GHSA-3cm8-v4mc-gppg"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2023-01-26T21:30:20Z"
post_cutoff = false
commit = "696fe34ed680ffd951bfeca737feb4a0b98dde5c"
parent = "a555eb1fa6ed0073c36b3493fba7a463a98eaa97"
commit_url = "https://github.com/refirmlabs/binwalk/commit/696fe34ed680ffd951bfeca737feb4a0b98dde5c"
vendored = false
host = "github"
path = "src/binwalk/plugins/unpfs.py"
mode = "name"
relpath = "src/binwalk/plugins/unpfs.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2022-10-26"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/binwalk/plugins/unpfs.py"
function = "extractor"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-3cm8-v4mc-gppg: Path traversal in binwalk"

[[pair]]
name = "gatsby-onoperation-ae5a654"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "gatsbyjs/gatsby"
cve = "CVE-2023-34238 GHSA-c6f8-8r25-c4gc"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2023-06-09T22:52:01Z"
post_cutoff = false
commit = "ae5a654eb346b2e7a9d341b809b2f82d34c0f17c"
parent = "18a47dadfdb0e38daf4371739ebaeb2593d3e6f6"
commit_url = "https://github.com/gatsbyjs/gatsby/commit/ae5a654eb346b2e7a9d341b809b2f82d34c0f17c"
vendored = false
host = "github"
path = "packages/gatsby/src/utils/start-server.ts"
mode = "name"
relpath = "packages/gatsby/src/utils/start-server.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-05-05"
fix_lines = { in_function = 26, in_file = 33, source_total = 102 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "packages/gatsby/src/utils/start-server.ts"
function = "onOperation"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-c6f8-8r25-c4gc: Gatsby develop server has Local File Inclusion vulnerability"

[[pair]]
name = "codedx-plugin-checkcsvfilematches-138932b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "jenkinsci/codedx-plugin"
cve = "CVE-2023-2196 GHSA-5gjq-5339-x5cv"
cwe = "CWE-22"
ecosystem = "maven"
published_at = "2023-05-16T18:30:16Z"
post_cutoff = false
commit = "138932b362c7da3c310b1f34fc854c5bf5f52458"
parent = "0214f30488ea8481f01e4b14a861e13d75bebb8b"
commit_url = "https://github.com/jenkinsci/codedx-plugin/commit/138932b362c7da3c310b1f34fc854c5bf5f52458"
vendored = false
host = "github"
path = "src/main/java/org/jenkinsci/plugins/codedx/Util.java"
mode = "name"
relpath = "src/main/java/org/jenkinsci/plugins/codedx/Util.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-05-10"
fix_lines = { in_function = 4, in_file = 3, source_total = 12 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/main/java/org/jenkinsci/plugins/codedx/Util.java"
function = "checkCSVFileMatches"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-5gjq-5339-x5cv: Jenkins Code Dx Plugin missing permission checks"

[[pair]]
name = "php-imap-fetch-88aaafb"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "webklex/php-imap"
cve = "CVE-2023-35169 GHSA-47p7-xfcc-4pv9"
cwe = "CWE-22"
ecosystem = "composer"
published_at = "2023-06-21T21:58:58Z"
post_cutoff = false
commit = "88aaafbd881f09c3ec174f7417d36a8dedbd1b37"
parent = "6ea5a94f2f8936ac5c2c40a46fbbd88f2bdeb16b"
commit_url = "https://github.com/webklex/php-imap/commit/88aaafbd881f09c3ec174f7417d36a8dedbd1b37"
vendored = false
host = "github"
path = "src/Attachment.php"
mode = "name"
relpath = "src/Attachment.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-06-20"
fix_lines = { in_function = 6, in_file = 20, source_total = 26 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/Attachment.php"
function = "fetch"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-47p7-xfcc-4pv9: php-imap vulnerable to RCE through a directory traversal vulnerability"

[[pair]]
name = "cypress-image-snapshot-removesnapshot-ef49519"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "simonsmith/cypress-image-snapshot"
cve = "CVE-2023-38695 GHSA-vxjg-hchx-cc4g"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2023-08-01T16:59:40Z"
post_cutoff = false
commit = "ef49519795daf5183f4fac6f3136e194f20f39f4"
parent = "b64bdc31943c3eb862efadef32586f96fbf787f5"
commit_url = "https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4"
vendored = false
host = "github"
path = "src/plugin.ts"
mode = "name"
relpath = "src/plugin.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-07-31"
fix_lines = { in_function = 2, in_file = 2, source_total = 8 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/plugin.ts"
function = "removeSnapshot"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-vxjg-hchx-cc4g: @simonsmith/cypress-image-snapshothas fix for insecure snapshot file names"

[[pair]]
name = "pf4j-extract-8e0aa19"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "pf4j/pf4j"
cve = "CVE-2023-40828 GHSA-cj8w-v588-p8wx"
cwe = "CWE-22"
ecosystem = "maven"
published_at = "2023-08-29T00:32:04Z"
post_cutoff = false
commit = "8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72"
parent = "c1c9c982dc372d1027468e166c3e0675d6890e2a"
commit_url = "https://github.com/pf4j/pf4j/commit/8e0aa198c4e652cfc1eb9e05ca9b64397f67cc72"
vendored = false
host = "github"
path = "pf4j/src/main/java/org/pf4j/util/Unzip.java"
mode = "name"
relpath = "pf4j/src/main/java/org/pf4j/util/Unzip.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-08-16"
fix_lines = { in_function = 5, in_file = 14, source_total = 14 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "pf4j/src/main/java/org/pf4j/util/Unzip.java"
function = "extract"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-cj8w-v588-p8wx: pf4j vulnerable to remote code execution via expandIfZip method in the extract function"

[[pair]]
name = "aws-sdk-php-buildendpoint-aebc9f8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "Apache-2.0"
repo = "aws/aws-sdk-php"
cve = "CVE-2023-51651 GHSA-557v-xcg6-rm5m"
cwe = "CWE-22"
ecosystem = "composer"
published_at = "2023-12-21T23:16:13Z"
post_cutoff = false
commit = "aebc9f801438746ac4ade327551576cb75f635f2"
parent = "3daedce00e450411630528245d83f734651b5dda"
commit_url = "https://github.com/aws/aws-sdk-php/commit/aebc9f801438746ac4ade327551576cb75f635f2"
vendored = false
host = "github"
path = "src/Api/Serializer/RestSerializer.php"
mode = "name"
relpath = "src/Api/Serializer/RestSerializer.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-11-22"
fix_lines = { in_function = 6, in_file = 9, source_total = 11 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/Api/Serializer/RestSerializer.php"
function = "buildEndpoint"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-557v-xcg6-rm5m: Potential URI resolution path traversal in the AWS SDK for PHP"

[[pair]]
name = "arrp-dumpdirect-7ea80db"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "MPL-2.0"
repo = "devan-kerman/arrp"
cve = "CVE-2024-24042 GHSA-cg24-jjr5-rxmf"
cwe = "CWE-22"
ecosystem = "maven"
published_at = "2024-03-19T09:30:32Z"
post_cutoff = false
commit = "7ea80db462c8bf66a0565e84fa49c1f2ecb9287b"
parent = "3a685438960b7fa64adaf71f7f13fba30d9b60f7"
commit_url = "https://github.com/devan-kerman/arrp/commit/7ea80db462c8bf66a0565e84fa49c1f2ecb9287b"
vendored = false
host = "github"
path = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java"
mode = "name"
relpath = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-01-09"
fix_lines = { in_function = 2, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/main/java/net/devtech/arrp/impl/RuntimeResourcePackImpl.java"
function = "dumpDirect"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-cg24-jjr5-rxmf: Path traversal in flaskcode Devan-Kerman ARRP"

[[pair]]
name = "paddle-download-5c50d1a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "paddlepaddle/paddle"
cve = "CVE-2024-0818 GHSA-2rp8-hff9-c5wr"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2024-03-07T15:30:38Z"
post_cutoff = false
commit = "5c50d1a8b97b310cbc36560ec36d8377d6f29d7c"
parent = "62a1261328c6bc165d2cfaea1338b74b5801104f"
commit_url = "https://github.com/paddlepaddle/paddle/commit/5c50d1a8b97b310cbc36560ec36d8377d6f29d7c"
vendored = false
host = "github"
path = "python/paddle/dataset/common.py"
mode = "name"
relpath = "python/paddle/dataset/common.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-01-31"
fix_lines = { in_function = 5, in_file = 6, source_total = 6 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "python/paddle/dataset/common.py"
function = "download"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-2rp8-hff9-c5wr: PaddlePaddle Path Traversal vulnerability"

[[pair]]
name = "lektor-untrusted-to-os-path-7393d87"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "lektor/lektor"
cve = "CVE-2024-28335 GHSA-wv28-7fpw-fj49"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2024-03-27T06:30:33Z"
post_cutoff = false
commit = "7393d87bd354e43120937789956175064e4610a0"
parent = "4b5731226f5e2a3f70ecf258d6718e99a962921c"
commit_url = "https://github.com/lektor/lektor/commit/7393d87bd354e43120937789956175064e4610a0"
vendored = false
host = "github"
path = "lektor/utils.py"
mode = "name"
relpath = "lektor/utils.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-02-27"
fix_lines = { in_function = 5, in_file = 4, source_total = 18 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "lektor/utils.py"
function = "untrusted_to_os_path"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-wv28-7fpw-fj49: Lektor does not sanitize database path traversal"

[[pair]]
name = "unzip-stream-unzipstream-ab67989"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "mhr3/unzip-stream"
cve = "GHSA-6jrj-vc65-c983"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2024-08-26T15:17:40Z"
post_cutoff = false
commit = "ab67989719abb4dcc774d02de266151905b8d45a"
parent = "4a4be03d5e13ce5408b8be3dee970d15212ca532"
commit_url = "https://github.com/mhr3/unzip-stream/commit/ab67989719abb4dcc774d02de266151905b8d45a"
vendored = false
host = "github"
path = "lib/unzip-stream.js"
mode = "name"
relpath = "lib/unzip-stream.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-04-20"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "lib/unzip-stream.js"
function = "UnzipStream"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-6jrj-vc65-c983: unzip-stream allows Arbitrary File Write via artifact extraction"

[[pair]]
name = "openapi-generator-generate-edbb021"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "openapitools/openapi-generator"
cve = "CVE-2024-35219 GHSA-g3hr-p86p-593h"
cwe = "CWE-22"
ecosystem = "maven"
published_at = "2024-05-28T15:47:57Z"
post_cutoff = false
commit = "edbb021aadae47dcfe690313ce5119faf77f800d"
parent = "4a872a8d697fbcfb8fd115bfaf10c00c2e3e3e06"
commit_url = "https://github.com/openapitools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d"
vendored = false
host = "github"
path = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java"
mode = "name"
relpath = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-05-14"
fix_lines = { in_function = 8, in_file = 8, source_total = 11 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java"
function = "generate"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-g3hr-p86p-593h: OpenAPI Generator Online - Arbitrary File Read/Delete"

[[pair]]
name = "weave-send-local-file-f43d5fb"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "wandb/weave"
cve = "CVE-2024-7340 GHSA-r49h-6qxq-624f"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2024-07-31T15:31:19Z"
post_cutoff = false
commit = "f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f"
parent = "c28d8d5bd811c33fd7b75663482447be9120299d"
commit_url = "https://github.com/wandb/weave/commit/f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f"
vendored = false
host = "github"
path = "weave/weave_server.py"
mode = "name"
relpath = "weave/weave_server.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-07-02"
fix_lines = { in_function = 18, in_file = 26, source_total = 28 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "weave/weave_server.py"
function = "send_local_file"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-r49h-6qxq-624f: Weave server API vulnerable to arbitrary file leak"

[[pair]]
name = "solara-get-from-cache-df2fd66"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "widgetti/solara"
cve = "CVE-2024-39903 GHSA-9794-pc4r-438w"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2024-07-12T21:00:21Z"
post_cutoff = false
commit = "df2fd66a7f4e8ffd36e8678697a8a4f76760dc54"
parent = "681f69b7779da2bd3586d6e9fd0b21d36e6fb124"
commit_url = "https://github.com/widgetti/solara/commit/df2fd66a7f4e8ffd36e8678697a8a4f76760dc54"
vendored = false
host = "github"
path = "solara/server/cdn_helper.py"
mode = "name"
relpath = "solara/server/cdn_helper.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-07-11"
fix_lines = { in_function = 10, in_file = 18, source_total = 41 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "solara/server/cdn_helper.py"
function = "get_from_cache"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-9794-pc4r-438w: Local File Inclusion in Solara"

[[pair]]
name = "url-to-png-handleextractqueryparamsmiddleware-e4eaeca"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "jasonraimondi/url-to-png"
cve = "CVE-2024-39918 GHSA-vvmv-wrvp-9gjr"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2024-07-15T17:46:57Z"
post_cutoff = false
commit = "e4eaeca6493b21cd515b582fd6c0af09ede54507"
parent = "ef8391480c25332fc74d6cf841eab2969e18db27"
commit_url = "https://github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507"
vendored = false
host = "github"
path = "src/middlewares/extract_query_params.ts"
mode = "name"
relpath = "src/middlewares/extract_query_params.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-07-13"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/middlewares/extract_query_params.ts"
function = "handleExtractQueryParamsMiddleware"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-vvmv-wrvp-9gjr: @jmondi/url-to-png contains a Path Traversal vulnerability"

[[pair]]
name = "df-core-handleservicerequest-5435460"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "Apache-2.0"
repo = "dreamfactorysoftware/df-core"
cve = "CVE-2025-55988 GHSA-gv7f-w92j-383q"
cwe = "CWE-22"
ecosystem = "composer"
published_at = "2026-03-20T21:31:28Z"
post_cutoff = false
commit = "54354605b2ec9afe6ee96756a5a22f6f56828950"
parent = "64ff000d125e55678a2cf909b157c2f5fd4b109c"
commit_url = "https://github.com/dreamfactorysoftware/df-core/commit/54354605b2ec9afe6ee96756a5a22f6f56828950"
vendored = false
host = "github"
path = "src/Http/Controllers/RestController.php"
mode = "name"
relpath = "src/Http/Controllers/RestController.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-09-02"
fix_lines = { in_function = 1, in_file = 1, source_total = 1 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/Http/Controllers/RestController.php"
function = "handleServiceRequest"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-gv7f-w92j-383q: DreamFactory has a directory traversal"

[[pair]]
name = "oak-send-4b2f27e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "oakserver/oak"
cve = "CVE-2024-49770 GHSA-qm92-93fv-vh7m"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2024-11-01T21:37:10Z"
post_cutoff = false
commit = "4b2f27efd5cba5a45b2c3982e610da3af0869209"
parent = "3896fe568b25ac0b4c5afbf822ff8344c3d1712a"
commit_url = "https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209"
vendored = false
host = "github"
path = "send.ts"
mode = "name"
relpath = "send.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-11-01"
fix_lines = { in_function = 2, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "send.ts"
function = "send"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-qm92-93fv-vh7m: Path traversal in oak allows transfer of hidden files within the served root directory"

[[pair]]
name = "agentscope-delete-workflow-7d285e8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "modelscope/agentscope"
cve = "CVE-2024-8537 GHSA-c4cc-w454-4634"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-03-20T12:32:48Z"
post_cutoff = false
commit = "7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a"
parent = "6178c29bcbff044c5bab788c0eb364c0fe84baec"
commit_url = "https://github.com/modelscope/agentscope/commit/7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a"
vendored = false
host = "github"
path = "src/agentscope/studio/_app.py"
mode = "name"
relpath = "src/agentscope/studio/_app.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-11-28"
fix_lines = { in_function = 3, in_file = 5, source_total = 5 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/agentscope/studio/_app.py"
function = "_delete_workflow"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-c4cc-w454-4634: AgentScope path traversal vulnerability"

[[pair]]
name = "djl-unzip-7415cc5"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "deepjavalibrary/djl"
cve = "CVE-2025-0851 GHSA-jcrp-x7w3-ffmg"
cwe = "CWE-22"
ecosystem = "maven"
published_at = "2025-01-29T22:21:33Z"
post_cutoff = false
commit = "7415cc5f72aae69ea9716a5e4f709af03a77a619"
parent = "503289a69c581e2373e12cff78ea2adc03a8d86f"
commit_url = "https://github.com/deepjavalibrary/djl/commit/7415cc5f72aae69ea9716a5e4f709af03a77a619"
vendored = false
host = "github"
path = "api/src/main/java/ai/djl/util/ZipUtils.java"
mode = "name"
relpath = "api/src/main/java/ai/djl/util/ZipUtils.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-12-06"
fix_lines = { in_function = 10, in_file = 20, source_total = 34 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "api/src/main/java/ai/djl/util/ZipUtils.java"
function = "unzip"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-jcrp-x7w3-ffmg: Deep Java Library path traversal issue"

[[pair]]
name = "carbon-resetmessages-129700e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "briannesbitt/carbon"
cve = "CVE-2025-22145 GHSA-j3f9-p6hm-5w6q"
cwe = "CWE-98"
ecosystem = "composer"
published_at = "2025-01-08T21:03:28Z"
post_cutoff = false
commit = "129700ed449b1f02d70272d2ac802357c8c30c58"
parent = "f01cfa96468f4c38325f507ab81a4f1d2cd93cfe"
commit_url = "https://github.com/briannesbitt/carbon/commit/129700ed449b1f02d70272d2ac802357c8c30c58"
vendored = false
host = "github"
path = "src/Carbon/AbstractTranslator.php"
mode = "name"
relpath = "src/Carbon/AbstractTranslator.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-12-27"
fix_lines = { in_function = 1, in_file = 2, source_total = 2 }

[[pair.expected]]
cwe = "CWE-98"
class = "file-inclusion"
path = "src/Carbon/AbstractTranslator.php"
function = "resetMessages"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-j3f9-p6hm-5w6q: Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale"

[[pair]]
name = "browsershot-seturl-e327397"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "spatie/browsershot"
cve = "CVE-2025-1026 GHSA-f2q5-6mx7-q9qq"
cwe = "CWE-22"
ecosystem = "composer"
published_at = "2025-02-05T06:30:26Z"
post_cutoff = false
commit = "e3273974506865a24fbb5b65b534d8d4b8dfbf72"
parent = "bcfd608b264fab654bf78e199bdfbb03e9323eb7"
commit_url = "https://github.com/spatie/browsershot/commit/e3273974506865a24fbb5b65b534d8d4b8dfbf72"
vendored = false
host = "github"
path = "src/Browsershot.php"
mode = "name"
relpath = "src/Browsershot.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-12-30"
fix_lines = { in_function = 3, in_file = 5, source_total = 11 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/Browsershot.php"
function = "setUrl"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-f2q5-6mx7-q9qq: Browsershot Local File Inclusion"

[[pair]]
name = "aws-sam-cli-copytree-462b4e0"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "aws/aws-sam-cli"
cve = "CVE-2025-3048 GHSA-pp64-wj43-xqcr"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-03-31T22:36:52Z"
post_cutoff = false
commit = "462b4e07b873035c25e8abc9068bb3b76e06314c"
parent = "42ba2f712a8f5084d6da9677febdcdf495d816e7"
commit_url = "https://github.com/aws/aws-sam-cli/commit/462b4e07b873035c25e8abc9068bb3b76e06314c"
vendored = false
host = "github"
path = "samcli/lib/utils/osutils.py"
mode = "name"
relpath = "samcli/lib/utils/osutils.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-02-14"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "samcli/lib/utils/osutils.py"
function = "copytree"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-pp64-wj43-xqcr: AWS SAM CLI Path Traversal allows file copy to local cache"

[[pair]]
name = "solon-find-f46e47f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "opensolon/solon"
cve = "CVE-2025-1584 GHSA-x8q6-cchr-p7m6"
cwe = "CWE-23"
ecosystem = "maven"
published_at = "2025-02-23T15:30:58Z"
post_cutoff = false
commit = "f46e47fd1f8455b9467d7ead3cdb0509115b2ef1"
parent = "87474726f1e496b381ce9d5ebbadabd0e04c2d75"
commit_url = "https://github.com/opensolon/solon/commit/f46e47fd1f8455b9467d7ead3cdb0509115b2ef1"
vendored = false
host = "github"
path = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java"
mode = "name"
relpath = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-02-21"
fix_lines = { in_function = 26, in_file = 27, source_total = 39 }

[[pair.expected]]
cwe = "CWE-23"
class = "path-traversal"
path = "solon-projects/solon-web/solon-web-staticfiles/src/main/java/org/noear/solon/web/staticfiles/StaticMappings.java"
function = "find"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-x8q6-cchr-p7m6: Solon Path Traversal"

[[pair]]
name = "setuptools-resolve-download-filename-250a6d1"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "pypa/setuptools"
cve = "CVE-2025-47273 GHSA-5rjg-fvgr-3xxf"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-05-19T16:52:43Z"
post_cutoff = false
commit = "250a6d17978f9f6ac3ac887091f2d32886fbbb0b"
parent = "d8390feaa99091d1ba9626bec0e4ba7072fc507a"
commit_url = "https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b"
vendored = false
host = "github"
path = "setuptools/package_index.py"
mode = "name"
relpath = "setuptools/package_index.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-04-19"
fix_lines = { in_function = 13, in_file = 17, source_total = 18 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "setuptools/package_index.py"
function = "_resolve_download_filename"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-5rjg-fvgr-3xxf: setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write"

[[pair]]
name = "dagster-get-notebook-data-3a3cec2"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "dagster-io/dagster"
cve = "CVE-2025-51481 GHSA-h7x8-jv97-fvvm"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-07-22T18:30:42Z"
post_cutoff = false
commit = "3a3cec2b51577c4970e6fc4c199cda6418c09a9d"
parent = "cb0f186667b55086346165fc8c00defa1f44a9c2"
commit_url = "https://github.com/dagster-io/dagster/commit/3a3cec2b51577c4970e6fc4c199cda6418c09a9d"
vendored = false
host = "github"
path = "python_modules/dagster/dagster/_grpc/impl.py"
mode = "name"
relpath = "python_modules/dagster/dagster/_grpc/impl.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-05-19"
fix_lines = { in_function = 9, in_file = 10, source_total = 11 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "python_modules/dagster/dagster/_grpc/impl.py"
function = "get_notebook_data"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-h7x8-jv97-fvvm: Dagster Local File Inclusion vulnerability"

[[pair]]
name = "llama-index-load-data-a86c96a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "run-llama/llama_index"
cve = "CVE-2025-6210 GHSA-3j8r-jf9w-5cmh"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-07-07T12:30:23Z"
post_cutoff = false
commit = "a86c96ae0e662492eeb471b658ae849a93f628ff"
parent = "1359a5300b15216766aa0ac0db0173d2016e03bf"
commit_url = "https://github.com/run-llama/llama_index/commit/a86c96ae0e662492eeb471b658ae849a93f628ff"
vendored = false
host = "github"
path = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py"
mode = "name"
relpath = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-06-03"
fix_lines = { in_function = 5, in_file = 17, source_total = 17 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "llama-index-integrations/readers/llama-index-readers-obsidian/llama_index/readers/obsidian/base.py"
function = "load_data"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-3j8r-jf9w-5cmh: LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit"

[[pair]]
name = "salt-file-recv-c4ad23f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "saltstack/salt"
cve = "CVE-2024-38824 GHSA-8pcp-r83j-fc92"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-06-13T09:30:34Z"
post_cutoff = false
commit = "c4ad23f0f3132d8d8a88f19fa537dc42cf21b215"
parent = "5ff18fd0ececdfd083ddce693c3ccef30e44f155"
commit_url = "https://github.com/saltstack/salt/commit/c4ad23f0f3132d8d8a88f19fa537dc42cf21b215"
vendored = false
host = "github"
path = "salt/master.py"
mode = "name"
relpath = "salt/master.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-06-06"
fix_lines = { in_function = 7, in_file = 4, source_total = 7 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "salt/master.py"
function = "_file_recv"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-8pcp-r83j-fc92: Salt vulnerable to directory traversal attack in file receiving method"

[[pair]]
name = "ignite-gridlogcommandhandler-5c42c7a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/ignite"
cve = "CVE-2025-48977 GHSA-v45h-mqf4-6939"
cwe = "CWE-23"
ecosystem = "maven"
published_at = "2026-05-28T12:30:28Z"
post_cutoff = false
commit = "5c42c7a303937844179ad470edb35c1ad1cee6ab"
parent = "98550a68b8eb034fd0346b4f4798c9465d8aa7c6"
commit_url = "https://github.com/apache/ignite/commit/5c42c7a303937844179ad470edb35c1ad1cee6ab"
vendored = false
host = "github"
path = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java"
mode = "name"
relpath = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-06-13"
fix_lines = { in_function = 4, in_file = 12, source_total = 17 }

[[pair.expected]]
cwe = "CWE-23"
class = "path-traversal"
path = "modules/core/src/main/java/org/apache/ignite/internal/processors/rest/handlers/log/GridLogCommandHandler.java"
function = "GridLogCommandHandler"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-v45h-mqf4-6939: Apache Ignite REST API Has a Relative Path Traversal Vulnerability"

[[pair]]
name = "ipx-resolvefile-81693dd"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "unjs/ipx"
cve = "CVE-2025-54387 GHSA-mm3p-j368-7jcr"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2025-08-04T14:48:25Z"
post_cutoff = false
commit = "81693ddbfc062cc922e4e2406e8427ab4e3ad214"
parent = "df55edb9c49bb56536cc9277efb24557edacd747"
commit_url = "https://github.com/unjs/ipx/commit/81693ddbfc062cc922e4e2406e8427ab4e3ad214"
vendored = false
host = "github"
path = "src/storage/node-fs.ts"
mode = "name"
relpath = "src/storage/node-fs.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-07-24"
fix_lines = { in_function = 2, in_file = 1, source_total = 11 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/storage/node-fs.ts"
function = "resolveFile"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-mm3p-j368-7jcr: IPX Allows Path Traversal via Prefix Matching Bypass"

[[pair]]
name = "core-download-file-fe95f6e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "home-assistant/core"
cve = "CVE-2025-65713 GHSA-pp3g-xmm4-5cw9"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-12-23T18:30:27Z"
post_cutoff = false
commit = "fe95f6e1c5ebf15da0987c1a69fc23f05cbf36cf"
parent = "37510aa316bd46dbbd8f983fbfcec543eac7c704"
commit_url = "https://github.com/home-assistant/core/commit/fe95f6e1c5ebf15da0987c1a69fc23f05cbf36cf"
vendored = false
host = "github"
path = "homeassistant/components/downloader/services.py"
mode = "name"
relpath = "homeassistant/components/downloader/services.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-08-05"
fix_lines = { in_function = 28, in_file = 38, source_total = 41 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "homeassistant/components/downloader/services.py"
function = "download_file"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-pp3g-xmm4-5cw9: Home Assistant Core before is vulnerable to Directory Traversal"

[[pair]]
name = "auth0-php-fileexists-9026da5"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "auth0/auth0-php"
cve = "CVE-2025-58769 GHSA-9mh6-g99m-ppcw"
cwe = "CWE-22"
ecosystem = "composer"
published_at = "2025-10-01T21:20:45Z"
post_cutoff = false
commit = "9026da58f5c381cd4cb5932de829eff6eacbb65c"
parent = "7f4414045fc7dc257baf8451a9cda2aacb7ed03b"
commit_url = "https://github.com/auth0/auth0-php/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c"
vendored = false
host = "github"
path = "src/Utility/Assert.php"
mode = "name"
relpath = "src/Utility/Assert.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-08-07"
fix_lines = { in_function = 6, in_file = 9, source_total = 12 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/Utility/Assert.php"
function = "fileExists"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-9mh6-g99m-ppcw: auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import"

[[pair]]
name = "tiny-scientist-review-paper-7fd4287"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "ulab-uiuc/tiny-scientist"
cve = "CVE-2025-55149 GHSA-rrgf-hcr9-jq6h"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-08-11T13:38:14Z"
post_cutoff = false
commit = "7fd42873603012acb8c55a4fc3eaac9ab18e6559"
parent = "d0d4d6ed91c378d5201ac60dcd8e7c3303412d66"
commit_url = "https://github.com/ulab-uiuc/tiny-scientist/commit/7fd42873603012acb8c55a4fc3eaac9ab18e6559"
vendored = false
host = "github"
path = "backend/app.py"
mode = "name"
relpath = "backend/app.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-08-08"
fix_lines = { in_function = 8, in_file = 10, source_total = 14 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "backend/app.py"
function = "review_paper"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-rrgf-hcr9-jq6h: TinyScientist has Path Traversal Vulnerability in PDF Review Function (CWE-22)"

[[pair]]
name = "vite-plugin-static-copy-vialocal-0bc6b49"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "sapphi-red/vite-plugin-static-copy"
cve = "CVE-2025-57753 GHSA-pp7p-q8fx-2968"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2025-08-21T14:53:52Z"
post_cutoff = false
commit = "0bc6b49ed72b46eecfc9682045f4b46a19694969"
parent = "14895079087ea926826baf62cabb4ec31cbe758a"
commit_url = "https://github.com/sapphi-red/vite-plugin-static-copy/commit/0bc6b49ed72b46eecfc9682045f4b46a19694969"
vendored = false
host = "github"
path = "src/middleware.ts"
mode = "name"
relpath = "src/middleware.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-08-21"
fix_lines = { in_function = 6, in_file = 15, source_total = 17 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/middleware.ts"
function = "viaLocal"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-pp7p-q8fx-2968: vite-plugin-static-copy files not included in `src` are possible to access with a crafted request"

[[pair]]
name = "tar-fs-incwd-0bd54cd"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "mafintosh/tar-fs"
cve = "CVE-2025-59343 GHSA-vj76-c3g6-qr5v"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2025-09-24T18:57:04Z"
post_cutoff = false
commit = "0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09"
parent = "cb1c571fba8ec6dd56340f55dcd5d284372a8249"
commit_url = "https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09"
vendored = false
host = "github"
path = "index.js"
mode = "name"
relpath = "index.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-09-16"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "index.js"
function = "inCwd"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-vj76-c3g6-qr5v: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball"

[[pair]]
name = "dosage-connect-336a968"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "webcomics/dosage"
cve = "CVE-2025-64184 GHSA-4vcx-3pj3-44m7"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2025-11-04T15:31:48Z"
post_cutoff = false
commit = "336a9684191604bc49eed7296b74bd582151181e"
parent = "8af120b2473c63fc582b9b545c86efe4369f2301"
commit_url = "https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e"
vendored = false
host = "github"
path = "dosagelib/comic.py"
mode = "name"
relpath = "dosagelib/comic.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-11-01"
fix_lines = { in_function = 11, in_file = 12, source_total = 16 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "dosagelib/comic.py"
function = "connect"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-4vcx-3pj3-44m7: Dosage vulnerable to a Directory Traversal through crafted HTTP responses"

[[pair]]
name = "unstructured-attachment-file-name-b01d35b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "unstructured-io/unstructured"
cve = "CVE-2025-64712 GHSA-gm8q-m8mv-jj5m"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-02-03T17:43:56Z"
post_cutoff = false
commit = "b01d35b2373fd087d2e15162b9c021663c97155d"
parent = "1c519efef5f888ae02ee4621b213eda527662d5f"
commit_url = "https://github.com/unstructured-io/unstructured/commit/b01d35b2373fd087d2e15162b9c021663c97155d"
vendored = false
host = "github"
path = "unstructured/partition/msg.py"
mode = "name"
relpath = "unstructured/partition/msg.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-11-06"
fix_lines = { in_function = 8, in_file = 16, source_total = 19 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "unstructured/partition/msg.py"
function = "_attachment_file_name"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-gm8q-m8mv-jj5m: Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write"

[[pair]]
name = "pebble-getfile-b3451c8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "pebbletemplates/pebble"
cve = "CVE-2025-1686 GHSA-p75g-cxfj-7wrx"
cwe = "CWE-73"
ecosystem = "maven"
published_at = "2025-02-28T19:45:03Z"
post_cutoff = false
commit = "b3451c8f305a1a248fbcc2363fd307d0baaee329"
parent = "a5a38beb9cee15546b03f0d74ff3facf51b2d181"
commit_url = "https://github.com/pebbletemplates/pebble/commit/b3451c8f305a1a248fbcc2363fd307d0baaee329"
vendored = false
host = "github"
path = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java"
mode = "name"
relpath = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-12-11"
fix_lines = { in_function = 23, in_file = 96, source_total = 135 }

[[pair.expected]]
cwe = "CWE-73"
class = "path-traversal"
path = "pebble/src/main/java/io/pebbletemplates/pebble/loader/FileLoader.java"
function = "getFile"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-p75g-cxfj-7wrx: Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro"

[[pair]]
name = "vite-plugin-react-findsourcemapurl-582fba0"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "vitejs/vite-plugin-react"
cve = "CVE-2025-68155 GHSA-g239-q96q-x4qm"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2025-12-16T22:32:26Z"
post_cutoff = false
commit = "582fba0b9a52b13fcff6beaaa3bfbd532bc5359d"
parent = "329c40a600dedc790fca36f2d460dc3d40186f7c"
commit_url = "https://github.com/vitejs/vite-plugin-react/commit/582fba0b9a52b13fcff6beaaa3bfbd532bc5359d"
vendored = false
host = "github"
path = "packages/plugin-rsc/src/plugins/find-source-map-url.ts"
mode = "name"
relpath = "packages/plugin-rsc/src/plugins/find-source-map-url.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-12-16"
fix_lines = { in_function = 5, in_file = 10, source_total = 12 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "packages/plugin-rsc/src/plugins/find-source-map-url.ts"
function = "findSourceMapURL"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-g239-q96q-x4qm: @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint"

[[pair]]
name = "bodyparser-markasmoved-143a16f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "adonisjs/bodyparser"
cve = "CVE-2026-21440 GHSA-gvq6-hvvp-h34h"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2026-01-02T18:58:32Z"
post_cutoff = false
commit = "143a16f35602be8561215611582211dec280cae6"
parent = "890b2c9820f9fdf2b2b0eaa709fecd920087e96c"
commit_url = "https://github.com/adonisjs/bodyparser/commit/143a16f35602be8561215611582211dec280cae6"
vendored = false
host = "github"
path = "src/multipart/file.ts"
mode = "name"
relpath = "src/multipart/file.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-02"
fix_lines = { in_function = 5, in_file = 5, source_total = 9 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/multipart/file.ts"
function = "markAsMoved"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-gvq6-hvvp-h34h: AdonisJS Path Traversal in Multipart File Handling"

[[pair]]
name = "pnpm-getbinsfrompackagemanifest-17432ad"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "pnpm/pnpm"
cve = "CVE-2026-24131 GHSA-v253-rj99-jwpq"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2026-01-26T21:29:58Z"
post_cutoff = false
commit = "17432ad5bbed5c2e77255ca6d56a1449bbcfd943"
parent = "b277b45bc35ae77ca72d7634d144bbd58a48b70f"
commit_url = "https://github.com/pnpm/pnpm/commit/17432ad5bbed5c2e77255ca6d56a1449bbcfd943"
vendored = false
host = "github"
path = "pkg-manager/package-bins/src/index.ts"
mode = "name"
relpath = "pkg-manager/package-bins/src/index.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-01-21"
fix_lines = { in_function = 3, in_file = 4, source_total = 4 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "pkg-manager/package-bins/src/index.ts"
function = "getBinsFromPackageManifest"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-v253-rj99-jwpq: pnpm has Path Traversal via arbitrary file permission modification "

[[pair]]
name = "wheel-unpack-7a7d2de"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "pypa/wheel"
cve = "CVE-2026-24049 GHSA-8rrh-rw8j-w5fx"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-01-22T18:02:56Z"
post_cutoff = false
commit = "7a7d2de96b22a9adf9208afcc9547e1001569fef"
parent = "41418fac233d6973ea8798d620df4aa5b3aa1b66"
commit_url = "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"
vendored = false
host = "github"
path = "src/wheel/_commands/unpack.py"
mode = "name"
relpath = "src/wheel/_commands/unpack.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-21"
fix_lines = { in_function = 4, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/wheel/_commands/unpack.py"
function = "unpack"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-8rrh-rw8j-w5fx: Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack"

[[pair]]
name = "openchatbi-save-report-372a7e8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "zhongyu09/openchatbi"
cve = "CVE-2026-28795 GHSA-vmwq-8g8c-jm79"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-03-02T21:47:32Z"
post_cutoff = false
commit = "372a7e861da5159c3106d64d6f6edf8284db8c75"
parent = "235291864f2d4aa0b40e445a00c3766001d6f3bf"
commit_url = "https://github.com/zhongyu09/openchatbi/commit/372a7e861da5159c3106d64d6f6edf8284db8c75"
vendored = false
host = "github"
path = "openchatbi/tool/save_report.py"
mode = "name"
relpath = "openchatbi/tool/save_report.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-01-27"
fix_lines = { in_function = 6, in_file = 10, source_total = 12 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "openchatbi/tool/save_report.py"
function = "save_report"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-vmwq-8g8c-jm79: OpenChatBI has a Path Traversal Vulnerability in save_report Tool"

[[pair]]
name = "clasp-fetchremote-ba6bd66"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "google/clasp"
cve = "CVE-2026-4092 GHSA-hqjg-pww4-pcgq"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2026-03-13T20:57:29Z"
post_cutoff = false
commit = "ba6bd666fe74de54950122b5d92ecf1dcc02a9d3"
parent = "56f0e6274c2daa2c0928d44fe50c517b188c11f5"
commit_url = "https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3"
vendored = false
host = "github"
path = "src/core/files.ts"
mode = "name"
relpath = "src/core/files.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-01-31"
fix_lines = { in_function = 17, in_file = 49, source_total = 54 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/core/files.ts"
function = "fetchRemote"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-hqjg-pww4-pcgq: @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script"

[[pair]]
name = "basic-ftp-downloadfromworkingdir-2a2a0e6"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "patrickjuchli/basic-ftp"
cve = "CVE-2026-27699 GHSA-5rq4-664w-9x2c"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2026-02-25T22:34:26Z"
post_cutoff = false
commit = "2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9"
parent = "65c90d949c0f8a9709759dff9e76bbe07061812b"
commit_url = "https://github.com/patrickjuchli/basic-ftp/commit/2a2a0e6514357b9eda07c2f8afbd3f04727a7cd9"
vendored = false
host = "github"
path = "src/Client.ts"
mode = "name"
relpath = "src/Client.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-23"
fix_lines = { in_function = 6, in_file = 7, source_total = 8 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/Client.ts"
function = "_downloadFromWorkingDir"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-5rq4-664w-9x2c: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method"

[[pair]]
name = "mcp-atlassian-download-attachment-52b9b09"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "sooperset/mcp-atlassian"
cve = "CVE-2026-27825 GHSA-xjgw-4wvw-rgm4"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-03-10T18:56:07Z"
post_cutoff = false
commit = "52b9b0997681e87244b20d58034deae89c91631e"
parent = "ab36f8161bba807b16964f2c6124174c9eca1acf"
commit_url = "https://github.com/sooperset/mcp-atlassian/commit/52b9b0997681e87244b20d58034deae89c91631e"
vendored = false
host = "github"
path = "src/mcp_atlassian/jira/attachments.py"
mode = "name"
relpath = "src/mcp_atlassian/jira/attachments.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-24"
fix_lines = { in_function = 6, in_file = 13, source_total = 68 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/mcp_atlassian/jira/attachments.py"
function = "download_attachment"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-xjgw-4wvw-rgm4: MCP Atlassian has an arbitrary file write leading to arbitrary code execution via unconstrained download_path in confluence_download_attachment"

[[pair]]
name = "bentoml-safe-extract-tarfile-4e0eb00"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "bentoml/bentoml"
cve = "CVE-2026-27905 GHSA-m6w7-qv66-g3mf"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-03-03T17:46:47Z"
post_cutoff = false
commit = "4e0eb007765ac04c7924220d643f264715cc9670"
parent = "3ba9d54637312aa2a9c7c35540c18c30317cac3f"
commit_url = "https://github.com/bentoml/bentoml/commit/4e0eb007765ac04c7924220d643f264715cc9670"
vendored = false
host = "github"
path = "src/bentoml/_internal/utils/filesystem.py"
mode = "name"
relpath = "src/bentoml/_internal/utils/filesystem.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-02-25"
fix_lines = { in_function = 24, in_file = 22, source_total = 24 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/bentoml/_internal/utils/filesystem.py"
function = "safe_extract_tarfile"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-m6w7-qv66-g3mf: BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction"

[[pair]]
name = "dbt-common-safe-extract-e547954"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "dbt-labs/dbt-common"
cve = "CVE-2026-29790 GHSA-w75w-9qv4-j5xj"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-03-05T00:59:10Z"
post_cutoff = false
commit = "e547954a48bac9394ef6eb98432e429dce9a7709"
parent = "e10b8aca2164c632cf0ab5fdbb16db0ec9176189"
commit_url = "https://github.com/dbt-labs/dbt-common/commit/e547954a48bac9394ef6eb98432e429dce9a7709"
vendored = false
host = "github"
path = "dbt_common/clients/system.py"
mode = "name"
relpath = "dbt_common/clients/system.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-27"
fix_lines = { in_function = 10, in_file = 9, source_total = 12 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "dbt_common/clients/system.py"
function = "safe_extract"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-w75w-9qv4-j5xj: dbt-common's commonprefix() doesn't protect against path traversal"

[[pair]]
name = "black-get-cache-key-4937fe6"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "psf/black"
cve = "CVE-2026-32274 GHSA-3936-cmfr-pm3m"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-03-12T18:33:10Z"
post_cutoff = false
commit = "4937fe6cf241139ddbfc16b0bdbb5b422798909d"
parent = "2e641d174469c505d5ae905e75d4c769597e681f"
commit_url = "https://github.com/psf/black/commit/4937fe6cf241139ddbfc16b0bdbb5b422798909d"
vendored = false
host = "github"
path = "src/black/mode.py"
mode = "name"
relpath = "src/black/mode.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-12"
fix_lines = { in_function = 7, in_file = 4, source_total = 28 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/black/mode.py"
function = "get_cache_key"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-3936-cmfr-pm3m: Black: Arbitrary file writes from unsanitized user input in cache file name"

[[pair]]
name = "agixt-safe-join-2079ea5"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "josh-xt/agixt"
cve = "CVE-2026-39981 GHSA-5gfj-64gh-mgmw"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-04-08T20:02:01Z"
post_cutoff = false
commit = "2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
parent = "872f519fcc75eb574d717ea10ca91fc089718ffe"
commit_url = "https://github.com/josh-xt/agixt/commit/2079ea5a88fa671a921bf0b5eba887a5a1b73d5f"
vendored = false
host = "github"
path = "agixt/extensions/essential_abilities.py"
mode = "name"
relpath = "agixt/extensions/essential_abilities.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-15"
fix_lines = { in_function = 14, in_file = 14, source_total = 17 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "agixt/extensions/essential_abilities.py"
function = "safe_join"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-5gfj-64gh-mgmw: AGiXT Vulnerable to Path Traversal in safe_join()"

[[pair]]
name = "mesop-make-file-path-c6b382f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "mesop-dev/mesop"
cve = "CVE-2026-33054 GHSA-8qvf-mr4w-9x2c"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-03-18T20:01:21Z"
post_cutoff = false
commit = "c6b382f363b73ac32c402a2db3aadc7784f66a5b"
parent = "712aafffd458def75e2f2fe4bd94d430436921e3"
commit_url = "https://github.com/mesop-dev/mesop/commit/c6b382f363b73ac32c402a2db3aadc7784f66a5b"
vendored = false
host = "github"
path = "mesop/server/state_session.py"
mode = "name"
relpath = "mesop/server/state_session.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-15"
fix_lines = { in_function = 7, in_file = 10, source_total = 11 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "mesop/server/state_session.py"
function = "_make_file_path"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-8qvf-mr4w-9x2c: Mesop has a Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion"

[[pair]]
name = "kedro-plugins-partition-to-path-65115f7"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "kedro-org/kedro-plugins"
cve = "CVE-2026-35492 GHSA-cjg8-h5qc-hrjv"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-04-06T17:55:14Z"
post_cutoff = false
commit = "65115f76b872217317734b6bde8927170c98fc4b"
parent = "df4b6a65ca75dbd3efed38362d2a045c746ab9ad"
commit_url = "https://github.com/kedro-org/kedro-plugins/commit/65115f76b872217317734b6bde8927170c98fc4b"
vendored = false
host = "github"
path = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py"
mode = "name"
relpath = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-18"
fix_lines = { in_function = 9, in_file = 51, source_total = 55 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "kedro-datasets/kedro_datasets/partitions/partitioned_dataset.py"
function = "_partition_to_path"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-cjg8-h5qc-hrjv: kedro-datasets has a path traversal vulnerability in PartitionedDataset that allows arbitrary file write"

[[pair]]
name = "anthropic-sdk-typescript-validatenosymlinkescape-0ac69b3"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "anthropics/anthropic-sdk-typescript"
cve = "CVE-2026-34451 GHSA-5474-4w2j-mq4c"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2026-04-01T21:16:49Z"
post_cutoff = false
commit = "0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9"
parent = "284561fe36b244f5b6ab624ec2608c07f71f476e"
commit_url = "https://github.com/anthropics/anthropic-sdk-typescript/commit/0ac69b3438ee9c96b21a7d3c39c07b7cdb6995d9"
vendored = false
host = "github"
path = "src/tools/memory/node.ts"
mode = "name"
relpath = "src/tools/memory/node.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-31"
fix_lines = { in_function = 2, in_file = 2, source_total = 4 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/tools/memory/node.ts"
function = "validateNoSymlinkEscape"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-5474-4w2j-mq4c: Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories"

[[pair]]
name = "copier-external-data-5413062"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "copier-org/copier"
cve = "CVE-2026-34730 GHSA-hgjq-p8cr-gg4h"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-04-01T22:38:39Z"
post_cutoff = false
commit = "5413062eb17b73dc885f5e645cdc161e69ef641b"
parent = "cb80a3ffc9c3787de3ed837e04ca29a0ff8ca3df"
commit_url = "https://github.com/copier-org/copier/commit/5413062eb17b73dc885f5e645cdc161e69ef641b"
vendored = false
host = "github"
path = "copier/_main.py"
mode = "name"
relpath = "copier/_main.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-31"
fix_lines = { in_function = 22, in_file = 22, source_total = 27 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "copier/_main.py"
function = "_external_data"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-hgjq-p8cr-gg4h: Copier `_external_data` allows path traversal and absolute-path local file read without unsafe mode"

[[pair]]
name = "vite-transformmiddleware-79f002f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "vitejs/vite"
cve = "CVE-2026-39365 GHSA-4w7w-66w2-5vf9"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2026-04-06T18:03:46Z"
post_cutoff = false
commit = "79f002f2286c03c88c7b74c511c7f9fc6dc46694"
parent = "a9a3df299378d9cbc5f069e3536a369f8188c8ff"
commit_url = "https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"
vendored = false
host = "github"
path = "packages/vite/src/node/server/middlewares/transform.ts"
mode = "name"
relpath = "packages/vite/src/node/server/middlewares/transform.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-06"
fix_lines = { in_function = 3, in_file = 4, source_total = 4 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "packages/vite/src/node/server/middlewares/transform.ts"
function = "transformMiddleware"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-4w7w-66w2-5vf9: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling"

[[pair]]
name = "nicegui-create-file-upload-d38a702"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "zauberzeug/nicegui"
cve = "CVE-2026-39844 GHSA-w8wv-vfpc-hw2w"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-04-08T15:04:13Z"
post_cutoff = false
commit = "d38a702e3af2da5b0708f689be8d71413fc77056"
parent = "2580928afff6e34d31b77ff22769d773feb817a8"
commit_url = "https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056"
vendored = false
host = "github"
path = "nicegui/elements/upload_files.py"
mode = "name"
relpath = "nicegui/elements/upload_files.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-07"
fix_lines = { in_function = 2, in_file = 7, source_total = 9 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "nicegui/elements/upload_files.py"
function = "create_file_upload"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-w8wv-vfpc-hw2w: NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows"

[[pair]]
name = "quarkus-openapi-generator-unzip-08b4064"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "quarkiverse/quarkus-openapi-generator"
cve = "CVE-2026-40180 GHSA-jx2w-vp7f-456q"
cwe = "CWE-22"
ecosystem = "maven"
published_at = "2026-04-08T19:14:32Z"
post_cutoff = false
commit = "08b406414ff30ed192e86c7fa924e57565534ff0"
parent = "e062c8c9fff0ff9d4f025bb77101155acf786232"
commit_url = "https://github.com/quarkiverse/quarkus-openapi-generator/commit/08b406414ff30ed192e86c7fa924e57565534ff0"
vendored = false
host = "github"
path = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java"
mode = "name"
relpath = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-07"
fix_lines = { in_function = 7, in_file = 7, source_total = 7 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "server/deployment/src/main/java/io/quarkiverse/openapi/server/generator/deployment/codegen/apicurio/ApicurioCodegenWrapper.java"
function = "unzip"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-jx2w-vp7f-456q: quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class"

[[pair]]
name = "excel-mcp-server-get-excel-path-f51340e"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "haris-musa/excel-mcp-server"
cve = "CVE-2026-40576 GHSA-j98m-w3xp-9f56"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-04-14T00:03:17Z"
post_cutoff = false
commit = "f51340ecd5778952405044b203d3a2d4c8a46833"
parent = "de4dc75f6ba629ccd2e097f5963235846be622e6"
commit_url = "https://github.com/haris-musa/excel-mcp-server/commit/f51340ecd5778952405044b203d3a2d4c8a46833"
vendored = false
host = "github"
path = "src/excel_mcp/server.py"
mode = "name"
relpath = "src/excel_mcp/server.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-12"
fix_lines = { in_function = 16, in_file = 31, source_total = 39 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/excel_mcp/server.py"
function = "get_excel_path"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-j98m-w3xp-9f56: excel-mcp-server has a Path Traversal issue"

[[pair]]
name = "psitransfer-getfilename-8b547bf"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "BSD-2-Clause"
repo = "psi-4ward/psitransfer"
cve = "CVE-2026-41180 GHSA-533q-w4g6-5586"
cwe = "CWE-22"
ecosystem = "npm"
published_at = "2026-04-16T21:13:40Z"
post_cutoff = false
commit = "8b547bf3e09757122efa00aab90281e3915aa0c6"
parent = "22ec552e6d579c1c859a9523810153289f3fb43b"
commit_url = "https://github.com/psi-4ward/psitransfer/commit/8b547bf3e09757122efa00aab90281e3915aa0c6"
vendored = false
host = "github"
path = "lib/store.js"
mode = "name"
relpath = "lib/store.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-14"
fix_lines = { in_function = 11, in_file = 10, source_total = 121 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "lib/store.js"
function = "getFilename"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-533q-w4g6-5586: PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart"

[[pair]]
name = "pptagent-get-html-table-image-418491a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "icip-cas/pptagent"
cve = "CVE-2026-42080 GHSA-pxhg-7xr2-w7xg"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-05-05T18:57:31Z"
post_cutoff = false
commit = "418491a9a1c02d9d93194b5973bb58df35cf9d00"
parent = "858da237342f4fdf9e6c3e47baaef6f44647c8f0"
commit_url = "https://github.com/icip-cas/pptagent/commit/418491a9a1c02d9d93194b5973bb58df35cf9d00"
vendored = false
host = "github"
path = "pptagent/utils.py"
mode = "name"
relpath = "pptagent/utils.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-19"
fix_lines = { in_function = 5, in_file = 25, source_total = 35 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "pptagent/utils.py"
function = "get_html_table_image"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-pxhg-7xr2-w7xg: PPTAgent: Arbitrary File Write via `save_generated_slides`"

[[pair]]
name = "pygeoapi-get-data-path-bf25b86"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "geopython/pygeoapi"
cve = "CVE-2026-42351 GHSA-f6pr-83pg-ghh6"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-04-29T22:18:02Z"
post_cutoff = false
commit = "bf25b8695edbdd5476eeffc102b633d1d3e45f52"
parent = "e80347d782ca4a076a2825920b0082701ceef909"
commit_url = "https://github.com/geopython/pygeoapi/commit/bf25b8695edbdd5476eeffc102b633d1d3e45f52"
vendored = false
host = "github"
path = "pygeoapi/provider/filesystem.py"
mode = "name"
relpath = "pygeoapi/provider/filesystem.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-20"
fix_lines = { in_function = 6, in_file = 9, source_total = 11 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "pygeoapi/provider/filesystem.py"
function = "get_data_path"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-f6pr-83pg-ghh6: pygeoapi 0.23.x: Path Traversal in STAC FileSystemProvider"

[[pair]]
name = "grav-plugin-form-uploadfiles-48bacc4"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "getgrav/grav-plugin-form"
cve = "CVE-2026-42845 GHSA-w4rc-p66m-x6qq"
cwe = "CWE-73"
ecosystem = "composer"
published_at = "2026-05-06T23:03:13Z"
post_cutoff = false
commit = "48bacc4187e1cff815000e526d5ca2878484867f"
parent = "2032e77857e4fd1662357a9411b490c6c725da43"
commit_url = "https://github.com/getgrav/grav-plugin-form/commit/48bacc4187e1cff815000e526d5ca2878484867f"
vendored = false
host = "github"
path = "classes/Form.php"
mode = "name"
relpath = "classes/Form.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-04-29"
fix_lines = { in_function = 10, in_file = 20, source_total = 21 }

[[pair.expected]]
cwe = "CWE-73"
class = "path-traversal"
path = "classes/Form.php"
function = "uploadFiles"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-w4rc-p66m-x6qq: Grav Form Plugin has an Anonymous Page Content Overwrite via Form File Upload filename Override"

[[pair]]
name = "taipy-get-resource-129fd40"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "avaiga/taipy"
cve = "CVE-2026-48544 GHSA-28gh-q3gw-pvx8"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-05-27T15:33:26Z"
post_cutoff = false
commit = "129fd407ffca49ee4ab853772c88d0c873e038dd"
parent = "d8556b92128defb4ea079e8776b1385cdc17e3fa"
commit_url = "https://github.com/avaiga/taipy/commit/129fd407ffca49ee4ab853772c88d0c873e038dd"
vendored = false
host = "github"
path = "taipy/gui/extension/library.py"
mode = "name"
relpath = "taipy/gui/extension/library.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-04-30"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "taipy/gui/extension/library.py"
function = "get_resource"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-28gh-q3gw-pvx8: Taipy contains a path traversal vulnerability"

[[pair]]
name = "jupyter-server-get-os-path-0d829f2"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "jupyter-server/jupyter_server"
cve = "CVE-2026-5422 GHSA-gf7q-q4j7-hp7c"
cwe = "CWE-23"
ecosystem = "pip"
published_at = "2026-06-02T12:31:26Z"
post_cutoff = true
commit = "0d829f2c35a481c3b24ecbe1e25a6f79954e88f2"
parent = "5869e779566352371904d0aed9407265148c0f78"
commit_url = "https://github.com/jupyter-server/jupyter_server/commit/0d829f2c35a481c3b24ecbe1e25a6f79954e88f2"
vendored = false
host = "github"
path = "jupyter_server/services/contents/fileio.py"
mode = "name"
relpath = "jupyter_server/services/contents/fileio.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-06"
fix_lines = { in_function = 5, in_file = 4, source_total = 6 }

[[pair.expected]]
cwe = "CWE-23"
class = "path-traversal"
path = "jupyter_server/services/contents/fileio.py"
function = "_get_os_path"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-gf7q-q4j7-hp7c: Duplicate Advisory: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() "

[[pair]]
name = "apm-looks-like-legacy-apm-bundle-77d1dda"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "microsoft/apm"
cve = "CVE-2026-46383 GHSA-mq5j-pw29-jcv3"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-05-15T18:25:34Z"
post_cutoff = false
commit = "77d1dda8303c8d7ccb6148788a6274fdece98499"
parent = "f85b9f54ad303159f9c448268eb7005c319fe02a"
commit_url = "https://github.com/microsoft/apm/commit/77d1dda8303c8d7ccb6148788a6274fdece98499"
vendored = false
host = "github"
path = "src/apm_cli/bundle/local_bundle.py"
mode = "name"
relpath = "src/apm_cli/bundle/local_bundle.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-05-11"
fix_lines = { in_function = 13, in_file = 12, source_total = 33 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/apm_cli/bundle/local_bundle.py"
function = "_looks_like_legacy_apm_bundle"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-mq5j-pw29-jcv3: Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`"

[[pair]]
name = "pdm-write-to-fs-41aa5f9"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "pdm-project/pdm"
cve = "CVE-2026-47764 GHSA-78v8-vpjp-cjqh"
cwe = "CWE-22"
ecosystem = "pip"
published_at = "2026-06-10T20:33:13Z"
post_cutoff = true
commit = "41aa5f94a30e51b1a460af27312dd9dc532aad5a"
parent = "904e1dded8f36fc21373db5b731a5801a6a1f2d9"
commit_url = "https://github.com/pdm-project/pdm/commit/41aa5f94a30e51b1a460af27312dd9dc532aad5a"
vendored = false
host = "github"
path = "src/pdm/installers/installers.py"
mode = "name"
relpath = "src/pdm/installers/installers.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-05-20"
fix_lines = { in_function = 12, in_file = 14, source_total = 24 }

[[pair.expected]]
cwe = "CWE-22"
class = "path-traversal"
path = "src/pdm/installers/installers.py"
function = "write_to_fs"
mechanism = "path_join_user_input"
family = "path"
evidence = "GHSA-78v8-vpjp-cjqh: PDM  wheel installation leads to Path Traversal via overridden write_to_fs"

[[pair]]
name = "serializer-decode-0943a06"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "symfony/serializer"
cve = "GHSA-j68w-pg49-f6vx"
cwe = "CWE-611"
ecosystem = "composer"
published_at = "2024-05-30T00:52:20Z"
post_cutoff = false
commit = "0943a06a663b573d7319fc1acd56d3484eaaa430"
parent = "d89f7d242d1bdf0c281bb498c840538c8071ec10"
commit_url = "https://github.com/symfony/serializer/commit/0943a06a663b573d7319fc1acd56d3484eaaa430"
vendored = false
host = "github"
path = "Encoder/XmlEncoder.php"
mode = "name"
relpath = "Encoder/XmlEncoder.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2012-02-24"
fix_lines = { in_function = 8, in_file = 11, source_total = 11 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "Encoder/XmlEncoder.php"
function = "decode"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-j68w-pg49-f6vx: Symfony XML decoding attack vector through external entities"

[[pair]]
name = "dependency-injection-parsefile-5c5040c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "symfony/dependency-injection"
cve = "GHSA-c636-cg5r-2498"
cwe = "CWE-611"
ecosystem = "composer"
published_at = "2024-05-29T19:59:13Z"
post_cutoff = false
commit = "5c5040c890a8e4085dcd6fa3827f574ab5f71f4c"
parent = "e2f9fee8ec36209fee64ee15a73fd5e0e8372652"
commit_url = "https://github.com/symfony/dependency-injection/commit/5c5040c890a8e4085dcd6fa3827f574ab5f71f4c"
vendored = false
host = "github"
path = "Loader/XmlFileLoader.php"
mode = "name"
relpath = "Loader/XmlFileLoader.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2012-08-28"
fix_lines = { in_function = 5, in_file = 5, source_total = 6 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "Loader/XmlFileLoader.php"
function = "parseFile"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-c636-cg5r-2498: Symfony XML Entity Expansion security vulnerability"

[[pair]]
name = "routing-loadfile-769e8e6"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "symfony/routing"
cve = "GHSA-rjpm-qmq7-q85w"
cwe = "CWE-611"
ecosystem = "composer"
published_at = "2024-05-30T00:49:54Z"
post_cutoff = false
commit = "769e8e6584c5d13e7c6f51aa77a9d5f977fec463"
parent = "4ff9294af0ce24d40aec58ef39b1550732586bd8"
commit_url = "https://github.com/symfony/routing/commit/769e8e6584c5d13e7c6f51aa77a9d5f977fec463"
vendored = false
host = "github"
path = "Loader/XmlFileLoader.php"
mode = "name"
relpath = "Loader/XmlFileLoader.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2012-08-28"
fix_lines = { in_function = 5, in_file = 5, source_total = 6 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "Loader/XmlFileLoader.php"
function = "loadFile"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-rjpm-qmq7-q85w: Symfony XXE security vulnerability"

[[pair]]
name = "silverstripe-seed-onbeforesecuritylogin-b065ebd"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "BSD-3-Clause"
repo = "symbiote/silverstripe-seed"
cve = "CVE-2017-20164 GHSA-wm32-3r4m-jvcc"
cwe = "CWE-601"
ecosystem = "composer"
published_at = "2023-01-07T21:30:38Z"
post_cutoff = false
commit = "b065ebd82da53009d273aa7e989191f701485244"
parent = "573d695aa7ed4d68c70cc3d2de3728051b4b495d"
commit_url = "https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244"
vendored = false
host = "github"
path = "code/extensions/SecurityLoginExtension.php"
mode = "name"
relpath = "code/extensions/SecurityLoginExtension.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2017-02-16"
fix_lines = { in_function = 2, in_file = 1, source_total = 2 }

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "code/extensions/SecurityLoginExtension.php"
function = "onBeforeSecurityLogin"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-wm32-3r4m-jvcc: Symbiote Seed Open Redirect vulnerability"

[[pair]]
name = "urllib3-init-adb358f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "urllib3/urllib3"
cve = "CVE-2018-25091 GHSA-gwvm-45gx-3cf8"
cwe = "CWE-601"
ecosystem = "pip"
published_at = "2023-10-15T21:30:26Z"
post_cutoff = false
commit = "adb358f8e06865406d1f05e581a16cbea2136fbc"
parent = "a252e2549ff797fe13e688f05296fa496e0c469a"
commit_url = "https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc"
vendored = false
host = "github"
path = "src/urllib3/util/retry.py"
mode = "name"
relpath = "src/urllib3/util/retry.py"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2018-12-29"
fix_lines = { in_function = 3, in_file = 2, source_total = 10 }

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "src/urllib3/util/retry.py"
function = "__init__"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-gwvm-45gx-3cf8: Authorization Header forwarded on redirect"

[[pair]]
name = "seotools-maketag-ca27cd0"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "artesaos/seotools"
cve = "CVE-2020-36665 GHSA-w2x5-hpmg-j98h"
cwe = "CWE-601"
ecosystem = "composer"
published_at = "2023-07-06T19:24:11Z"
post_cutoff = false
commit = "ca27cd0edf917e0bc805227013859b8b5a1f01fb"
parent = "445c0bf0ddbd7cdc271d2887d25009a0e1ff2cb6"
commit_url = "https://github.com/artesaos/seotools/commit/ca27cd0edf917e0bc805227013859b8b5a1f01fb"
vendored = false
host = "github"
path = "src/SEOTools/OpenGraph.php"
mode = "name"
relpath = "src/SEOTools/OpenGraph.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2020-04-02"
fix_lines = { in_function = 1, in_file = 1, source_total = 5 }

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "src/SEOTools/OpenGraph.php"
function = "makeTag"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-w2x5-hpmg-j98h: Artesãos SEOTools Open Redirect vulnerability"

[[pair]]
name = "axmlrpc-parse-ad6615b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "MIT"
repo = "gturri/axmlrpc"
cve = "CVE-2020-36641 GHSA-g4r8-28fp-f255"
cwe = "CWE-611"
ecosystem = "maven"
published_at = "2023-01-05T12:30:27Z"
post_cutoff = false
commit = "ad6615b3ec41353e614f6ea5fdd5b046442a832b"
parent = "2e59d03c961607d32bc9dc5e7aba931338907603"
commit_url = "https://github.com/gturri/axmlrpc/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b"
vendored = false
host = "github"
path = "src/main/java/de/timroes/axmlrpc/ResponseParser.java"
mode = "name"
relpath = "src/main/java/de/timroes/axmlrpc/ResponseParser.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2020-10-15"
fix_lines = { in_function = 6, in_file = 10, source_total = 11 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "src/main/java/de/timroes/axmlrpc/ResponseParser.java"
function = "parse"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-g4r8-28fp-f255: aXMLRPC XML External Entity vulnerability"

[[pair]]
name = "neo4j-apoc-procedures-parsexml-c3e2a29"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "neo4j-contrib/neo4j-apoc-procedures"
cve = "GHSA-9vx8-f5c4-862x"
cwe = "CWE-611"
ecosystem = "maven"
published_at = "2023-02-24T17:39:18Z"
post_cutoff = false
commit = "c3e2a29020497acf9417879f38e8af4e8c6d5783"
parent = "1b60237168679daed62edcdb1260d5fc790329ab"
commit_url = "https://github.com/neo4j-contrib/neo4j-apoc-procedures/commit/c3e2a29020497acf9417879f38e8af4e8c6d5783"
vendored = false
host = "github"
path = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java"
mode = "name"
relpath = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-02-13"
fix_lines = { in_function = 9, in_file = 13, source_total = 13 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "core/src/main/java/apoc/export/graphml/XmlGraphMLReader.java"
function = "parseXML"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-9vx8-f5c4-862x: XML External Entity (XXE) vulnerability in apoc.import.graphml"

[[pair]]
name = "keycloak-nodejs-connect-forcechecksso-190a947"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "keycloak/keycloak-nodejs-connect"
cve = "CVE-2022-2237 GHSA-59fq-727j-hm3f"
cwe = "CWE-601"
ecosystem = "npm"
published_at = "2023-03-02T23:21:02Z"
post_cutoff = false
commit = "190a9470e234bbd9ac5d5de43f5a19aead9a2c21"
parent = "e4bd6b7bc8116432bf8fde87c5f06417005f88ea"
commit_url = "https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21"
vendored = false
host = "github"
path = "middleware/check-sso.js"
mode = "name"
relpath = "middleware/check-sso.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-03-01"
fix_lines = { in_function = 2, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "middleware/check-sso.js"
function = "forceCheckSSO"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-59fq-727j-hm3f: keycloak-connect contains Open redirect vulnerability in the Node.js adapter"

[[pair]]
name = "mstest-plugin-containsdata-f9b9b0c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "MIT"
repo = "jenkinsci/mstest-plugin"
cve = "CVE-2023-24441 GHSA-3ppr-72x5-x67q"
cwe = "CWE-611"
ecosystem = "maven"
published_at = "2023-01-26T21:30:18Z"
post_cutoff = false
commit = "f9b9b0cbdf7559fdd8fc4004e5a242f5801daa67"
parent = "3870f53d9d1ab5759ab82a44c8d6b4ca9d933923"
commit_url = "https://github.com/jenkinsci/mstest-plugin/commit/f9b9b0cbdf7559fdd8fc4004e5a242f5801daa67"
vendored = false
host = "github"
path = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java"
mode = "name"
relpath = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-06-16"
fix_lines = { in_function = 6, in_file = 15, source_total = 20 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "src/main/java/hudson/plugins/mstest/MSTestReportConverter.java"
function = "containsData"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-3ppr-72x5-x67q: XML external entity vulnerability on agents in Jenkins MSTest Plugin "

[[pair]]
name = "drill-xmlreader-0e88b7a"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/drill"
cve = "CVE-2023-48362 GHSA-v62g-jwj9-rfvx"
cwe = "CWE-611"
ecosystem = "maven"
published_at = "2024-07-24T09:30:40Z"
post_cutoff = false
commit = "0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3"
parent = "097da744ff416bda7bd6e83df3d7b3f31369c42e"
commit_url = "https://github.com/apache/drill/commit/0e88b7a5101d24c561a2a3efb12d7a3b3f7933f3"
vendored = false
host = "github"
path = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java"
mode = "name"
relpath = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2023-11-06"
fix_lines = { in_function = 1, in_file = 3, source_total = 3 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "contrib/format-xml/src/main/java/org/apache/drill/exec/store/xml/XMLReader.java"
function = "XMLReader"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-v62g-jwj9-rfvx: XML External Entity Reference (XXE) in the XML Format Plugin in Apache Drill"

[[pair]]
name = "axis-axis1-java-getservice-685c309"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "apache/axis-axis1-java"
cve = "CVE-2023-51441 GHSA-hr2c-p8rh-238h"
cwe = "CWE-918"
ecosystem = "maven"
published_at = "2024-01-06T12:30:34Z"
post_cutoff = false
commit = "685c309febc64aa393b2d64a05f90e7eb9f73e06"
parent = "e84c60c1f0764b01577d62c9e6453457d523ee77"
commit_url = "https://github.com/apache/axis-axis1-java/commit/685c309febc64aa393b2d64a05f90e7eb9f73e06"
vendored = false
host = "github"
path = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java"
mode = "name"
relpath = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2023-12-18"
fix_lines = { in_function = 3, in_file = 7, source_total = 8 }

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "axis-rt-core/src/main/java/org/apache/axis/client/ServiceFactory.java"
function = "getService"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-hr2c-p8rh-238h: Apache Axis Improper Input Validation vulnerability"

[[pair]]
name = "cyclonedx-javascript-library-getparser-5e5e1e0"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "cyclonedx/cyclonedx-javascript-library"
cve = "CVE-2024-34345 GHSA-38gf-rh2w-gmj7"
cwe = "CWE-611"
ecosystem = "npm"
published_at = "2024-05-08T19:55:37Z"
post_cutoff = false
commit = "5e5e1e0b9422f47d2de81c7c4064b803a01e7203"
parent = "974c5585dac0428f2863459b215a3dc2951421a6"
commit_url = "https://github.com/cyclonedx/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203"
vendored = false
host = "github"
path = "src/validation/xmlValidator.node.ts"
mode = "name"
relpath = "src/validation/xmlValidator.node.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2024-05-07"
fix_lines = { in_function = 3, in_file = 2, source_total = 3 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "src/validation/xmlValidator.node.ts"
function = "getParser"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-38gf-rh2w-gmj7: @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability"

[[pair]]
name = "fhir-ig-publisher-loadmappingspaces-3560de2"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "hl7/fhir-ig-publisher"
cve = "CVE-2024-52807 GHSA-8c3x-hq82-gjcm"
cwe = "CWE-611"
ecosystem = "maven"
published_at = "2025-01-24T18:33:29Z"
post_cutoff = false
commit = "3560de2f486d688a3ddcf4aa54d8bdacea380c3d"
parent = "ba0b48d4ddb4dbffb45e0d45c43069e99a038385"
commit_url = "https://github.com/hl7/fhir-ig-publisher/commit/3560de2f486d688a3ddcf4aa54d8bdacea380c3d"
vendored = false
host = "github"
path = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java"
mode = "name"
relpath = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2024-11-19"
fix_lines = { in_function = 2, in_file = 1, source_total = 6 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java"
function = "loadMappingSpaces"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-8c3x-hq82-gjcm: XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher`"

[[pair]]
name = "fedify-lookupwebfinger-8be3c20"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "dahlia/fedify"
cve = "CVE-2025-23221 GHSA-c59p-wq67-24wx"
cwe = "CWE-918"
ecosystem = "npm"
published_at = "2025-01-21T19:58:29Z"
post_cutoff = false
commit = "8be3c2038eebf4ae12481683a1e809b314be3151"
parent = "c505eb82fcd6b5b17174c6659c29721bc801ab9a"
commit_url = "https://github.com/dahlia/fedify/commit/8be3c2038eebf4ae12481683a1e809b314be3151"
vendored = false
host = "github"
path = "src/webfinger/lookup.ts"
mode = "name"
relpath = "src/webfinger/lookup.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-01-18"
fix_lines = { in_function = 1, in_file = 2, source_total = 2 }

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "src/webfinger/lookup.ts"
function = "lookupWebFinger"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-c59p-wq67-24wx: Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify"

[[pair]]
name = "local-s3-createservicefactory-d6ed756"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "robothy/local-s3"
cve = "GHSA-47qw-ccjm-9c2c"
cwe = "CWE-611"
ecosystem = "maven"
published_at = "2025-03-10T18:29:36Z"
post_cutoff = false
commit = "d6ed756ceb30c1eb9d4263321ac683d734f8836f"
parent = "009901882be8b543e85b67c5ec2e9f30d83d62ef"
commit_url = "https://github.com/robothy/local-s3/commit/d6ed756ceb30c1eb9d4263321ac683d734f8836f"
vendored = false
host = "github"
path = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java"
mode = "name"
relpath = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-02-24"
fix_lines = { in_function = 2, in_file = 3, source_total = 5 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "local-s3-rest/src/main/java/com/robothy/s3/rest/LocalS3.java"
function = "createServiceFactory"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-47qw-ccjm-9c2c: LocalS3 XML Parser Vulnerable to XML External Entity (XXE) Injection"

[[pair]]
name = "webdrivermanager-loadxml-125646b"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "java"
origin = "github-advisory"
license = "Apache-2.0"
repo = "bonigarcia/webdrivermanager"
cve = "CVE-2025-4641 GHSA-pwm3-776c-8q7q"
cwe = "CWE-611"
ecosystem = "maven"
published_at = "2025-05-14T21:31:18Z"
post_cutoff = false
commit = "125646bd53855cf5de99fd4bc501b3604c151c9b"
parent = "0f14b3fc93cdfb58b24f419ce28ca08955aac964"
commit_url = "https://github.com/bonigarcia/webdrivermanager/commit/125646bd53855cf5de99fd4bc501b3604c151c9b"
vendored = false
host = "github"
path = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java"
mode = "name"
relpath = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-04-07"
fix_lines = { in_function = 3, in_file = 6, source_total = 6 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java"
function = "loadXML"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-pwm3-776c-8q7q: BoniGarcia WebDriverManager Affected By Improper Restriction of XML External Entity Reference"

[[pair]]
name = "workers-oauth-provider-parseauthrequest-66de8d8"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "cloudflare/workers-oauth-provider"
cve = "CVE-2025-4143 GHSA-4pc9-x2fx-p7vj"
cwe = "CWE-601"
ecosystem = "npm"
published_at = "2025-05-01T17:00:29Z"
post_cutoff = false
commit = "66de8d802c1d7c468887906ea1a0769a975ff1e3"
parent = "3e3d0bfea19a5bf444423fc88622e65d6c14fad0"
commit_url = "https://github.com/cloudflare/workers-oauth-provider/commit/66de8d802c1d7c468887906ea1a0769a975ff1e3"
vendored = false
host = "github"
path = "src/oauth-provider.ts"
mode = "name"
relpath = "src/oauth-provider.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-04-30"
fix_lines = { in_function = 10, in_file = 34, source_total = 50 }

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "src/oauth-provider.ts"
function = "parseAuthRequest"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-4pc9-x2fx-p7vj: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint"

[[pair]]
name = "langroid-extract-field-values-36e7e7d"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "MIT"
repo = "langroid/langroid"
cve = "CVE-2025-46726 GHSA-pw95-88fg-3j6f"
cwe = "CWE-611"
ecosystem = "pip"
published_at = "2025-05-05T20:40:44Z"
post_cutoff = false
commit = "36e7e7db4dd1636de225c2c66c84052b1e9ac3c3"
parent = "eca5c0677ee27acf71b7ff68e69576135769a2fb"
commit_url = "https://github.com/langroid/langroid/commit/36e7e7db4dd1636de225c2c66c84052b1e9ac3c3"
vendored = false
host = "github"
path = "langroid/agent/xml_tool_message.py"
mode = "name"
relpath = "langroid/agent/xml_tool_message.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-05-03"
fix_lines = { in_function = 7, in_file = 11, source_total = 18 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "langroid/agent/xml_tool_message.py"
function = "extract_field_values"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-pw95-88fg-3j6f: Langroid Allows XXE Injection via XMLToolMessage"

[[pair]]
name = "math-read-fc31c8f"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "phpoffice/math"
cve = "CVE-2025-48882 GHSA-42hm-pq2f-3r7m"
cwe = "CWE-611"
ecosystem = "composer"
published_at = "2025-05-29T17:27:39Z"
post_cutoff = false
commit = "fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a"
parent = "6ea0c8140b9597b11127233c381f2d5d90f01265"
commit_url = "https://github.com/phpoffice/math/commit/fc31c8f57a7a81f962cbf389fd89f4d9d06fc99a"
vendored = false
host = "github"
path = "src/Math/Reader/MathML.php"
mode = "name"
relpath = "src/Math/Reader/MathML.php"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-05-29"
fix_lines = { in_function = 3, in_file = 11, source_total = 96 }

[[pair.expected]]
cwe = "CWE-611"
class = "xxe"
path = "src/Math/Reader/MathML.php"
function = "read"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-42hm-pq2f-3r7m: PHPOffice Math allows XXE when processing an XML file in the MathML format "

[[pair]]
name = "datasette-handle-404-f257ca6"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "python"
origin = "github-advisory"
license = "Apache-2.0"
repo = "simonw/datasette"
cve = "CVE-2025-64481 GHSA-w832-gg5g-x44m"
cwe = "CWE-601"
ecosystem = "pip"
published_at = "2025-11-06T15:13:33Z"
post_cutoff = false
commit = "f257ca6edb64848c3b04b54d41e347c54fe57c05"
parent = "295e4a2e87464fc1838d6278308bf151bc14ba73"
commit_url = "https://github.com/simonw/datasette/commit/f257ca6edb64848c3b04b54d41e347c54fe57c05"
vendored = false
host = "github"
path = "datasette/app.py"
mode = "name"
relpath = "datasette/app.py"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2025-11-05"
fix_lines = { in_function = 1, in_file = 5, source_total = 5 }

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "datasette/app.py"
function = "handle_404"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-w832-gg5g-x44m: Open redirect endpoint in Datasette"

[[pair]]
name = "fastify-reply-from-buildurl-4d9795c"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "javascript"
origin = "github-advisory"
license = "MIT"
repo = "fastify/fastify-reply-from"
cve = "CVE-2025-66415 GHSA-2q7r-29rg-6m5h"
cwe = "CWE-441"
ecosystem = "npm"
published_at = "2025-12-02T00:38:57Z"
post_cutoff = false
commit = "4d9795cd5b57a36756d37b7f036eae369f69fa66"
parent = "79ff1d2496d9496c59d5b392a18ce220c2d82b3f"
commit_url = "https://github.com/fastify/fastify-reply-from/commit/4d9795cd5b57a36756d37b7f036eae369f69fa66"
vendored = false
host = "github"
path = "lib/utils.js"
mode = "name"
relpath = "lib/utils.js"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2025-12-01"
fix_lines = { in_function = 5, in_file = 6, source_total = 10 }

[[pair.expected]]
cwe = "CWE-441"
class = "ssrf"
path = "lib/utils.js"
function = "buildURL"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-2q7r-29rg-6m5h: fastify-reply-from affected by bypass of reply forwarding"

[[pair]]
name = "angular-cli-joinurlparts-f086ecc"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "MIT"
repo = "angular/angular-cli"
cve = "CVE-2026-27738 GHSA-xh43-g2fq-wjrj"
cwe = "CWE-601"
ecosystem = "npm"
published_at = "2026-02-25T22:41:57Z"
post_cutoff = false
commit = "f086eccc36d10cf01c426e35864bc32e1e292323"
parent = "6cf621c905de4815b1e12964fb909876ca6e3ea3"
commit_url = "https://github.com/angular/angular-cli/commit/f086eccc36d10cf01c426e35864bc32e1e292323"
vendored = false
host = "github"
path = "packages/angular/ssr/src/utils/url.ts"
mode = "name"
relpath = "packages/angular/ssr/src/utils/url.ts"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-02-23"
fix_lines = { in_function = 19, in_file = 15, source_total = 36 }

[[pair.expected]]
cwe = "CWE-601"
class = "open_redirect"
path = "packages/angular/ssr/src/utils/url.ts"
function = "joinUrlParts"
mechanism = "validation_strength"
family = "untrusted_destination"
evidence = "GHSA-xh43-g2fq-wjrj: Angular SSR has an Open Redirect via X-Forwarded-Prefix"

[[pair]]
name = "backstage-fetchcimdmetadata-17038ab"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "typescript"
origin = "github-advisory"
license = "Apache-2.0"
repo = "backstage/backstage"
cve = "CVE-2026-32236 GHSA-qp4c-xg64-7c6x"
cwe = "CWE-918"
ecosystem = "npm"
published_at = "2026-03-12T14:51:02Z"
post_cutoff = false
commit = "17038abf2dfdb4abc08a59b1c95af39851de0e07"
parent = "3b62dd2d6bf7623ebd23e4b5a6dceb209f98dfce"
commit_url = "https://github.com/backstage/backstage/commit/17038abf2dfdb4abc08a59b1c95af39851de0e07"
vendored = false
host = "github"
path = "plugins/auth-backend/src/service/CimdClient.ts"
mode = "name"
relpath = "plugins/auth-backend/src/service/CimdClient.ts"
provenance = "agent"
split = "train"
review_tier = "advisory"
fix_date = "2026-03-11"
fix_lines = { in_function = 1, in_file = 1, source_total = 1 }

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "plugins/auth-backend/src/service/CimdClient.ts"
function = "fetchCimdMetadata"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-qp4c-xg64-7c6x: @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch"

[[pair]]
name = "core-bundle-dev-app-fromurl-7904f69"
slice = "advisory-fixes"
batch = "2026-10-04"
language = "php"
origin = "github-advisory"
license = "MIT"
repo = "roadiz/core-bundle-dev-app"
cve = "CVE-2026-33486 GHSA-rc55-58f4-687g"
cwe = "CWE-918"
ecosystem = "composer"
published_at = "2026-03-23T21:43:14Z"
post_cutoff = false
commit = "7904f690a51b88b1c72c02149ebdf85fa81f19f2"
parent = "17ddb5934cdfe9aa617707081ca4765dc988b1d6"
commit_url = "https://github.com/roadiz/core-bundle-dev-app/commit/7904f690a51b88b1c72c02149ebdf85fa81f19f2"
vendored = false
host = "github"
path = "lib/Documents/src/DownloadedFile.php"
mode = "name"
relpath = "lib/Documents/src/DownloadedFile.php"
provenance = "agent"
split = "holdout"
review_tier = "advisory"
fix_date = "2026-03-19"
fix_lines = { in_function = 17, in_file = 74, source_total = 75 }

[[pair.expected]]
cwe = "CWE-918"
class = "ssrf"
path = "lib/Documents/src/DownloadedFile.php"
function = "fromUrl"
mechanism = "source_reaches_sink"
family = "untrusted_destination"
evidence = "GHSA-rc55-58f4-687g: Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents"