marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
caa56387a1900f7b349fdf80008d9c76747ad882
Open_Ultra_SAST/benchmarks/valid/train/verification.json
T
Marius CiepluchandClaude Opus 5.5 2b65680d5d data: hunt training-set candidates (task 4.1), not frozen: 99 verified locations in 28 changes, awaiting spot-check 
Sourced apart from the 12 pilot repositories: 212 candidates (pool-fresh, pool-retry, OSV for PyPI,
npm, Maven and Packagist), 49 dropped because the benchmarks already name their repository, 413
catalog locations, 99 passing all three verifier checks in 28 repositories. Short of the 40-positive
target. catalog.py now reads .java and .php. Freeze waits on the maintainer's spot-check
(CANDIDATES.md, SOURCING.md).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-13 16:48:41 +02:00

4961 lines
174 KiB
JSON
Raw Blame History

{
"cases": [
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "acacode-swagger-typescript-api-c4257c99ff0cfe5f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "swagger-typescript-api CLI/generateApi() consuming an attacker-controlled OpenAPI spec path (e.g. `sta generate --url https://attacker.example/openapi.json`); the injected `${...}` in the spec path is interpolated into the generated method's `path: \\`...\\`` template literal and evaluated when the generated method is called.",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "acacode-swagger-typescript-api-e64e7a7e89c832b6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "lazybeforeunveil event handler reading data-vimeo/data-vimeoparams attributes from DOM elements",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "afarkas-lazysizes-7b62735d3e5d1714",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "lazybeforeunveil event handler / click handler on element with data-youtube attribute",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "afarkas-lazysizes-99fc6cf6e6f1f846",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "next-intl middleware with localePrefix: 'as-needed' (external application middleware, not a concrete in-repo route/handler)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "amannn-next-intl-10fdf55408ba9a03",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "startWebServer -> app.listen(PORT) binding all interfaces; HTTP routes GET /api/documents, POST /api/documents, DELETE /api/documents/:id, POST /api/search-all, GET /api/config",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "andrea9293-mcp-documentation-server-0913a4303cf82c9a",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "parse() in source/modules/database/custom/index.js, invoked from database config UI; data source is shell-findOne IPC result (info['database'])",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-0abdb762876f58b3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "modules/database/php/index.js parse() rendering database config tree text",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-4b97e82397da81ee",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "checkprobe() invoked from database module UI; data source is remote server response via that.drive.core.request(that.drive.core.base.probedb())",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-98183d78558cfa95",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "parse() in modules/database/asp/index.js reading database config via ipcRenderer shell-findOne",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "antswordproject-antsword-b0cec123d7799276",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "SearchLayoutView.renderTypeTagList / getFilterBox (Backbone Marionette view rendering search type/tag dropdowns)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-0ba0aadbe86a1987",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-10c9d446ebf3bb21",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SearchResultLayoutView.getFixedDslColumn / getDaynamicColumns formatters rendering entity attributes via Backgrid Html cells; source is search API response entity attributes (e.g. name, typeName, custom attributes) rendered into DOM",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-3f751971e2a63d2e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Header view onRender: that.$('.userName').html(Globals.userLogedIn.response.userName) renders the authenticated user's userName via .html() (DOM XSS sink); source is the logged-in user's userName from the login response, reachable when the Header view renders after authentication.",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-42a370a3cdec7d12",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "React route /search/searchResult (FilterQuery component); source: URL query string via location.search / URLSearchParams, attacker-controlled filter params (type, tag, relationshipName, entityFilters, tagFilters, relationshipFilters) rendered into Chip labels",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-4c582bc549c555a1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.15,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-5373cc60e39f63cb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "sanitizeHtmlContent (dashboard/src/utils/Utils.ts)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-7f7bd8d16a1151b1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Backbone Marionette view RelationSearchResultLayoutView rendering relationship search results; data from relationship search API (getBasicRearchResult/fetch) flows into Backgrid Html cell formatters (e.g. col['label'], col['typeName'], col['name']) that build HTML strings without escaping, enabling stored XSS for an authenticated user.",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-940ab56a7aadcda1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ShowMoreText React component (dashboard/src/components/ShowMore/ShowMoreText.tsx)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-9ddeccc45a8bbeb5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "HtmlRenderer React component (htmlString prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-ea6cfd8c8ed3e117",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CommonViewFunction.propertyTable / fetchInputOutputValue (dashboardv2/public/js/utils/CommonViewFunction.js)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-atlas-eec08160065d0b9b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-atlas-f8d76d90d767826b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SpecificCompiler.javaSplit (invoked via SpecificCompiler.compileSchema / velocity template generation from untrusted Avro schema)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-avro-1c1ac5d9361c069c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SpecificCompiler.javaEscape via javaSplit during specific record generation from untrusted Avro schemas",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-avro-1d43772609028459",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SpecificCompiler.javaAnnotations(JsonProperties) invoked during SpecificCompiler code generation from Avro schema JSON (javaAnnotation property)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-avro-f133a25fc910fb31",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "execute_sql_query(sql, connection_manager, **kwargs) MCP tool convenience function",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-doris-mcp-server-58f237c099a19c43",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-0209dc8ff7a5a0b9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-203931cda95af8bc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-29fe382661669370",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-35b46d5635d33c30",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-46458e154673da1a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-5b201fbf15fe43ca",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-68401dcb84d645a6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-6ff76988cae7dfa5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-8083f17f7cbadd46",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-9a97c39706187df2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-9c4ae45efeed53a7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.1,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-a05c81da5a0b21df",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-a176addda844a7ce",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "getLessSpecificLocale(Locale) called during localized template lookup with attacker-controlled locale identifier",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-a74ec0787d3280ea",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-a765c68d84f2b828",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-aace5c9941b635b3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-c0f61114ff3ab48a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-cf639b1623d15342",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-cfc58a253de5f6bd",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-d058151619a90d08",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-d260924010aace8a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "TemplateCache.lookupWithLocalizedThenAcquisitionStrategy (invoked via Configuration.getTemplate with attacker-controlled Locale)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-freemarker-d3c7bc0ea1b565c4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-d4b9c3b8b1a5b2c3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-eb721acc4b96dd7f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-eb9b0fff47e5400b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.1,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-f10a2c2cfda93e16",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-f5ba78c9c91de7a1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-f78f7186c5610790",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-freemarker-fabd1840fb3c1eed",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "JMXConnector.doStart() invoked via GBean lifecycle during server startup; JMX connector accepts remote RMI connections",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-geronimo-0779e8a19c60e8ad",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "JMXSecureConnector.doStart (JMX connector server startup)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-geronimo-469d656c92e703bc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "JMSSource.doProcess (JMS Source configured via Flume agent config providerUrl)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-logging-flume-2f03541bca7f3237",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "JMSSource.doConfigure via providerUrl configuration parameter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-logging-flume-3a9f6e6ef1ab1349",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "JMSMessageConsumer constructor via JMSSource providerUrl configuration (initialContext.lookup(destinationName))",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-logging-flume-9dd9e4ee8d0de85f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-pdfbox-11311474dc9fddbd",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() flows into extractFile(filePath, filename, embeddedFile)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-3dc4e739d0307166",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "main(String[] args) CLI: args[0] PDF file path; embedded file names from PDComplexFileSpecification.getFilename() flow into extractFile",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-56ad35de6b5478ab",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "ExtractEmbeddedFiles.main(String[] args) CLI argument args[0] (PDF file path); embedded filename from PDComplexFileSpecification.getFilename() in PDF content reaches extractFile",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-7d8d6513c163f5fe",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ExtractEmbeddedFiles example main() CLI argument (PDF file path); filename from PDComplexFileSpecification.getFilename() concatenated into extraction path",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "apache-pdfbox-d700dd5c8843f12c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ExtractEmbeddedFiles example main() CLI argument (PDF file path); filename from PDComplexFileSpecification.getFilename() appended to extraction path in extractFile",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-pdfbox-f03695e9a3bbfb76",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "IAlarmQueryDAO.getAlarm (keyword parameter)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-2290116e5febf3c6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "queryBasicTraces (ITraceQueryDAO) invoked via GraphQL trace query; endpointName parameter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-5eb8d566abf7ce37",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "searchEndpoint(keyword, serviceId, limit) - keyword concatenated into SQL LIKE clause; no in-repo HTTP route or CLI argument shown in provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-80e3e3e53c0f37a0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "IAlarmQueryDAO.getAlarm (keyword parameter) invoked via alarm query GraphQL/REST handler; no concrete in-repo route or attacker-controlled source shown in provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-9ea0241fb2a1d2cc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "searchServices(keyword) via metadata query API",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "apache-skywalking-a7df135a93d33dbc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "arc\\url\\Url::__construct($url)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "ariadne-cms-arc-web-dedc841aa3fcd892",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "WxCryptUtil.extractEncryptPart(String xml) via BUILDER_LOCAL DocumentBuilder",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "binarywang-wxjava-81c6bfb8c7d2780a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "BaseWxPayResult.getXmlDoc() parsing attacker-supplied xmlString (e.g., via toMap/getXmlValue), but no concrete in-repo HTTP handler or CLI route is shown in the provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "binarywang-wxjava-bb0f4f6e3747df3f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Vue component render (b-table caption prop) - no in-repo route/handler/CLI source established",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-07356b6e97b97bc0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "b-pagination component prop ellipsisText / firstText rendered via domProps innerHTML in makeEllipsis",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-28832e100e7f287c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Vue component render function (b-table) using this.caption prop bound to innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-28e8c5390cd69d63",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-nav-item-dropdown component render (text prop via innerHTML)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-4956693c54c51e2d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "makeEndBtns render function in src/mixins/pagination.js (btnText via props/slots)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-5c23596323e6b8a9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "pageLinkClasses (page) method in src/mixins/pagination.js",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-62335f9ab1503cb8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "formOptions computed property in src/mixins/form-options.js (options prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-63c25165cde74e91",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "b-dropdown component render function (this.text prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-89a979a090308f7b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "render() in src/components/progress/progress-bar.js via the `label` prop rendered with domProps.innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-961a13bdb159074a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "card-body component render function via title/subTitle props",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-9cb0f01421a910d4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-form-group render function (label prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-a3dc3bb9b99618da",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-dropdown component render (this.text prop)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-ad0ba8cae6e3210c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "jumbotron component render function (props.header / props.lead)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-afa3ef454d76061d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "bootstrap-vue InputGroup component render function (props.prepend / props.append)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-b376dace0b85c60c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "render (h) in src/components/modal/modal.js; title prop rendered via h(this.titleTag, ...) without sanitization",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-b7c3ceceb8ee2f53",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "b-table component render() -> makeHeadCells() using field.label via domProps.innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "bootstrap-vue-bootstrap-vue-f1906edae2e32153",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "codecov/__init__.py:main() CLI entry point; attacker-controlled source: --gcov-args / --gcov-exec / --gcov-root CLI arguments (argparse) flowing into cmd string passed to try_to_run (popen)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "codecov-codecov-python-261567376b9ecd8e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "WebPageLoader.load(source_content) via crewai_tools.rag loaders; source is SourceContent.source URL supplied by the caller",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-0c90e759dac62125",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "DOCXLoader.load -> _download_from_url (source_content.source_ref URL)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-3736ee46eb9984b5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "DocsSiteLoader.load(source) via source.source URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-4591ac4ce34038bb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "PDFLoader.load(source) -> _download_from_url(url, kwargs)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "crewaiinc-crewai-4a0af130f248da07",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "MCP tool git_clone (gitCloneLogic) invoked via MCP tools/call with attacker-controlled input.targetPath/repositoryUrl/branch reaching child_process.exec",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyanheads-git-mcp-server-07d42f8af21c4e1d",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "MCP tool git_init (gitInitLogic) invoked via tools/call with input.initialBranch",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyanheads-git-mcp-server-3c306de22fb76061",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "EmailTermsView at url /terms/email; GET parameter returnTo flows via get_initial into form initial, then form_valid sets self.success_url from form.cleaned_data['returnTo'] without validation, causing open redirect",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-1b3a86185cb651c3",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "AcceptTermsView.post at URL /terms/accept, reading request.POST['returnTo']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-387ba4069e5df737",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /terms/accept/ with returnTo parameter handled by termsandconditions/views.py returnTo function",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-8ee6351ba4d07811",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /terms/accept/ with returnTo parameter (termsandconditions/views.py returnTo function)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-95885d31451074da",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "AcceptTermsView at url /terms/accept; GET parameter returnTo read via self.request.GET.get(\"returnTo\", \"/\") in get_initial",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "cyface-django-termsandconditions-d51b737f5af17360",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CLI --input-file-type protobuf with --input/--url; _ProtoInputPreparer.__enter__ -> _write_missing_weak_imports",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "datamodel-code-generator-datamodel-code-generator-5533ebd26fe5db29",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "CLI: datamodel-code-generator --input-file-type protobuf --input <attacker-controlled .proto> (or --url); source: WEAK_IMPORT_PATTERN capture group from the proto text reaching _write_missing_weak_imports",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "datamodel-code-generator-datamodel-code-generator-bd146f812470891a",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "get_frontend_context_variables",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "django-commons-django-unicorn-12a63e34be303045",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "CLI command `convert` (docling/cli/main.py) with `--html-image-headers` and `--html-image-fetch remote|all`; attacker-controlled source is the untrusted HTML document's `<img src>` URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-442cf60d08eedb5a",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTMLBackend._render_with_browser via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled source is the untrusted HTML document's <img src> URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-6fdb354a87a33a5b",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ImageResourceLoader.__init__ (headers parameter); CLI --html-image-headers with --html-image-fetch remote/all",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-79c0c9a6f809c850",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "docling-project-docling-a3a58e4798820a2f",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTMLBackend._route_request via HTMLBackendOptions(enable_remote_fetch=True, fetch_images=True, headers=...) / CLI --html-image-headers with --html-image-fetch remote|all; attacker-controlled source is the document's <img src> URL",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "docling-project-docling-e161c7347b530396",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "dromara-sureness-229b3e58be2cea98",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "dromara-sureness-fe133861b4331e26",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "dtwang-line-desktop-mcp-0211ddfcea45a218",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "CLI --http-mode --port 3000 binds Express app to 0.0.0.0 and exposes POST /mcp Streamable HTTP endpoint without authentication",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "dtwang-line-desktop-mcp-11072dcfdfa41a45",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "Express app.all('/mcp') handler in LineDesktopMCPServer.run() invoked via CLI --http-mode --port; attacker-controlled source is the unauthenticated HTTP POST to /mcp (req.body initialize / mcp-session-id header) reaching transport.handleRequest and MCP tools",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "dtwang-line-desktop-mcp-b9429141072345c4",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "initTemplateList (CLI options.template)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "easy-team-easywebpack-cli-b9675c77904bca7d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "filegator-filegator-3e6375432d7d1672",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "filegator-filegator-a4e0e2b35d13f929",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "scopeSearch invoked via Eloquent search scope; no concrete in-repo route/handler or attacker-controlled source provided in the supplied file context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "fiveai-cachet-29e687ca594eba8e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.35,
"entry_point": "execute_module monitor.http_check {url:...}",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-2a4e38c04fd5f6be",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-34e3395590f26492",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-53361f3afc1d0761",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.15,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-720084a3ead8521c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.35,
"entry_point": "execute_module graphql.query {url:...} -> _prepare_graphql_request",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-730f3f6c3f5e3112",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.15,
"entry_point": "execute_module slack.send {webhook_url: attacker-controlled}",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-922d1d2f64c30590",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "execute_module http.request {url: attacker-controlled} -> http_request() -> session.request(method, url, allow_redirects=True) follows 302 into internal space",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "flytohub-flyto-core-9648472ee6b1bd21",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "execute_module http.get with attacker-controlled url parameter (http_get in src/core/modules/atomic/http/get.py)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "flytohub-flyto-core-c57a8e72e5f62c6f",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-cf56d8dfb0fcb584",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.15,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-d56b51ea8b6eec43",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "flytohub-flyto-core-f8f7252f12890138",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "fusesource-hawtjni-18415170793563b7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Library.exractAndLoad (called from Library.load via classLoader.getResource)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "fusesource-hawtjni-f763d2029e719e50",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "display_evaluation_run_status(eval_run_obj) called in Jupyter/Colab; error_message from eval_run_obj.error",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-0ac10c09d9bb7ce5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "_get_inference_html(dataframe_json)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-ae123ecdc45075bf",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "_get_evaluation_html(eval_result_json)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-c97b4cfd80013853",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "_get_comparison_html(eval_result_json)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "googleapis-python-aiplatform-d6824d56240b0069",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Playground component constructor (props.schema) in packages/graphql-playground-react/src/components/Playground.tsx",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-779f126239ce96a4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; introspection type names reach renderType via onHasCompletion autocomplete, then injected through information.innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-8a960cf0662c724e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "SchemaFetcher.fetchSchema via endpoint query parameter (session.endpoint) loading a malicious schema",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-8ab7cfafbc027403",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "GraphQL Playground React app loaded via graphql-playground-html/middleware; endpoint query parameter (?endpoint=...) sets the schema endpoint, and the fetched introspection schema flows through props.schema into UNSAFE_componentWillReceiveProps in Playground.tsx",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-94e027d23fc54155",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "GraphQL Playground endpoint query parameter (?endpoint=...) loading a malicious schema; onHasCompletion renders untrusted schema type names via innerHTML",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "graphql-graphql-playground-afc7c3fd32fb660f",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Guzzle Client cookie handling via CookieJar::matchesDomain (e.g. new Client(['cookies' => true]))",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "guzzle-guzzle-71918799e733c0fa",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "is_url_safe (exported helper) called by external consumers; no in-repo route/handler/CLI source shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hackingrepo-dssrf-js-ecfa495c64d13a59",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hjson-hjson-java-0100a1cb12b60b6a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-117903a04ddebe6e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> ExtractShadowStrategyTool (journal_path) -> safe_user_path",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-16a24d8276343ff1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-1b7a462b5edd6f25",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-36bca05009805ae2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-3eeced0e67bd3443",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-3fe5123aa283389c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-4055b927694ed3d9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.1,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-489a94725fbd4ac9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-490c1fadec0168f7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-4bc98a6c0e318002",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-53b8e8b13c96984b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-54e08745442bc15e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "POST /sessions/{session_id}/messages -> SessionService.send_message -> _run_attempt -> LLM tool registry (read_document / safe_user_path-gated tools)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-7f6e6e7392e1389e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-840eb07dfbe96e75",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> DocReaderTool.execute -> read_document(file_path) with attacker-controlled file_path from chat message",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-866d7a8070276364",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-925032218d1d77e4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-9b681020685fe0e7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-a10dddba8add7fac",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "POST /sessions/{session_id}/messages -> send_message -> svc.send_message -> agent loop invoking read_document / safe_user_path-gated tools",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-ad7c628e2179fe31",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "BacktestTool.execute -> run_backtest(run_dir) via POST /sessions/{sid}/messages LLM tool invocation; run_dir is attacker-controlled via prompt injection",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c16e9e336b3428d7",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "POST /sessions/{sid}/messages -> LLM tool registry -> PatternTool.execute -> run_pattern(run_dir)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c504e5fd82839ef8",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c6867edb99dcb1d1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-c92f45b95e1d0b54",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-cd0aa698868347a5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-d15ad3bf7a566ce3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "build_registry (agent/src/tools/__init__.py) - tool auto-discovery; advisory claims reachability via POST /sessions/{sid}/messages on port 8899, but no such route/handler is present in the supplied file context",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-dc628e0182f9c1ae",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-ebb08ee489b9450b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-f4657c425bc7405e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "POST /sessions/{sid}/messages -> SessionService._run_with_agent -> AgentLoop.run -> build_registry tools (read_document / safe_user_path)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-fc64bd08539555f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-fefd053d0fc19401",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "hkuds-vibe-trading-ff88c73cf17f2c68",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "home-assistant-frontend-4ddc46798ca8e7d6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Lovelace Statistics Graph card (statistics-chart.ts) rendering ECharts tooltip via formatTooltip; source is entity name from getStatisticLabel/computeStateName (attacker-controlled via helper or integration-provided entity name)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-588ec87d01bd562c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ZWave JS network visualization panel (zwave_js-network-visualization custom element) tooltip formatter rendering device names via ECharts tooltip",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-589375de71f6b2f2",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "home-assistant-frontend-61bf65e9dd9a81f3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Statistics Graph card / state-history-chart-timeline.ts _renderTooltip (seriesName from entity name via getStatisticLabel/computeStateName)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-72bcad0f4ba8aa00",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "home-assistant-frontend-ade4d24b167a84dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Statistics Graph card (statistics-chart.ts) rendering entity name via getStatisticLabel -> computeStateName into ECharts tooltip; attacker-controlled source is the entity name set via helper/integration",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-d7404ee83aa6f810",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "Statistics Graph card tooltip rendering (statistics-chart.ts _renderTooltip) via entity name from getStatisticLabel/computeStateName; the provided file is ha-sunburst-chart.ts, not the statistics chart",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-dbfdac609f80500c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Lovelace Statistics Graph card tooltip formatter (_renderTooltip) rendering entity name from getStatisticLabel/computeStateName; attacker-controlled source is the entity/statistic name set via helper or integration",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "home-assistant-frontend-f515548346e64ad5",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "XSLTProcessor.transform (JS-exposed @JsxFunction transformToDocument/transformToFragment) invoked from attacker-controlled webpage JavaScript in HtmlUnit browser",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "htmlunit-htmlunit-2d8f01031e36f7f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "is_private_url called via validate_request_url for user-provided URLs (e.g. event organizer-supplied URL fields); no concrete in-repo route/handler with attacker-controlled source is established by the provided file context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "indico-indico-7df3dccdecfcf290",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "RemoteImageMixin.validate_remote_image via DRF serializer field 'remote_image' (URLField) on API endpoints using RemoteImageMixin; attacker-controlled source is the remote_image URL submitted in the request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "inventree-inventree-3c189cf58ad5161c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "powerline segment GitStatusSegment invoked when shell prompt renders in a directory containing a malicious .git/config (core.fsmonitor)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jaspernbrouwer-powerline-gitstatus-02af01b55c83b1b6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "clean_data (jquery.terminal.js) invoked during terminal formatting of user input; no in-repo route/handler/CLI argument shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jcubic-jquery.terminal-14e90f7dbacbca75",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "clean_data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jcubic-jquery.terminal-5fac75c0184dbcd6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "clean_data (jquery.terminal formatter/attribute rendering)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jcubic-jquery.terminal-cb10a82f25867022",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-3b5afa072c43cab3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "AnsiblePlaybookStep.AnsiblePlaybookExecution.run() invoked via the ansiblePlaybook pipeline step; extraVars parameter (step.extraVars) is attacker/user-controlled and passed to convertExtraVars",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-4904f1516a63debe",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "extraVar (Job DSL context method)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-992e550732edf17b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "appendExtraVars (invoked during Ansible build step execution; extra vars configured via job configuration form)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-ansible-plugin-bfcea0679f20d5f1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-1561c6b78bc53ad9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CodeBuilder.perform (Jenkins build step) via readResolve deserialization of persisted CodeBuilder config",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-3c24887c571b4cb0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "CodeBuildStep.CodeBuildExecution.run (Jenkins build step)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-3d0bfc1f65a1d762",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "CodeBuilder @DataBoundConstructor (Jenkins job configuration form)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-6ad10434eea5ee64",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "CodeBuilder.perform (Jenkins Builder) - AWSClientFactory constructor with getParameterized(this.awsSecretKey)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-74b2064ce4792a4c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "AWSClientFactory constructor (credentialsType=Keys path) invoked from build configuration; no concrete in-repo route/handler shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-codebuild-plugin-78b40b445eb31871",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "doFillCredentialsIdItems (Jenkins Stapler HTTP endpoint helper)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-aws-credentials-plugin-79ab9c6465c74964",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-configuration-as-code-plugin-26c452bafd056c70",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "SecretBuildWrapper.decorateLogger / LineTransformationOutputStream.close (Jenkins build log output stream)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-credentials-binding-plugin-912adeb590b59d23",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-credentials-binding-plugin-d713906e76e2660a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint doCheckDependencyTrackFrontendUrl (and doTestConnection) invoked via form validation request; attacker-controlled source is the @QueryParameter value / dependencyTrackApiKey and credentials ID",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-dependency-track-plugin-673cc48b4f75ebf5",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins HTTP endpoint doCheckDependencyTrackUrl (and doTestConnection) reachable via Stapler form validation; attacker-controlled source: @QueryParameter value / dependencyTrackUrl and dependencyTrackApiKey",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-dependency-track-plugin-90b566be2c3aebff",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint doTestConnection (descriptor form validation endpoint, e.g. /descriptorByName/.../testConnection) with attacker-controlled dependencyTrackUrl and dependencyTrackApiKey query parameters",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-dependency-track-plugin-9e8488d96f7c0424",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "configure(StaplerRequest, JSONObject) global configuration handler",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-gitlab-logo-plugin-2cdae87438f0fc39",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "GitlabLogoProperty.getProject() via getIconUrl()/getRepositoryUrl()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-gitlab-logo-plugin-46246cf241510f0a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins global configuration form submission handled by DescriptorImpl.configure(StaplerRequest, JSONObject) via Stapler; attacker-controlled source is the privateToken form field in the submitted JSON form data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-gitlab-logo-plugin-f771ba20ac33c126",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "readResolve() on PluginDescriptor during Jenkins XML deserialization of hudson.plugins.jira.JiraProjectProperty.xml",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-jira-ext-plugin-28565b34d1c8489d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "JiraClientFactoryImpl.newJiraClient()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-jira-ext-plugin-9bc3b4180b83656a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint doFillJenkinsSitesItems on JobImportActionDescriptor (fill field for Jenkins sites), reachable by any authenticated user with Overall/Read permission",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-job-import-plugin-07e0e7023a46cf4d",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Jenkins Stapler HTTP endpoint /jobImport/fillCredentialIdItems (doFillCredentialIdItems on JobImportActionDescriptor), reachable by any authenticated user with Overall/Read permission",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-job-import-plugin-5509a356384e862e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "MarkupFormatter.translate(String markup, Writer output) invoked by Jenkins when rendering descriptions configured with the Markdown Formatter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-markdown-formatter-plugin-9c93ac91e86f4cc5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "MarkupFormatter.translate invoked by Jenkins rendering of user-editable descriptions",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-markdown-formatter-plugin-dd25c90bea9a886e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "doCommenceLogin(@QueryParameter String from, @Header(\"Referer\") String referer) -> getValidRedirectUrl(from != null ? from : referer)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-oic-auth-plugin-072cfcf18988ef12",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "doOwnersSubmit(StaplerRequest req, StaplerResponse rsp) via HTTP form submission to the job ownership config page; source: req.getSubmittedForm() JSON 'owners' field",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-ownership-plugin-aec8f0570f4b80f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "Stapler HTTP endpoint doChangeSubmit (P4Hook) reachable via Jenkins Stapler routing; attacker-controlled source: StaplerRequest parameters (_.p4port) and submitted form",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-p4-plugin-5022afedadfe8449",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "P4Hook.doChange (HTTP endpoint /p4/change via StaplerRequest)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-p4-plugin-65a59903d43924ee",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP endpoint doBuild/doBuildSubmit on ReviewAction (urlName 'review') via StaplerRequest parameters",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-p4-plugin-85c3775c29eb0c5c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP endpoint /review/buildSubmit (Stapler doBuildSubmit) reachable via Overall/Read authenticated user submitting form data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-p4-plugin-a1c0ab5c3582fc3b",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "UnprotectedRootAction P4Hook at URL /p4, HTTP endpoint doEvent (and doChange) reachable without authentication; attacker-controlled source is the HTTP request body/JSON payload (req.getInputStream)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-p4-plugin-fdef12ac487474fb",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-113227759c983f0a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-1361f56765dbad32",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "setApiToken via @DataBoundSetter during Jenkins global configuration save (RemoteBuildConfiguration.xml)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-5b7b011daea8e88e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "setAuthorizationHeader(URLConnection, BuildContext) invoked during remote build trigger HTTP request; apiToken sourced from Jenkins global configuration (RemoteBuildConfiguration.xml)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-parameterized-remote-trigger-plugin-f066bf7b2ae56763",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Pipeline Maven Integration plugin Maven build step parsing maven-spy.xml from agent temporary directory (listGeneratedArtifacts)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-pipeline-maven-plugin-f7e9c244b67b36a6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "InfoParser.parseFor parsing reportFile (Selenium HTML report file) via getReportFileFor(build, testResult, seleniumReportsDir)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-seleniumhtmlreport-plugin-596bcea5f710622a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "getPom(FilePath workspace) -> MasterToSlaveFileCallable.invoke parses pom.xml (BUILD_FILE) via DocumentBuilderFactory without disabling external entities",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-semantic-versioning-plugin-7a6f61fea77b9da3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "doDownloadAttachment Stapler request handler (Jenkins Stapler route /downloadAttachment) reading request parameter \"f\"",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-tap-plugin-b1954cc1fc64febe",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-22b29c9f11c9c050",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "archiveZap() Jenkins Pipeline step (ArchiveZapExecution.start)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-35e96c45d9357469",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "archiveRawReport called from ZAP Pipeline build step (ZapBuilder/ZapStep) during Jenkins build",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-5ee6ae7d06c3ad5e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "ZapAction.doDynamic (Stapler route /job/<job>/<run>/zap/... via getUrlName() returning ZapArchive.DIRECTORY_NAME), serving DirectoryBrowserSupport content; attacker-controlled source is files in the workspace/archived artifacts",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-953ab12f1f2d06d9",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jenkinsci-zap-pipeline-plugin-f405bf70465980bc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-561dd51556f2b530",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "GET /api/<entity>?sort=... (generated reactive entity list endpoint; sort parameter)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-98eceaae5495db76",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-b5bedd365fd447dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-d40433c5e5a179bb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.97,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-e25ba8d07362b033",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "GET /api/<entity>?sort=... (generated reactive entity list endpoint; sort parameter flows into EntityManager.createOrderByFields)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-e4ad88d8f028b8fe",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "jhipster-generator-jhipster-ed98b23f033108c6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhy-jsoup-6358e99ead4eb079",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhy-jsoup-caf11625421e51b5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "TagSet.valueOf(String tagName, String namespace, ParseSettings settings) called during HTML parsing of untrusted input via Jsoup.parse / Cleaner with a custom Safelist",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "jhy-jsoup-fb24c11d6f1b2ae3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-0409fd38692653dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-17356dc985f12ca8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-2ae7bec575002cc8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); caller-controlled source: Sales Invoice Item.asset Link field in request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-39e17ab80d48e54e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); source: caller-supplied Sales Invoice Item.asset Link in request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-46e518f703a36dc0",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale -> frappe.get_doc(\"Asset\", d.asset) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel(); source: caller-supplied Sales Invoice Item.asset Link in request body",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-48f1f22be6ba9f48",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "pacioli CLI build_parser (broker/pacioli/cli.py)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-9f19515916d1f37b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Sales Invoice.on_submit -> process_asset_depreciation -> depreciate_asset_on_sale (item row 'asset' Link from request body) -> depreciation.py:481 -> asset_depreciation_schedule.py:215-217 current_schedule.cancel()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "john-broadway-pacioli-b26b532c43a68565",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-b3ff7c846381ada8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "pacioli doctor CLI subcommand (cmd_doctor)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "john-broadway-pacioli-f63aa31ecca38c1c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "api.tools.parse_response / api.helper.get.visible_emails_post / api.helper.get.email_data_post",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "kartiktalwar-gmail.js-301ae79245460d39",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "MongoDBSaver.deleteThread(threadId)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "langchain-ai-langgraphjs-920b675720dbc952",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "parse_env_variables via Trainer initialization reading PL_TRAINER_GPUS environment variable",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "lightning-ai-pytorch-lightning-8a9ebfbdcc58e73e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTTP request path parsing in Armeria server (PathAndQuery.appendOneByte) reached via FileService under a path prefix, e.g. GET /files/..%2Fsecrets.txt",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-143c39cfd2874e4c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ArmeriaHttpUtil.decodePath invoked from HTTP request path handling (e.g., FileService under /files)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-1a9b7d60cd9e8330",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "HTTP request path handling in Armeria server (PathAndQuery.splitPathAndQuery invoked from request path parsing); attacker-controlled source is the request path containing %2F, e.g. /files/..%2Fsecrets.txt",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-3196308da59204ff",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "ArmeriaHttpUtil.decodePath (called from Armeria server request path handling)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-36dfac02c436f929",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "HTTP request path handling in Armeria server (e.g., FileService under /files)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-5e40f3c4fd9a04ba",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "line-armeria-7fb77b8814401e5d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "RoutingResultBuilder.rawParam called during HTTP request routing; no concrete in-repo route/handler or attacker-controlled source shown in provided context",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-ecc4313228868198",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP request path parsing in Armeria server (PathAndQuery.parse) invoked via FileService under a route such as /files, attacker-controlled source: request path containing %2F",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "line-armeria-fff692dc76424e72",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-4d161f6aa8f9499a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.2,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-70cbfb17db2cecb4",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "lhc_web/cli/lib/install.php step3() invoked via CLI installer (php cron.php / install script)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-90e4ec70ac068666",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "livehelperchat-livehelperchat-db8669fb4edb63c2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "ljharb-shell-quote-74ceec6e8c431f73",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "iziModal('open') plugin method invoked by page JavaScript with attacker-influenced options.title",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "marcelodolza-izimodal-afd617de248065eb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "commandExists(commandName, callback) exported function",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "mathisonian-command-exists-5c2ea6b59177e0dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "Pipeline.__init__ via config_file (dey_mini.yaml) ['nnet']['module']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-0fa875b67930ece7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "ImageViewTransform.__init__ (model_dir from config file dey_mini.yaml ['nnet']['module'])",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-1d41167fffcc5136",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "DROEstimation.__init__ via model loading (model_dir)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-36d2bd78fdd5731d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Pipeline.__init__ via config_file (dey_mini.yaml) ['nnet']['module']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-3718dff6ca9e3eb5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "LinearAECPipeline.__init__ (pipeline instantiation via modelscope pipeline API)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-71fef32c90c184a3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "Model.__init__ via configuration file key ['nnet']['module']",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-75fd1dee4ec928eb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "PedestrainAttributeRecognitionPipeline.__init__ via pipeline(Tasks.pedestrian_attribute_recognition, model=...) with attacker-controlled model config",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-modelscope-bb25a58bfaca076c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Template._save_pil_image (static method in swift/template/base.py); no in-repo route, request handler, or CLI argument is shown reaching it with attacker-controlled image data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modelscope-ms-swift-600a21056f8085a7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "import_report_from_email(content) -> import_archive -> import_report; content originates from DMARC report emails sent to the rua address of a domain",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modoboa-modoboa-dmarc-7b9ba42b6d644e40",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "import_report(content) called with XML content from emailed DMARC reports (rua address)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "modoboa-modoboa-dmarc-9e011e2d13bc2f47",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "saveAttachments (LocalFileSystemAttachmentServiceImpl) invoked via Genie API multipart/form-data attachment upload",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "netflix-genie-3c700ed384082b01",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "HerokuAddonPool(id, app, opt) exported function; app parameter interpolated into cp.exec",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "nodef-heroku-addonpool-e3d374b9c51542a9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "unadded()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-06a6c2a9fdaf1fe6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "module.exports = async function(tag) in lib/tag/index.js",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-0cd4fa8d294bb15c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "module.exports function in lib/modified/index.js (library API, no in-repo route/handler/CLI)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-1c70190766100c0e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "lib/remote/index.js remote() (test file lib/remote/spec.js)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-c2e0fe13af8ae7dc",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "remote()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "omrilotan-async-git-e3f54204efc8569d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-08eea42408cf3b85",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Project.__init__ via CLI generation from an OpenAPI document (openapi.title used to build project_dir path)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-6597f2ff2bd4d4af",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "openapi-python-client CLI generating a client from an attacker-supplied OpenAPI document (snake_case called on schema names)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-eec25cd455fc2186",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "openapi-python-client CLI generating a client from an attacker-supplied OpenAPI document (tag names flow into _build_api file paths)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openapi-generators-openapi-python-client-faf2d6df0e1fba6a",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "openstack-nova-4045dc3bd0ca9f47",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Bash.run (metagpt/tools/libs/terminal.py) invoked as an LLM tool; no in-repo HTTP route or CLI argument source is shown",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "paipeline-metagpt-5bf0b5683141e177",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.3,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "paipeline-metagpt-8a7c60e38d5f4edd",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "paipeline-metagpt-9e79068fd7901a91",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "Terminal.run_command (no in-repo HTTP route or CLI argument shown reaching it)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "paipeline-metagpt-bf0e585f3114f491",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "petl.io.xml.fromxml() -> XmlView.__iter__",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "petl-developers-petl-c3a25a317f77d4e7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "petl.io.xml.fromxml() -> XmlView.__iter__ -> etree.parse(xmlf)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "petl-developers-petl-d8f99d8829b06c72",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "petl.io.xml.fromxml",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "petl-developers-petl-fe2841388aef1fd9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "HTTP GET / handler _on_root_request_cb reading request.url.query (_state_id_)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "posit-dev-py-shiny-3537c0dd41a40d38",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP request query string `_state_id_` parameter reaching `_load_state_qs` (bookmark restore path)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "posit-dev-py-shiny-78e995f1fddd0cb5",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "HTTP request query string parsed by RestoreContext.from_query_string via the Shiny bookmark-restore path; attacker-controlled source is the `_state_id_` query-string parameter",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "posit-dev-py-shiny-8fd07b2eca54563e",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "posit-dev-py-shiny-c4952ae2ef71c906",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "posit-dev-py-shiny-d9a1d7c28404388d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "getErrorDiv called from fetchAndGenerateResults error handler; source is search API response error message",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "readthedocs-readthedocs-sphinx-search-391e2f80eb80c3c8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "generateSingleResult (called from generateSuggestionsList with search backend response data)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "readthedocs-readthedocs-sphinx-search-885af7a7682d69e3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "get_section_html",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "readthedocs-readthedocs-sphinx-search-eb34d0b4ee01b206",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.4,
"entry_point": "plot(options)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "rkesters-gnuplot-d931b1756db47945",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "language_attributes filter via cleanHtmlMarkup()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "roots-soil-8fa3ef8a493b8d64",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Inventory.php store() method, invoked via Livewire request from the admin product inventory form; attacker-controlled source is the authenticated low-privilege panel user's Livewire action call and form state",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-02254beed509364c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Components\\Customers\\Orders (public $customer property, table()/render()); attacker-controlled source: Livewire client-side property tampering of the unlocked public ShopperUser $customer",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-047e62abed0b91fa",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Shopper\\Livewire\\Components\\Orders\\OrderNotes::leaveNotes(), invoked via Livewire update request from the order detail admin panel; attacker-controlled source is the public $notes property and the Livewire-callable leaveNotes action",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-052f88a347caf2eb",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire admin component Settings/Team/Index (table recordActions DeleteAction) reachable by any authenticated panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-064f0b5f8937aae5",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-0d7758a9a7d45a31",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin Order Detail component action markCompleteAction (Filament action callable by authenticated low-privilege panel user with read_orders)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-0fd6e8d87dd0ed82",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Settings/Team/RolePermission::save() invoked via Livewire update request from the admin panel route (shopper settings team role page); attacker-controlled source is the authenticated low-privilege panel user's Livewire action call and form state",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-1112cc61420816ff",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-137aa7e49095c9df",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Products\\Form\\Edit::store() invoked via Livewire update request from the admin product edit form; attacker-controlled source is the Livewire form state (data) submitted by an authenticated low-privilege panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-13fdb238d0d8e573",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component packages/admin/src/Livewire/Pages/Order/Detail.php::capturePaymentAction (Filament action 'capturePayment' invoked by an authenticated low-privilege panel user with read_orders permission)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-22487ec06a8cf50a",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component packages/admin/src/Livewire/Pages/Order/Shipments.php::table() record actions (markDelivered, edit) invoked via Livewire request by an authenticated low-privilege panel user with browse_orders/read_orders permission",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-2405022067cc6870",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Order/Detail markPaidAction (Filament action 'markPaid') invoked by an authenticated low-privilege panel user with read_orders permission",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-29811dac402a0d13",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Order/Detail archiveAction (Filament action 'archive') invoked via Livewire request to the admin order detail page; attacker-controlled source is the authenticated low-privilege panel user's Livewire action call",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-2aeaefee52274ee8",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Files.php store() action, invoked via Livewire request to the product edit page; attacker-controlled source is the Livewire action call and form state from any authenticated panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-5481a94c34f42fbf",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Products\\Form\\Shipping::store() invoked via Livewire update request from the admin product shipping form; attacker-controlled source is the Livewire action call and form state ($this->data) submitted by any authenticated panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-5a3dcf2a6b6b16c8",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Settings/Team/RolePermission::createPermissionAction (admin panel route for role permissions), invoked by an authenticated low-privilege panel user with view_users permission",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-5e6161ace0cb4b97",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Carriers::createCarrierAction (admin panel route rendering the Carriers Livewire component); attacker-controlled source: authenticated low-privilege panel user invoking the createCarrier Filament action with form data",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-61e951b6bcd03186",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component packages/admin/src/Livewire/Pages/Collection/Edit.php store() action, invoked via Livewire update request from the admin collection edit page by an authenticated low-privilege panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-7cc69fb293ec0e10",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Settings/Team/RolePermission::generatePermissionsAction (Filament action 'generatePermissions'), invoked by an authenticated panel user with only view_users permission; source is the Livewire action request payload (resource/group_name)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-8769d9915b8295a9",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Currencies (route /settings/currencies) - table() ToggleColumn is_enabled, EditAction edit, and grouped bulk actions enable/disable; attacker-controlled Livewire method calls (e.g. updateTableColumnState, mountTableAction, callTableBulkAction) from an authenticated low-privilege panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-88497bd11908cf4a",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Livewire component AddVariant (packages/admin/src/Livewire/SlideOvers/AddVariant.php) form() barcode TextInput; attacker-controlled source is the barcode form field submitted via the Livewire save() action, rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-8b7021ee40c51b56",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Settings\\Legal\\PolicyForm::store() invoked via Livewire update request from the admin panel; attacker-controlled source is the authenticated low-privilege panel user's Livewire request payload (form state) reaching $this->legal->update()",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-91023b586e4ab747",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Livewire component Shopper\\Livewire\\Components\\Settings\\Team\\Permissions::togglePermission invoked via Livewire update request from the admin panel Team/RolePermission UI",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-995f958bcb3b415b",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\PaymentMethods::createPaymentAction (admin panel route for payment methods settings); attacker-controlled source: authenticated low-privilege panel user invoking the createPayment Livewire action",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-a413505de3d037f8",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component packages/admin/src/Livewire/Components/Products/Form/Seo.php store() action, invoked via Livewire request to the product SEO form; attacker-controlled source is the Livewire component action call and form state from any authenticated panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-a82b452965e2ffe5",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.6,
"entry_point": "Livewire component packages/admin/src/Livewire/SlideOvers/AddProduct.php::store() invoked via Livewire request to the AddProduct slide-over (form submit wire:target=\"store\"); attacker-controlled source is the Livewire-bound $data form state including the barcode field",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-ab37699016e7189c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Product\\Variant::updateStockAction (admin panel product variant page); attacker-controlled source: Livewire action call with form data (sku, barcode) from an authenticated low-privilege user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-b37cd0c75b594760",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Components\\Products\\Form\\Inventory (form/table actions)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-cd42a8054fc4a7f9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Shopper\\Livewire\\Pages\\Order\\Detail::cancelOrderAction invoked via Livewire action call on the order detail page (route shopper.orders.detail); attacker-controlled source is the authenticated low-privilege panel user's Livewire action request, which only required read_orders",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-cd45e0d6604bb846",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Settings/Locations/InventoryForm::store() invoked via Livewire update request from the admin panel route shopper.settings.locations; attacker-controlled source is the Livewire form state ($this->form->getState()) submitted by an authenticated low-privilege panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-d05ad8c2776691be",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component PaymentMethods (Settings/PaymentMethods) table actions: ToggleColumn is_enabled, EditAction edit, DeleteAction delete; invoked via Livewire update endpoint by any authenticated panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-d26bdca35566e799",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire admin component Order/Detail::startProcessingAction (Filament action 'startProcessing') invoked by an authenticated low-privilege panel user with read_orders permission",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-deb90b541bcac1aa",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Shopper\\Admin\\Livewire\\Pages\\Settings\\Team\\Index (route: shopper.settings.team.index) - createRoleAction invoked by any authenticated panel user; source: Livewire action call from client",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-df2391064e3c3332",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Livewire component Settings/Team/Permissions::removePermission invoked via Livewire action from admin panel; source is the Livewire action parameter $id",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "shopperlabs-shopper-ed89d9515bdaac41",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "Livewire component Customers\\Create::store() invoked via admin panel route shopper.customers.create (Livewire POST to /admin/customers/create); attacker-controlled source is the Livewire form state ($this->form->getState()) submitted by an authenticated low-privilege panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-f3cb66743db8d5f1",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "Livewire component packages/admin/src/Livewire/Pages/Settings/Carriers.php (table actions: ToggleColumn is_enabled, EditAction, DeleteAction) invoked via Livewire update requests by any authenticated panel user",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "shopperlabs-shopper-fddd0d6c3c4501aa",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "bootstrap-select plugin initialization/render (client-side library); no in-repo server route or CLI handler",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "snapappointments-bootstrap-select-5d3e7953302ad040",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "spatie-laravel-medialibrary-17bc134397b9d3f7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "spatie-laravel-medialibrary-9b12f440411602e2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "supabase-auth-js-13d9df5e852b0156",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "resolveFile via loadFileDataForInput (UI server-side file resolution)",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "tensorzero-tensorzero-1df57d6b5c9fc101",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-00a60694b44cad58",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-017c730f695963d1",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0303c786b3f9def3",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-03db63004dde1012",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0847872016dff82d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0b7c25791baf4ea7",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0d903711cc0bf246",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "POST /api/v1/schedules/:scheduleId/deactivate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.deactivate.ts), authenticated via authenticateApiRequest using an environment-scoped secret API key",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-0eb72665259b13c2",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.55,
"entry_point": "POST /api/v1/schedules/:scheduleId/activate (action in apps/webapp/app/routes/api.v1.schedules.$scheduleId.activate.ts), authenticated via authenticateApiRequest using an environment-scoped secret API key",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-124d417d0ae18fbe",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-1389b2b039433f1d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-1609ba0be33d1321",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-173943fa33a292d8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment(projectId, friendlyId); attacker-controlled source: deploymentId path param + secret API key of a lower-trust environment",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-2240070f2c86924b",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-23e4ffbc736b2960",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-28978c4024d4bf10",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-2ad2f0a3cde32718",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.95,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-2f8805383abee870",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (action in apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts); attacker-controlled source: API key in request headers via authenticateRequest, plus deploymentId path param",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-30dec4b7031de737",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-3309f58798af795d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-33568c3becc0c84c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-34d89ac9922ed6c5",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-397d55d61662dcbb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-3b2daa8cc067a965",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-3da6ba2954fae9e2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-428c7b244470b508",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5224c92a3bd5124b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-52d2cb11d78d0327",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5392f925c70f8c55",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-588437af67b5a758",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.85,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) with attacker-controlled secret API key (dev/preview env) and deploymentId param",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5b0c0ef74fdf5bc3",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5c1e8b013b50f48d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "POST /api/v1/deployments/:deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment -> getDeployment; attacker-controlled source: authenticated secret API key (environment) and deploymentId path param",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-5f1cf28e3ac84980",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-69e5a79ca434a31b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-72c9f380f92bd8f2",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-7323929a73b6be76",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-816142e126393220",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-874f7ae9b06d875b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-92c5190a8ba1209d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-984189f717b2a3da",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-99347f6b51258e29",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-a20e065c9b6ced3b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-b2314fca2554ca64",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-b8f3fea0ac68f12c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-ca2ef47f420ef2eb",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-d7690485d67bf995",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-dcc34c0e95ea739c",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-ddd75cb2ab0e406d",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-df02f538ad370706",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-dfa82db3c18c0e1b",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "POST /api/v1/deployments/$deploymentId/cancel (apps/webapp/app/routes/api.v1.deployments.$deploymentId.cancel.ts) -> DeploymentService.cancelDeployment; attacker-controlled source: authenticated environment secret API key (dev/preview key) plus deploymentId path param",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-eebfca9646e01b1c",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-f2588e86d347fea6",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": false,
"confidence": 0.05,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "triggerdotdev-trigger.dev-f809e61cae1a9f29",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Affix constructor via $.fn.affix(options) or data-spy=\"affix\" data attributes; options.target passed to $(this.options.target)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "twbs-bootstrap-a6f8f24cd4354719",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Tooltip.prototype.init via $.fn.tooltip plugin (options.viewport / options.container)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "twbs-bootstrap-bfa547024b92ef59",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.55,
"entry_point": "Collapse.prototype.getParent (options.parent selector)",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "twbs-bootstrap-d29d2c0e551ad5e8",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.9,
"entry_point": "",
"fix_addresses_it": false,
"human_spot_check": null,
"id": "web-infra-dev-rspack-c788948210260bd9",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
},
{
"advisory_cited": true,
"confidence": 0.75,
"entry_point": "processMessage(message, ctx) invoked from the Baileys socket message pipeline (e.g. sendMessage/ev 'messages.upsert' handling); attacker-controlled source is the incoming WAMessage.message.protocolMessage (placeholderResendMessage / PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE, HISTORY_SYNC_NOTIFICATION, APP_STATE_SYNC_KEY_SHARE) delivered over the WhatsApp protocol",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "whiskeysockets-baileys-89cd6d4edf46d286",
"model": "deepseek-flash",
"reachable_in_repo": true,
"verdict": "pending_human",
"vulnerable_pre_fix": true
},
{
"advisory_cited": true,
"confidence": 0.35,
"entry_point": "AuthService.handleCallback",
"fix_addresses_it": true,
"human_spot_check": null,
"id": "workos-authkit-session-399c57ce0227249e",
"model": "deepseek-flash",
"reachable_in_repo": false,
"verdict": "rejected",
"vulnerable_pre_fix": false
}
]
}
Reference in New Issue View Git Blame Copy Permalink