T3MP3ST v1 — hardened launch (AGPL, verify-claims 24/24, leak-scrubbed)

bench/cve-zero/samples/GHSA-q6xx-5vr8-p898/ground-truth.json

@@ -0,0 +1 @@
+{"ghsa": "GHSA-q6xx-5vr8-p898", "repo": "nezhahq/nezha", "cwes": ["CWE-862", "CWE-639"], "summary": "fix(rpc): bind io_stream sessions to creator to prevent terminal/fm hijack", "fix_commit": "6661d6a7fc1c269f55c7f4e775082ad23fbe0f54", "parent_commit": "e7c2e453c0032be6ba86fa274fda4ebc8ba3e70a", "vuln_files": ["service/rpc/io_stream.go", "cmd/dashboard/controller/terminal.go", "cmd/dashboard/controller/fm.go"], "vuln_lines": {"service/rpc/io_stream.go": [13, 34, 38, 43], "cmd/dashboard/controller/terminal.go": [47, 74], "cmd/dashboard/controller/fm.go": [49, 74]}, "source_files": 28, "scope_dirs": ["service/rpc", "cmd/dashboard/controller"], "source_note": "Subset: only the service/rpc and cmd/dashboard/controller packages (containing the vuln files) were copied into source/, not the full repo."}