{
  "schemaVersion": 1,
  "caseId": "minimist-cve-2021-44906",
  "run": "historical-detection-20261020",
  "preregistration": {
    "artifactPath": "/evidence/benchmarks/historical-detection-20261020/preregistration.json",
    "sha256": "6c7ef71cffa3729de787444c67823b01afcda71d61b42f2a005fda892a07db91",
    "websiteCommit": "aeb254a5673d716048f72d500fc57aaca477042c"
  },
  "tool": {
    "name": "vettalon",
    "version": "0.3.0"
  },
  "models": {
    "finder": "claude-opus-5-5 via claude CLI 2.1.300 (Anthropic)",
    "verifiers": [
      "grok-4.7 via grok CLI 1.0.62 (xAI, container sandbox)",
      "gpt-oss-120b-medium via agy 1.4.3 (OpenAI family, host)"
    ]
  },
  "command": "vettalon scan <release tree> --profile deep --config roster.toml --finders claude --verifiers grok,agy --max-modules 8 --refuter-runs 1 --no-prior --time-budget 2400 --source-receipts --trace trace.jsonl --report report.json --fail-on none --lang en",
  "hintLevel": "L0",
  "target": {
    "file": "index.js",
    "vulnerableRanges": [
      [
        69,
        95
      ]
    ],
    "fixedRanges": [
      [
        69,
        95
      ],
      [
        247,
        249
      ]
    ],
    "acceptedCwes": [
      "CWE-1321",
      "CWE-915",
      "CWE-471"
    ]
  },
  "arms": {
    "vulnerable": {
      "version": "1.2.5",
      "archiveUrl": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
      "archiveSha256": "a1800ce4d39356e96497bd09a41fad0033a13dd8eeb469008333547505ce4350",
      "treeSha256": "87f5fe30004aacf835941e044c766f5541c1a19db3ccb4962378a97fc1ba82cb",
      "excludedFiles": [],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "complete",
      "incompleteReason": null,
      "calls": {
        "total": 5,
        "finder": 4,
        "verifier": 1,
        "failed": 0
      },
      "reportSha256": "1e3b6711cd6922ef6bb78ba791037bebe16a5a7db967aeefcae4e45594a434d0",
      "modules": {
        "selected": 3,
        "reviewed": 3
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "0feebc85297a35829a4a3a6c5346ddcca582052e5ebf0d33bd024abe8cd5245b"
      },
      "outcome": "found",
      "matches": [
        {
          "file": "index.js",
          "line": 75,
          "cwe": "CWE-1321",
          "severity": "medium",
          "status": "needs_human",
          "title": "Incomplete prototype-pollution guard in setKey allows polluting Function.prototype via constructor.constructor.prototype",
          "verification": [
            {
              "model": "grok",
              "family": "xai",
              "verdict": "plausible"
            }
          ]
        }
      ],
      "otherFindings": {
        "total": 0,
        "byStatus": {},
        "reviewed": false
      }
    },
    "fixed": {
      "version": "1.2.6",
      "archiveUrl": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
      "archiveSha256": "49c9124665fc1900e589be610b8dc69d5e61a179e9ed8547c6d61d30a225e726",
      "treeSha256": "3d532eb6fe5af7e900b9c626ff08a9e90ba94960896173cf93265dbe4708f0e0",
      "excludedFiles": [],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "complete",
      "incompleteReason": null,
      "calls": {
        "total": 3,
        "finder": 3,
        "verifier": 0,
        "failed": 0
      },
      "reportSha256": "149f20bdff903003cfe880174f47df7cdb6bea61acf85c387fefa6c2bbe9ca36",
      "modules": {
        "selected": 3,
        "reviewed": 3
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "48ab32c4ba79cde9a1b1236437942567f97b8eac7ce17013b83b548c620db652"
      },
      "outcome": "notFlagged",
      "matches": [],
      "otherFindings": {
        "total": 0,
        "byStatus": {},
        "reviewed": false
      }
    }
  },
  "limitations": {
    "zh": "這是已公開、已修補漏洞的偵測基準，不是新發現。模型訓練資料可能已包含此公告或修補，命中不能證明模型是從程式碼推理出來的。候選與 needs_human 都不是自動確認，也沒有執行 PoC。比對標準在掃描前登錄；其他輸出只列數量，未經審閱、未公開位置。原始 report.json 與 trace 不公開，只列 SHA-256。單次執行，模型輸出有隨機性，重跑結果可能不同。",
    "en": "This is a detection benchmark on an already disclosed and patched issue, not a new discovery. The models may have seen the advisory or the fix during training, so a match does not show that the model reasoned it out from the code. Candidates and needs_human results are not automatic confirmation, and no PoC was run. Match criteria were registered before scanning. Other findings are listed as counts only; they were not reviewed and their locations are not published. The raw report.json and trace are not public; only their SHA-256 is listed. Single run; model output is nondeterministic and a rerun may differ."
  }
}