{
  "schemaVersion": 1,
  "caseId": "pyjwt-cve-2022-29217",
  "run": "historical-detection-20261020",
  "preregistration": {
    "artifactPath": "/evidence/benchmarks/historical-detection-20261020/preregistration.json",
    "sha256": "6c7ef71cffa3729de787444c67823b01afcda71d61b42f2a005fda892a07db91",
    "websiteCommit": "aeb254a5673d716048f72d500fc57aaca477042c"
  },
  "tool": {
    "name": "vettalon",
    "version": "0.3.0"
  },
  "models": {
    "finder": "claude-opus-5-5 via claude CLI 2.1.300 (Anthropic)",
    "verifiers": [
      "grok-4.7 via grok CLI 1.0.62 (xAI, container sandbox)",
      "gpt-oss-120b-medium via agy 1.4.3 (OpenAI family, host)"
    ]
  },
  "command": "vettalon scan <release tree> --profile deep --config roster.toml --finders claude --verifiers grok,agy --max-modules 8 --refuter-runs 1 --no-prior --time-budget 2400 --source-receipts --trace trace.jsonl --report report.json --fail-on none --lang en",
  "hintLevel": "L0",
  "target": {
    "file": "jwt/algorithms.py",
    "vulnerableRanges": [
      [
        183,
        199
      ]
    ],
    "fixedRanges": [
      [
        185,
        195
      ]
    ],
    "acceptedCwes": [
      "CWE-327",
      "CWE-347",
      "CWE-345",
      "CWE-287",
      "CWE-290",
      "CWE-1173"
    ]
  },
  "arms": {
    "vulnerable": {
      "version": "2.3.0",
      "archiveUrl": "https://files.pythonhosted.org/packages/1d/8e/01bdcfdbb352daaba8ea406d9df149c5bba7dbf70f908d4fa4c269fe6a08/PyJWT-2.3.0.tar.gz",
      "archiveSha256": "b888b4d56f06f6dcd777210c334e69c737be74755d3e5e9ee3fe67dc18a0ee41",
      "treeSha256": "985db04acbeeb744cbcc7a6cea9c9b87ebc3fda2914814cd7dba0e31766e2598",
      "excludedFiles": [
        "CHANGELOG.rst",
        "docs/changelog.rst"
      ],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "injection_uncrosschecked",
      "calls": {
        "total": 10,
        "finder": 9,
        "verifier": 1,
        "failed": 0
      },
      "reportSha256": "81fb9120cbb14c416b5ec50f84185a4bae09ff7478d72b51cb2e769ac34baf94",
      "modules": {
        "selected": 8,
        "reviewed": 8
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "bd8b7b5e904cd6bcffb2eea783632389bc629ad972404aa4645a4bbad7696f73"
      },
      "outcome": "found",
      "matches": [
        {
          "file": "jwt/algorithms.py",
          "line": 193,
          "cwe": "CWE-327",
          "severity": "high",
          "status": "needs_human",
          "title": "HMAC key blocklist misses OpenSSH EC/EdDSA public keys, allowing HS256 algorithm confusion",
          "verification": [
            {
              "model": "grok",
              "family": "xai",
              "verdict": "plausible"
            }
          ]
        }
      ],
      "otherFindings": {
        "total": 0,
        "byStatus": {},
        "reviewed": false
      }
    },
    "fixed": {
      "version": "2.4.0",
      "archiveUrl": "https://files.pythonhosted.org/packages/d8/6b/6287745054dbcccf75903630346be77d4715c594402cec7c2518032416c2/PyJWT-2.4.0.tar.gz",
      "archiveSha256": "d42908208c699b3b973cbeb01a969ba6a96c821eefb1c5bfe4c390c01d67abba",
      "treeSha256": "94987f97d997cc5c063218cabc9c71527977f57dd509e80934c7562bc02c0b5f",
      "excludedFiles": [
        "CHANGELOG.rst",
        "docs/changelog.rst",
        "tests/test_advisory.py"
      ],
      "scannedAt": "2026-10-20",
      "exitCode": 0,
      "runStatus": "incomplete",
      "incompleteReason": "injection_uncrosschecked",
      "calls": {
        "total": 10,
        "finder": 10,
        "verifier": 0,
        "failed": 0
      },
      "reportSha256": "18e5a0a5c435f20a321194fd7e23ba696fe120959d4cf981a788e5600e0074e0",
      "modules": {
        "selected": 8,
        "reviewed": 8
      },
      "targetFile": {
        "reviewed": true,
        "truncated": false,
        "submittedSha256": "e1cf03fe47b4379ca48ba8b4ef30b3893ef4df04957fb09489b424a803d3012f"
      },
      "outcome": "notFlagged",
      "matches": [],
      "otherFindings": {
        "total": 0,
        "byStatus": {},
        "reviewed": false
      }
    }
  },
  "limitations": {
    "zh": "這是已公開、已修補漏洞的偵測基準，不是新發現。模型訓練資料可能已包含此公告或修補，命中不能證明模型是從程式碼推理出來的。候選與 needs_human 都不是自動確認，也沒有執行 PoC。比對標準在掃描前登錄；其他輸出只列數量，未經審閱、未公開位置。原始 report.json 與 trace 不公開，只列 SHA-256。單次執行，模型輸出有隨機性，重跑結果可能不同。",
    "en": "This is a detection benchmark on an already disclosed and patched issue, not a new discovery. The models may have seen the advisory or the fix during training, so a match does not show that the model reasoned it out from the code. Candidates and needs_human results are not automatic confirmation, and no PoC was run. Match criteria were registered before scanning. Other findings are listed as counts only; they were not reviewed and their locations are not published. The raw report.json and trace are not public; only their SHA-256 is listed. Single run; model output is nondeterministic and a rerun may differ."
  }
}