diff --git a/.github/workflows/datasets-validate-all.yml b/.github/workflows/datasets-validate-all.yml index acfcdc9..95e79a2 100644 --- a/.github/workflows/datasets-validate-all.yml +++ b/.github/workflows/datasets-validate-all.yml @@ -2,10 +2,11 @@ name: datasets-validate-all # Runs data_validation/run_all_checks.py: every dataset's own validate.py # (including ones in sub-collections), then the shared checks in -# data_validation/validators/ on every data file. Then the data_validation -# test suite, and the cross-dataset consistency check. The coverage report -# and anomaly list go to the job summary for reviewers; they never fail -# the job. +# data_validation/validators/ on every data file, and the cross-dataset +# consistency check. The tests job runs the data_validation test suite on +# each supported Python. The coverage report and anomaly list go to the job +# summary for reviewers; they never fail the job. + on: push: branches: [main] @@ -43,9 +44,6 @@ jobs: - name: Cross-dataset consistency run: python data_validation/qc_tools/consistency_check.py - - name: data_validation tests - run: python -m pytest data_validation/tests -v - - name: Coverage report and anomalies (job summary) if: always() run: | @@ -58,3 +56,25 @@ jobs: python data_validation/qc_tools/anomaly_detector.py echo '```' } >> "$GITHUB_STEP_SUMMARY" + + # The tooling's own tests on every Python release it supports. + tests: + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + python-version: ['3.11', '3.12', '3.13'] + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: ${{ matrix.python-version }} + + - name: Install requirements + run: python -m pip install --quiet -r data_validation/requirements.txt + + - name: data_validation tests + run: python -m pytest data_validation/tests -v diff --git a/.github/workflows/reference-data-refresh.yml b/.github/workflows/reference-data-refresh.yml new file mode 100644 index 0000000..3288689 --- /dev/null +++ b/.github/workflows/reference-data-refresh.yml @@ -0,0 +1,69 @@ +name: reference-data-refresh + +# Monthly: regenerate the MITRE ATLAS and CWE tables in +# data_validation/reference_data/ from MITRE's latest releases. If anything +# changed, push the result to a branch and open an issue so a maintainer can +# open the PR (this repository does not let workflows open pull requests). +on: + schedule: + - cron: '17 6 2 * *' # 06:17 UTC on the 2nd of each month + workflow_dispatch: + +permissions: + contents: write + issues: write + +jobs: + refresh: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: '3.11' + + - name: Install requirements + run: python -m pip install --quiet -r data_validation/requirements.txt + + - name: Regenerate ATLAS and CWE tables + run: python data_validation/reference_data/update_reference_data.py + + - name: Run the checks against the new tables + id: checks + continue-on-error: true + run: python data_validation/run_all_checks.py --no-shared && python data_validation/validators/crossref_validator.py + + - name: Push a branch and open an issue if anything changed + env: + GH_TOKEN: ${{ github.token }} + CHECKS: ${{ steps.checks.outcome }} + run: | + if git diff --quiet -- data_validation/reference_data; then + echo "Reference data is current." + exit 0 + fi + branch="automation/reference-data-$(date -u +%Y-%m)" + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git switch -c "$branch" + git add data_validation/reference_data + git commit -m "reference_data: refresh MITRE ATLAS and CWE tables" + git push --force origin "$branch" + versions=$(grep -E '^\| (MITRE ATLAS|CWE) ' data_validation/reference_data/SOURCES.md | cut -d'|' -f2,4) + { + echo "The monthly refresh regenerated the MITRE ATLAS and CWE tables." + echo + echo "Versions: $versions" + echo + echo "Identifier check against the existing data: **$CHECKS**. A failure usually means MITRE retired or renamed an ID the datasets cite; the crossref output in the run log names the entries." + echo + echo "Open the PR: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/compare/main...${branch}?expand=1" + echo + echo "Run: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" + } > body.md + if gh issue list --state open --search "in:title Reference data refresh $(date -u +%Y-%m)" --json number --jq 'length' | grep -q '^0$'; then + gh issue create --title "Reference data refresh $(date -u +%Y-%m)" --body-file body.md + fi diff --git a/data_validation/README.md b/data_validation/README.md index a8283e7..09b6e81 100644 --- a/data_validation/README.md +++ b/data_validation/README.md @@ -40,7 +40,8 @@ The tooling has two jobs: keep the research data behind OWASP deliverables (the |---|---|---| | `schema_validator.py` | Schema violations, for files no dataset validator covers | File with no schema to check against | | `dsgai_mapping_check.py` | DSGAI ID not in the taxonomy; a mapping value that is not a DSGAI ID | Same ID twice in one mapping; more than 6 mappings | -| `crossref_validator.py` | Malformed CVE/GHSA/CWE/ATLAS ID; CVE year in the future; unknown CWE or ATLAS ID | Deprecated CWE; retired ATLAS ID; malformed ID in free text (often a placeholder) | +| `crossref_validator.py` | Malformed CVE/GHSA/CWE/ATLAS ID; CVE year in the future; unknown CWE, ATLAS or OWASP Top 10 ID (`LLM01:2026`, `ASI01:2026`) | Deprecated CWE; retired ATLAS ID; OWASP ID without its edition year; malformed ID in free text (often a placeholder) | +| `severity_check.py` | CVSS v3.x/v4.0 vector that doesn't parse; score that doesn't match its vector; qualitative rating outside the score's FIRST band | Score with no vector | | `anonymization_scanner.py` | — | Email addresses, keys and tokens, private or (in a network context) public IPs, internal hostnames, home paths, SSNs | | `dedup_checker.py` | Two records in one dataset with the same ID | Records with identical or ≥ 80% similar text | @@ -75,7 +76,7 @@ After the automated checks pass, contributions are reviewed by cybersecurity and ## Running the checks -Python 3.10 or higher. +Python 3.11 or higher (CI tests 3.11, 3.12 and 3.13). ```bash pip install -r data_validation/requirements.txt @@ -111,13 +112,13 @@ data_validation/ ├── qc_tools/ Reports for reviewers ├── schemas/ Schemas for datasets without their own schema.json │ (the rest are pointers to the dataset-local schemas) -├── reference_data/ DSGAI, MITRE ATLAS and CWE lookup tables; see SOURCES.md +├── reference_data/ DSGAI, MITRE ATLAS, CWE and OWASP Top 10 lookup tables; see SOURCES.md └── tests/ Tests and deliberately valid/invalid fixtures ``` Dataset-local schemas (`datasets//schema.json`) are authoritative. `schemas/exploit`, `vulnerability`, `riskassessment` and `agentdataflow_trace` are kept only as `$ref` pointers to them; `schemas/incident`, `rag`, `crossframework_mapping` and `promptinj_testcase` are the only schemas for their data. -The ATLAS and CWE tables are generated from MITRE's releases by `reference_data/update_reference_data.py`; don't edit them by hand. +The ATLAS and CWE tables are generated from MITRE's releases by `reference_data/update_reference_data.py`; don't edit them by hand. The `reference-data-refresh` workflow runs it on the 2nd of each month and, when MITRE has published something new, pushes a branch and opens an issue for a maintainer to turn into a PR. `owasp_top10.csv` is maintained by hand when OWASP publishes a new edition. --- diff --git a/data_validation/SETUP.md b/data_validation/SETUP.md index a6e47a7..4912e98 100644 --- a/data_validation/SETUP.md +++ b/data_validation/SETUP.md @@ -17,9 +17,9 @@ The data validation pipeline is a set of Python scripts that check contributed d ## Prerequisites -### Python 3.10+ +### Python 3.11+ -The scripts require Python 3.10 or higher. Most modern systems have Python pre-installed. +The scripts require Python 3.11 or higher. Most modern systems have Python pre-installed. **Check if you have it:** @@ -27,7 +27,7 @@ The scripts require Python 3.10 or higher. Most modern systems have Python pre-i python3 --version ``` -If you see `Python 3.10.x` or higher, you're good. If not: +If you see `Python 3.11.x` or higher, you're good. If not: | Platform | How to install | |---|---| @@ -95,7 +95,7 @@ You'll know it's active when your terminal prompt changes to show `(venv)` at th pip install -r requirements.txt ``` -> **What this does:** Reads the `requirements.txt` file and installs all the Python libraries the validation scripts need. That is `jsonschema` (schema validation) and `pytest` (the tests), plus `pyyaml`, which only the reference-data refresh script uses. +> **What this does:** Reads the `requirements.txt` file and installs all the Python libraries the validation scripts need. That is `jsonschema` with its format checkers (schema validation, including dates and URIs) and `pytest` (the tests), plus `pyyaml`, which only the reference-data refresh script uses. **If you get a permissions error:** Make sure your virtual environment is activated (Step 2). If you're not using a virtual environment, add `--user` to the command: `pip install --user -r requirements.txt` @@ -169,7 +169,7 @@ Python might be installed as `python` instead of `python3` on your system (commo python --version ``` -If that shows 3.10+, use `python` everywhere this guide says `python3`. +If that shows 3.11+, use `python` everywhere this guide says `python3`. ### "No module named 'jsonschema'" (or any other module) diff --git a/data_validation/reference_data/SOURCES.md b/data_validation/reference_data/SOURCES.md index d095de6..6596788 100644 --- a/data_validation/reference_data/SOURCES.md +++ b/data_validation/reference_data/SOURCES.md @@ -6,8 +6,11 @@ Lookup tables the validators check identifiers against. |---|---|---|---| | DSGAI | `dsgai_entries.json` | 1.0 | OWASP GenAI Data Security Risks and Mitigations 2026 (kept identical to `datasets/_shared/dsgai_taxonomy.json`; a test enforces it) | | MITRE ATLAS | `mitre_atlas_techniques.csv` | 2026.09 | latest release listed in `https://raw.githubusercontent.com/mitre-atlas/atlas-data/main/dist/manifest.yaml` | +| OWASP Top 10s | `owasp_top10.csv` | LLM 2025, LLM 2026, Agentic 2026 | LLM: `https://github.com/GenAI-Security-Project/GenAI-LLM-Top10` (2026 published 2026-08-04). Agentic: `https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/` (published 2025-12-09) | | CWE | `cwe_ids.csv` | 4.20 | `https://cwe.mitre.org/data/xml/cwec_latest.xml.zip` (weaknesses, categories and views) | +`owasp_top10.csv` is maintained by hand. The 2026 LLM list renumbered the entries (LLM03 was Supply Chain in 2025 and is Excessive Agency in 2026), so IDs always carry the edition year; `equivalent_2025` gives the 2025 ID each 2026 entry continues (LLM08:2026 Hidden Context Exposure broadens LLM07:2025 System Prompt Leakage). OWASP writes the Agentic IDs without a year (ASI01); this repository adds `:2026` so a future edition cannot collide. + Regenerate the ATLAS and CWE tables with `python update_reference_data.py`; it fills in the Version column. Do not edit those two CSVs by hand. `datasets/_shared/dsgai_taxonomy.json` is the DSGAI list the validators use. `dsgai_entries.json` is kept because the Turkish prompt-injection validator reads it. diff --git a/data_validation/reference_data/owasp_top10.csv b/data_validation/reference_data/owasp_top10.csv new file mode 100644 index 0000000..ead2e4f --- /dev/null +++ b/data_validation/reference_data/owasp_top10.csv @@ -0,0 +1,31 @@ +id,list,edition,name,equivalent_2025 +LLM01:2025,LLM,2025,Prompt Injection, +LLM02:2025,LLM,2025,Sensitive Information Disclosure, +LLM03:2025,LLM,2025,Supply Chain, +LLM04:2025,LLM,2025,Data and Model Poisoning, +LLM05:2025,LLM,2025,Improper Output Handling, +LLM06:2025,LLM,2025,Excessive Agency, +LLM07:2025,LLM,2025,System Prompt Leakage, +LLM08:2025,LLM,2025,Vector and Embedding Weaknesses, +LLM09:2025,LLM,2025,Misinformation, +LLM10:2025,LLM,2025,Unbounded Consumption, +LLM01:2026,LLM,2026,Prompt Injection,LLM01:2025 +LLM02:2026,LLM,2026,Sensitive Information Disclosure,LLM02:2025 +LLM03:2026,LLM,2026,Excessive Agency,LLM06:2025 +LLM04:2026,LLM,2026,Supply Chain,LLM03:2025 +LLM05:2026,LLM,2026,Data and Model Poisoning,LLM04:2025 +LLM06:2026,LLM,2026,Unbounded Consumption,LLM10:2025 +LLM07:2026,LLM,2026,Misinformation,LLM09:2025 +LLM08:2026,LLM,2026,Hidden Context Exposure,LLM07:2025 +LLM09:2026,LLM,2026,Vector and Embedding Weaknesses,LLM08:2025 +LLM10:2026,LLM,2026,Improper Output Handling,LLM05:2025 +ASI01:2026,ASI,2026,Agent Goal Hijack, +ASI02:2026,ASI,2026,Tool Misuse and Exploitation, +ASI03:2026,ASI,2026,Identity and Privilege Abuse, +ASI04:2026,ASI,2026,Agentic Supply Chain Vulnerabilities, +ASI05:2026,ASI,2026,Unexpected Code Execution, +ASI06:2026,ASI,2026,Memory and Context Poisoning, +ASI07:2026,ASI,2026,Insecure Inter-Agent Communication, +ASI08:2026,ASI,2026,Cascading Failures, +ASI09:2026,ASI,2026,Human-Agent Trust Exploitation, +ASI10:2026,ASI,2026,Rogue Agents, diff --git a/data_validation/requirements.txt b/data_validation/requirements.txt index ba66d86..44a7ce1 100644 --- a/data_validation/requirements.txt +++ b/data_validation/requirements.txt @@ -1,5 +1,7 @@ # Validators, QC tools and their tests -jsonschema>=4.18.0 +# [format-nongpl] adds the checkers for "uri" and other formats; without it +# jsonschema treats those formats as annotations and never fails them. +jsonschema[format-nongpl]>=4.18.0 pytest>=7.0.0 # Only for reference_data/update_reference_data.py (refreshing the ATLAS table) pyyaml>=6.0 diff --git a/data_validation/run_all_checks.py b/data_validation/run_all_checks.py index e764e63..940ada2 100644 --- a/data_validation/run_all_checks.py +++ b/data_validation/run_all_checks.py @@ -9,7 +9,8 @@ silently passing. 2. Shared checks (data_validation/validators/) on every data file: schema (for files no dataset validator covers), DSGAI IDs, CVE/CWE/ATLAS - IDs, anonymization patterns and duplicates. Errors fail the run; + and OWASP Top 10 IDs, CVSS scores and ratings, anonymization patterns + and duplicates. Errors fail the run; heuristic warnings (anonymization, near-duplicates, retired IDs) are counted, and printed with --verbose. @@ -34,6 +35,7 @@ from validators import ( # noqa: E402 anonymization_scanner, crossref_validator, dedup_checker, dsgai_mapping_check, schema_validator, + severity_check, ) from validators._common import ( # noqa: E402 ERROR, SKIP_DIRS, Finding, ensure_utf8_stdout, iter_data_files, load_json, load_taxonomy_ids, @@ -100,6 +102,7 @@ def shared_checks(dataset: Path, datasets_root: Path) -> tuple[int, list[Finding findings += schema_validator.validate_file(path, dataset_root=dataset) findings += dsgai_mapping_check.check_data(path, data, taxonomy) findings += crossref_validator.check_data(path, data) + findings += severity_check.check_data(path, data) findings += anonymization_scanner.check_data(path, data) records, load_errors = dedup_checker.load_records(files) findings += load_errors + dedup_checker.check_records(records) @@ -162,7 +165,7 @@ def main(argv: list[str] | None = None) -> int: checked_files = errors = warnings = 0 if not args.no_shared: - print("\nShared checks (schema, DSGAI IDs, CVE/CWE/ATLAS IDs, anonymization, duplicates):") + print("\nShared checks (schema, DSGAI, CVE/CWE/ATLAS/OWASP IDs, CVSS, anonymization, duplicates):") for dataset in datasets: n, findings = shared_checks(dataset, datasets_root) if not n: diff --git a/data_validation/schemas/crossframework_mapping.schema.json b/data_validation/schemas/crossframework_mapping.schema.json index f732ac2..3513cb5 100644 --- a/data_validation/schemas/crossframework_mapping.schema.json +++ b/data_validation/schemas/crossframework_mapping.schema.json @@ -1,5 +1,5 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", + "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "Cross-Framework Control Mapping Entry", "type": "object", "required": ["dsgai_id", "dsgai_name", "framework", "control_id", "control_name", "relationship"], diff --git a/data_validation/schemas/incident.schema.json b/data_validation/schemas/incident.schema.json index e940981..17727eb 100644 --- a/data_validation/schemas/incident.schema.json +++ b/data_validation/schemas/incident.schema.json @@ -1,5 +1,5 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", + "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "Incident Dataset Entry", "type": "object", "required": ["incident_id", "date", "summary", "dsgai_mapping", "attack_vector", "data_types_affected", "impact"], diff --git a/data_validation/schemas/promptinj_testcase.schema.json b/data_validation/schemas/promptinj_testcase.schema.json index 99aec49..7abf4c5 100644 --- a/data_validation/schemas/promptinj_testcase.schema.json +++ b/data_validation/schemas/promptinj_testcase.schema.json @@ -1,5 +1,5 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", + "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "Prompt Injection and Data Extraction Test Case", "type": "object", "required": ["testcase_id", "category", "dsgai_mapping", "prompt", "expected_secure", "expected_vulnerable", "severity"], diff --git a/data_validation/schemas/rag.schema.json b/data_validation/schemas/rag.schema.json index 3d11807..c478b40 100644 --- a/data_validation/schemas/rag.schema.json +++ b/data_validation/schemas/rag.schema.json @@ -1,5 +1,5 @@ { - "$schema": "http://json-schema.org/draft-07/schema#", + "$schema": "https://json-schema.org/draft/2020-12/schema", "title": "RAG Poisoning and Retrieval Integrity Entry", "type": "object", "required": ["document_id", "category", "dsgai_mapping", "content"], diff --git a/data_validation/tests/fixtures/cvss40_reference_scores.json b/data_validation/tests/fixtures/cvss40_reference_scores.json new file mode 100644 index 0000000..d9259ee --- /dev/null +++ b/data_validation/tests/fixtures/cvss40_reference_scores.json @@ -0,0 +1 @@ +[["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:H/E:P/CR:L/IR:M/AR:L/MAV:N/MPR:L/MVI:L/MSA:S",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/CR:H/MSC:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H/MAT:N/MVI:L/MSC:L",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/CR:M/MAV:N/MPR:L/MVA:H",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:N/SA:L/CR:H/MAT:N",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:N/E:A/IR:M/AR:H/MAV:N/MAT:N/MPR:H/MUI:A/MVI:N/MSI:S",7.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/AR:M/MAV:N/MAT:N/MVC:H/MVI:H/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:H/SC:L/SI:N/SA:L/CR:L/MUI:N/MVA:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:L/SI:N/SA:L/E:P/MAV:N/MAC:L/MVC:H/MVI:N/MSC:H/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:L/SC:N/SI:H/SA:N/CR:L/AR:H/MAV:N/MVA:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:L/SC:N/SI:L/SA:N/MVC:N/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:L/VA:H/SC:L/SI:H/SA:N/MPR:L/MUI:P/MSC:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:L/SI:H/SA:L/IR:M/MVA:L/MSA:S",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:U/IR:M/MAC:L/MVC:L/MVI:L",2.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:H/SI:N/SA:L/E:A/MPR:L/MUI:N/MVA:N/MSC:L/MSI:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/CR:M/AR:L/MAV:N/MPR:N",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:H/E:P/AR:L/MVA:H/MSC:N/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:L/SI:N/SA:N/CR:M/IR:M/AR:M",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/IR:H/MAC:L/MAT:N",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:H/SC:L/SI:N/SA:L/IR:M/MAC:L/MVC:H/MVA:L",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:H/SI:N/SA:H/CR:H/MAT:N/MVC:H",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:N/SI:H/SA:N/E:P/CR:H/MAV:N/MVI:L/MVA:H",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:L/SA:L/CR:H/MAV:N/MAC:L/MVI:N/MVA:N/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:N/SA:H/AR:H/MAV:N/MAC:L/MAT:N/MPR:L/MVC:L/MVI:L/MVA:L/MSI:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:H/CR:L/MAV:N/MPR:N/MUI:A/MVC:H/MVA:N/MSC:L/MSA:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:A/MAV:N/MAC:L/MAT:N/MUI:N/MSC:L/MSI:S",9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:N/SC:H/SI:N/SA:L/IR:L/MAV:N/MAT:N/MVC:L",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/CR:M/MAV:N/MSA:S",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:N/SA:H/MAC:L/MAT:N/MVI:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N/CR:M/IR:H/MAV:N/MAT:N/MVI:N/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:L/SA:H/CR:H/MAC:L/MAT:N/MPR:H/MUI:N/MSC:N/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:L/E:U/MAC:L/MPR:H",2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:N/IR:M/MAT:N/MPR:L/MVI:L/MSC:H",6.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:H/SI:L/SA:L/E:U/MAC:L/MUI:A/MSA:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:H/SI:N/SA:H/IR:M/MAC:L/MAT:N/MVI:N/MSI:S/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:N/SI:H/SA:H/IR:M/MAT:N/MVI:N/MVA:N",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/IR:M/AR:M/MVC:H/MSI:H/MSA:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:H/E:U/AR:M/MAC:L/MUI:N/MVI:L/MVA:L",4.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:H/SI:N/SA:L/E:U/CR:M/IR:H/MAV:N/MAT:N/MPR:H/MSC:L",4.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:H/SC:N/SI:H/SA:H/MAC:L/MPR:L/MUI:P/MVC:N/MVI:H/MSC:L",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:L/AR:L/MPR:H/MUI:P/MVA:L/MSC:H",4.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/IR:M",6.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:H/SA:N/IR:H/MAT:N/MPR:H/MUI:A/MVA:H/MSI:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/AR:H/MAV:N/MAT:N/MUI:A/MVA:H/MSC:N/MSI:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/IR:M/MAT:N/MPR:H/MUI:P/MVC:N/MSI:S/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:H/SC:L/SI:H/SA:H/E:U/MAV:N/MAT:N/MPR:L/MUI:N/MVI:H",5.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:H/MAV:N/MSA:S",7.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:L/SA:N/AR:M/MSI:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:N/SI:L/SA:N/CR:H/MAC:L/MAT:N/MUI:P/MVC:L/MVA:L/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:A/IR:H/MAC:L/MPR:N/MUI:A/MVA:N/MSI:S/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:H/SI:N/SA:H/E:U/CR:M/AR:L/MUI:N/MVC:L/MVI:H/MVA:N/MSA:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P/MAT:N/MVI:L",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:H/SA:H/E:P/IR:L/AR:H/MAV:N/MAT:N",5.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:L/CR:M/AR:H/MAV:N/MUI:N/MSC:N/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:H/SC:L/SI:H/SA:N/IR:H/AR:M/MPR:N/MVC:N/MSC:L",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:H/SI:N/SA:L/MAV:N/MAC:L/MVI:H/MVA:N",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:H/SI:N/SA:H/E:P/CR:M/IR:H/MPR:N/MUI:A/MVI:L/MSI:H",5.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:L/MAV:N/MPR:L/MVI:L/MSC:N",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:L/SA:L/E:A/CR:H/IR:H/AR:L/MUI:P/MVC:L",5.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:H/SI:H/SA:L/IR:M/AR:H/MAV:N/MAT:N/MVC:H/MVA:L/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:H/CR:H/IR:L/AR:H/MPR:L/MUI:N/MVA:N/MSA:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:H/SA:N/CR:M/IR:H/AR:M/MAC:L/MSC:H/MSI:S/MSA:S",8.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:A/AR:L/MPR:H/MUI:A/MVC:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:L/SA:N/IR:H/MAT:N/MVC:N/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:H/SI:L/SA:L/MAC:L/MPR:H/MUI:N/MVC:N/MVA:N",6.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:L/IR:H/AR:H/MAV:N/MAT:N/MVA:H/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:H/IR:M/MAV:N/MAC:L/MSC:H",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:L/SC:H/SI:N/SA:H/IR:L/MVC:L/MVA:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:L/VA:H/SC:H/SI:N/SA:L/MAV:N/MPR:L/MUI:P/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H/CR:M/MUI:N/MVI:H/MVA:H/MSI:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N/E:U",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/MAV:N/MAC:L/MSC:N",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:L/SA:H/CR:H/MPR:L/MUI:A/MSC:L",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/AR:L/MAC:L/MAT:N/MUI:A/MVC:H/MVA:L/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L/MAC:L/MVC:H/MVI:L/MSC:L/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/IR:L/AR:H/MUI:P/MVA:N/MSC:H/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:L/SC:L/SI:L/SA:H/CR:M/MPR:N/MUI:P",6.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:L/MAC:L/MAT:N/MVI:H",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:H/SI:L/SA:L/AR:H/MAV:N",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:P/CR:M/IR:H/MAT:N/MPR:L/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/CR:H/MPR:L/MUI:A",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:H/SI:L/SA:H/AR:M/MAT:N/MSC:H",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:L/E:U/MAT:N/MUI:A",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:L/SA:N/MAV:N/MPR:H/MVA:N/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:H/E:P/CR:M/AR:M/MPR:H/MUI:N/MVA:N/MSA:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:H/SA:H/CR:M/IR:H/MAV:N/MAC:L/MVC:H/MVA:N",7.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:H/SA:H/E:P/CR:M/MAT:N/MUI:A/MVI:N/MSC:L",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:H/SI:L/SA:N/CR:L/MAV:N/MVI:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:L/SI:H/SA:H/CR:L/MPR:H/MUI:N/MSI:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:U/MVA:N/MSC:N",4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:N/SI:L/SA:L/E:U/CR:M/MAV:N/MAC:L/MAT:N/MVI:H/MVA:N/MSC:N/MSA:S",8.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:U/IR:M/AR:H/MAV:N/MAC:L/MAT:N/MUI:P/MVC:L",2.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:N/SA:H/MUI:A/MVC:N/MVI:L/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:L/CR:L/MAV:N/MAT:N/MVI:L/MVA:N",5.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:L/SC:H/SI:N/SA:L/MUI:N/MVI:L/MSC:L/MSI:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:H/SA:N/CR:H/IR:L/AR:H/MAC:L/MUI:A/MVA:H/MSC:N/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:U/MAV:N/MVC:N/MSC:N",1.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/CR:H/MAT:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N/E:P/CR:M/IR:H/MAV:N/MPR:N/MVC:N/MVI:L/MSA:S",6.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:H/SA:L/E:U/IR:M/MAV:N/MVC:L/MSI:S",4.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:L/SI:N/SA:N/E:U/CR:M/AR:L/MSA:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AR:L/MAT:N/MPR:H/MVC:L/MVA:N/MSI:S",7.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:L/MVA:L",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/MAV:N/MAC:L/MPR:H/MUI:A/MVC:H",6.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:H/IR:M/AR:L/MSC:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/MAV:N/MAC:L/MPR:L/MVI:N/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:L/SC:L/SI:H/SA:H/E:A/CR:L/IR:M/AR:M/MAT:N/MVC:L/MVA:N/MSI:S/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:L/MVI:H/MVA:N",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:L/SA:H/E:P/MAV:N/MAT:N",4.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:L/AR:M/MAT:N/MUI:N/MVI:N",6.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/MAT:N/MVI:L/MVA:H/MSC:N/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/IR:H/MAV:N/MAC:L/MAT:N/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/MAV:N/MAT:N/MPR:N/MSA:H",2.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L/IR:H/MAC:L/MPR:N/MSI:H/MSA:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/IR:L/MAV:N/MAC:L/MPR:H/MSC:H/MSI:S/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:H/AR:L/MAC:L/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/MAC:L/MSC:N",6.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:H/SA:H/E:P/AR:M/MAT:N/MVI:L/MVA:H",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:H/SC:L/SI:N/SA:N/E:U/AR:M/MVC:L/MSA:S",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:P/MAT:N",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:H/CR:M/MSC:L",8.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:L/AR:H/MAV:N/MSI:S/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:H/SC:H/SI:N/SA:L/CR:L/MAC:L/MVI:L/MSC:N/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:L/SA:N/CR:L/MAC:L/MVI:N/MVA:L/MSC:H/MSI:S/MSA:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AR:M/MAC:L/MAT:N/MPR:H/MVC:H/MVA:N",4.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:H/SC:H/SI:L/SA:L/MVI:N/MVA:L",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:H/SA:H/E:A/CR:H/IR:M/AR:M/MAT:N/MUI:P/MVC:N/MVA:L",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/AR:M/MUI:A/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:L/SC:H/SI:H/SA:L/CR:H/IR:L/MAT:N/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/CR:L/AR:L/MPR:N/MUI:P/MVC:L/MVA:L/MSI:S/MSA:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N/MUI:A/MVI:H/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:L/SI:H/SA:N/E:U/CR:H/MAV:N/MVC:N/MVA:L",2.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/IR:H/MAC:L/MAT:N/MVI:N/MVA:N/MSC:H",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:H/SI:N/SA:H/E:P/CR:H/MVA:N/MSC:L/MSA:S",8.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/IR:M/MAT:N/MPR:H/MVI:H/MVA:N/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:L/SI:N/SA:L/CR:L/IR:M/MPR:H/MVC:H",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/CR:L/IR:M/MPR:L/MUI:P/MVI:N/MSC:N/MSI:S/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:H/SC:N/SI:N/SA:H/E:A/IR:H/MAV:N/MAT:N/MUI:N/MVA:H/MSC:L",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:L/SI:H/SA:N/CR:M/IR:H/MAV:N/MUI:P/MVA:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/CR:M/AR:M/MAT:N/MUI:N/MVA:N/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:H/SI:L/SA:H/E:A/IR:M/MAT:N/MPR:N/MUI:P/MVC:L/MVI:L",6.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/IR:M/MAV:N/MAC:L/MAT:N/MPR:L/MUI:A/MVI:N",4.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:H/SI:L/SA:L/AR:H/MPR:N/MUI:P/MSI:S/MSA:S",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:H/SC:H/SI:L/SA:L/AR:H/MAV:N/MAC:L/MPR:N/MVI:L/MSI:S/MSA:S",9.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:H/SC:L/SI:H/SA:N/CR:M/IR:H/MAC:L/MAT:N/MVA:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L/CR:L/IR:M/MVI:N",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N/IR:L/AR:M/MAT:N/MVC:N/MVI:N/MSI:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:L/SC:L/SI:L/SA:L/E:P/MUI:A/MVA:H",5.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:L/CR:H/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/IR:H/AR:H/MUI:N",6.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/CR:L/AR:L/MAC:L/MPR:H/MUI:A/MVI:L/MVA:N/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:L/SA:H/AR:L/MUI:P",6.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N/E:P/IR:H/AR:L/MAC:L/MVC:N/MSC:N/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:L/E:U/IR:M/AR:M/MAV:N/MPR:L/MVA:L",1.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:U/CR:M/AR:M/MUI:P/MSC:H",2.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/MAC:L/MAT:N/MVC:H/MSC:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:H/VA:L/SC:H/SI:L/SA:N/E:A/CR:M/IR:M/AR:H/MAC:L/MPR:N/MVI:H",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:H/E:A/CR:L/MAC:L/MAT:N/MPR:H/MVI:L",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:H/SA:H/CR:H/IR:H/AR:H/MAC:L/MVI:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/E:U/MVI:N/MVA:L/MSI:H/MSA:S",5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:H/MPR:N/MUI:N/MVC:H/MSC:N/MSI:S/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/MVC:L/MVI:L",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/CR:L/MAV:N/MSC:H/MSI:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N/E:A/IR:H/AR:H/MAC:L/MAT:N",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H",6.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/CR:L/MUI:A/MVC:N/MVI:N/MVA:L/MSA:S",7.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:H/SI:L/SA:N/CR:M/MAV:N/MAT:N/MVI:H/MVA:N/MSC:N",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:L/SA:H/E:P/CR:H/IR:M/MAT:N/MPR:L/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:L/SI:H/SA:N/E:P/AR:M/MAV:N/MAC:L/MPR:H/MSI:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:H/SI:N/SA:N/E:U/MAT:N/MPR:H/MUI:N/MSI:S",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/AR:H/MPR:N/MUI:N/MVA:N/MSC:L/MSI:S",9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:L/SC:H/SI:N/SA:L/AR:M/MAV:N/MAC:L/MUI:N/MSC:N/MSA:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:L/SA:H/CR:M/AR:L/MPR:H",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:N/CR:H/MPR:N",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:A/CR:H/MAV:N/MAC:L/MPR:N/MUI:A/MVC:L/MSC:N/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:P/MAC:L/MPR:N/MUI:N/MVC:L/MSA:S",9.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:H/CR:H/AR:L/MPR:N/MUI:P/MVA:L/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:N/SA:L/MSC:L",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:H/SA:N/E:A/IR:H/AR:M/MVC:H",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:H/SC:H/SI:H/SA:N/MPR:H/MUI:P/MVC:H/MVA:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:L/SC:N/SI:L/SA:L/E:P/CR:M/IR:H/MAV:N/MAT:N/MUI:P/MSA:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:L/SI:H/SA:N/CR:H/MAV:N/MVC:H/MVA:H",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/MVC:H/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:L/SI:L/SA:H/E:U/MVI:H",5.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:H/SC:N/SI:L/SA:L/E:U/IR:H/MAT:N/MVC:H/MVA:N/MSI:S/MSA:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/E:U/AR:L/MAV:N/MPR:N/MUI:A/MVA:L/MSI:S",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:H/SA:N/IR:H/MVC:N",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/IR:H/MUI:P/MVI:L/MSI:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:H/SA:H/E:U/MPR:L/MVC:H/MVI:L",5.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:H/E:P/AR:H/MAV:N/MAT:N/MVC:L/MVA:H",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:L/SA:L/E:P/AR:M/MAV:N/MPR:H/MVC:L/MVA:N/MSC:N/MSI:S",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:L/CR:L/IR:L/MAV:N/MAT:N",5.4],["CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:H/SI:L/SA:H/E:A/CR:H/MAV:N/MAT:N/MVA:L",8.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L/E:A/IR:L/AR:M/MAV:N/MUI:N/MVC:L/MVI:N/MVA:L",5.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:H/IR:M/MAC:L/MAT:N/MVC:H/MVI:H/MSC:N",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:L/SC:N/SI:H/SA:H/E:P/CR:M/MAV:N",5.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:H/SC:H/SI:H/SA:L/MVA:N",6.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:N/IR:L/MAT:N/MUI:P/MSI:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:H/SA:L/MUI:A/MVC:N/MVI:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:L/SI:H/SA:N/MAT:N/MUI:P/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:H/SA:N/E:U/AR:L/MSC:N/MSI:S/MSA:S",6.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/AR:M/MAT:N/MVA:H/MSC:H/MSA:S",10],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:U/MVC:N/MVI:H/MVA:N/MSA:S",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:N/IR:L/AR:L/MAV:N/MAC:L/MVA:N",6.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:H/CR:M/IR:M/MPR:H/MVC:N/MVI:L",6.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:L/SI:N/SA:H/CR:M/MAT:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:L/IR:L/MAV:N/MAT:N/MPR:H/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:H/SI:L/SA:H/E:U/IR:L/MAV:N/MPR:L/MUI:N/MSC:L",4.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:L/SI:L/SA:L/IR:M/MAC:L/MPR:L/MUI:P",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:H/E:A/CR:M/IR:H/MAT:N/MPR:L/MVC:N/MVI:H/MSC:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:L/SI:N/SA:L/E:U/CR:H/IR:M/AR:H",4.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:L/SA:H/E:U/CR:M/MVC:N/MVA:N/MSA:S",4.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/CR:L/IR:M/MAC:L/MAT:N/MPR:H/MUI:N/MVC:N/MVI:L/MSA:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/AR:L/MAC:L/MPR:N",5.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:N/SI:L/SA:N/AR:L/MUI:P/MVC:L/MVA:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/MAV:N/MAT:N/MUI:N/MVI:L",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:H/CR:L/MAV:N/MAC:L/MAT:N/MUI:P/MVC:L/MVI:L/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:H/E:U/CR:M/AR:L/MAV:N/MAC:L/MVC:H/MVA:L/MSC:H",4.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:A/IR:M/MAC:L/MUI:N/MVI:N",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:H/SC:L/SI:H/SA:H/IR:L/MAV:N/MAT:N/MUI:A/MVA:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/IR:M/AR:M/MVC:L/MVA:H/MSC:N/MSI:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:H/SC:H/SI:N/SA:H/E:P/CR:H/IR:M/MVC:N/MSI:S/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:L/SC:L/SI:H/SA:H/E:P/MUI:N/MVC:H",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:H/SA:L/CR:M/IR:H/MAV:N/MAT:N/MUI:A/MVC:H/MSC:H/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:L/SI:L/SA:N/E:U/CR:M/MAC:L/MPR:H",4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:H/SA:H/MAV:N/MAT:N/MVI:L",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/IR:H/MAC:L/MVC:N/MVA:L/MSA:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:H/AR:H/MAV:N/MPR:L/MUI:N/MVC:N",6.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/CR:M/MAC:L/MUI:P",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:H/SA:N/CR:M/MVA:L/MSA:S",9.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:L/E:P/IR:L/MUI:N",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:H/CR:H/IR:L/AR:L/MAV:N/MAT:N/MVI:L",6.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:L/SA:L/IR:H/MPR:H/MVC:H/MVI:L/MSC:H",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:L/VA:L/SC:N/SI:N/SA:L/CR:H/AR:H/MAT:N/MVC:L/MVA:N",4.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:L/SC:L/SI:N/SA:H/E:A/CR:H/MAV:N/MVC:H/MVI:L/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:L/MPR:H/MUI:N/MVC:H/MVA:N",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:H/SI:H/SA:N/IR:H/MUI:A/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:L/SA:H/E:A/AR:H/MVI:N/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:H/SC:L/SI:N/SA:H/IR:L/AR:L/MPR:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:H/SI:N/SA:N/MAC:L/MPR:L/MVC:L/MVI:L/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:H/SA:L/MAC:L/MPR:L/MVC:N",6.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:L/SA:H/E:A/AR:H/MAC:L/MUI:A/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:L/SC:H/SI:N/SA:L/E:U/IR:M/MAT:N/MPR:H/MVA:N/MSI:S/MSA:S",4.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:U/CR:M/MAT:N/MVC:N",5.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/IR:L/AR:M/MPR:H/MUI:P/MSI:S/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:L/IR:M/MAV:N/MAT:N/MPR:H/MUI:N/MVC:L/MSC:N/MSI:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/MAV:N/MSC:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:N/AR:L/MAT:N/MPR:N/MVI:L/MVA:H/MSC:L/MSA:S",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:N/SA:N/CR:M/MUI:N/MVC:H/MVI:L/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N/MAC:L/MUI:N/MVC:N/MVA:H/MSC:L",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:H/IR:H/MAC:L/MAT:N/MUI:A/MVC:N/MVA:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:H/SC:H/SI:N/SA:L/AR:L/MAV:N/MAC:L/MPR:N/MSC:L/MSA:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:H/E:A/CR:H/MVC:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:H/SA:H/AR:M/MAT:N/MVC:H/MVI:H",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:L/SI:N/SA:H/IR:H/MAT:N/MUI:A/MVC:L/MVA:N/MSC:H/MSI:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/AR:M/MVC:N/MSC:N/MSA:S",6.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:H/SA:L/E:A/AR:H",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:P/MAC:L/MUI:A/MVA:N",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:H/SA:N/E:U/CR:L/AR:H/MAC:L/MPR:H/MVC:H/MVA:L/MSC:L/MSI:S",6.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/IR:H/MAC:L/MAT:N/MSC:H",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:H/CR:L/MUI:N/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:U/MAV:N/MAC:L/MUI:N/MVC:N/MSI:S",6.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:H/SA:L/CR:H/IR:H/MAV:N/MAT:N/MPR:L/MUI:P/MVA:L/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:L/IR:H/MAC:L/MUI:A/MVC:L/MVI:L/MSI:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:H/SI:H/SA:H/E:P/IR:L/MAT:N/MSC:L/MSI:S",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:L/SI:N/SA:H/E:P/CR:H/AR:M/MAC:L/MAT:N/MUI:A",5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:L/MAC:L/MPR:L/MVC:L/MSI:S/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:H/SI:L/SA:H/MPR:L/MVC:H",9.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:H/SI:L/SA:L/IR:M/AR:H/MAV:N/MPR:L/MUI:N/MSC:N",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:H/MAC:L/MUI:P/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:L/SI:N/SA:H/MPR:N/MUI:P/MVC:L/MVI:L/MSC:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:N/SA:L/CR:M/AR:M/MVI:N/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:L/VA:H/SC:L/SI:H/SA:N/MAV:N/MPR:H/MUI:P/MVC:H/MVA:N/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:H/SI:N/SA:H/MAV:N/MPR:L/MUI:N/MSI:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:H/SI:N/SA:H/AR:L/MAT:N/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:N/SA:L/CR:H/IR:L/MAC:L/MAT:N/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:L/IR:M/MAC:L/MPR:L/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:L/SC:N/SI:H/SA:H/E:A/MAV:N/MAC:L/MAT:N/MVC:H/MVI:L/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:H/SA:H/IR:M/MAT:N/MUI:A",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:L/SA:N/IR:M/MAC:L/MSC:L",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:H/SA:N/E:U/IR:L/MVA:L/MSI:S/MSA:S",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/MAC:L/MAT:N/MUI:P/MVI:L/MVA:L/MSI:S/MSA:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:H/SA:N/E:P/IR:M/MVC:N/MSC:H/MSI:S",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:L/SC:L/SI:N/SA:N/CR:H/IR:L/AR:L/MAC:L/MUI:P/MSC:N",5.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:H/SA:L/CR:L/IR:L/AR:H/MUI:N/MVC:N/MVA:N/MSC:L/MSI:S/MSA:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:L/SA:H/E:P/MAT:N/MPR:L/MSC:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:L/SI:N/SA:L/AR:M/MAC:L/MAT:N/MPR:N/MVA:L",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:U/CR:M/MAV:N/MVA:N",1.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:H/SI:N/SA:H/MAV:A/MAC:L/MAT:N/MPR:N/MVI:L/MSI:S/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:H/SI:L/SA:L/E:A/MAV:N/MAC:L/MVC:N/MSC:L/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:H/SC:H/SI:L/SA:N/AR:H/MVC:H",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:L/CR:L/IR:H/MAV:N/MPR:N/MVA:H/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/MAV:N/MPR:N/MVA:H",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:L/CR:L/MAV:A/MVA:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/IR:M/MAC:L/MUI:P/MVA:L/MSA:S",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/IR:L/MAV:N/MAC:L/MAT:N/MUI:A/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:L/SI:L/SA:L/MPR:H/MUI:N/MVC:L/MVA:H/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:L/SC:H/SI:H/SA:N/MAV:N/MAC:L/MAT:N/MPR:N/MUI:N/MVI:N/MSC:L/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/IR:H",8.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:H/SI:L/SA:L/IR:L/AR:M/MUI:A/MSA:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:H/SC:N/SI:H/SA:L/CR:H/IR:M/MUI:P/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:L/SI:H/SA:N/E:A/CR:H/IR:H/MAC:L/MUI:P/MVC:H/MVI:L",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:U/AR:H/MAT:N/MPR:L/MVA:H",4.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H/CR:M/MAV:N/MAC:L/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:H/IR:H/AR:H/MAT:N/MUI:P/MVC:N/MVA:N/MSC:L",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:L/SA:H/MAV:N/MPR:N/MVI:L/MVA:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/MAT:N/MPR:N/MUI:A/MVI:L",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/IR:H/MAV:N/MAT:N/MVC:H/MVI:N/MSI:S/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:L/SI:N/SA:H/AR:L/MUI:A/MVA:N",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:H/SC:H/SI:L/SA:H/CR:H/MAC:L/MAT:N/MPR:L/MUI:N/MVA:N/MSC:H/MSI:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:L/MPR:N/MUI:A/MVA:H/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:H/SA:H/E:A/CR:H/IR:M/MAT:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:H/SA:N/IR:M/MAC:L/MAT:N/MUI:A/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:H/SA:H/E:P/CR:M/AR:M/MAV:N/MPR:H/MUI:P/MVC:H/MVA:L/MSI:S",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:L/SI:H/SA:H/IR:L/AR:M/MAC:L/MAT:N/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:H/MAV:N/MAT:N/MPR:N/MUI:P/MSA:S",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:H/SC:H/SI:N/SA:N/IR:L/AR:H/MAV:N/MVA:L/MSC:H/MSA:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:H/CR:M/IR:H/MAV:N/MVA:N/MSA:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:U/IR:L/MPR:N/MSC:H/MSI:S",4.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:H/SA:L/E:P/MAV:N/MUI:P/MVC:L/MSA:S",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:N/SA:L/E:A/IR:M/MAV:N/MUI:P/MVC:N/MSC:N/MSI:S/MSA:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:H/SA:N/E:P/MPR:L/MUI:N/MVI:H/MVA:N",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N/E:U/CR:H/MAV:N/MAT:N/MPR:N/MVC:L/MVA:L",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:H/E:P/MAC:L/MUI:P/MVI:N/MSC:H/MSI:S",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:L/SA:L/CR:L/MVI:L/MVA:H/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:H/SC:N/SI:H/SA:L/AR:H/MUI:P/MVA:L",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:H/SA:N/CR:M/MAV:N/MVC:N/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:H/SC:H/SI:L/SA:L/CR:L/IR:M/MAT:N/MPR:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:L/SI:N/SA:L/MVC:N/MVI:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:H/SI:N/SA:L/E:P/AR:L/MVC:H/MVI:H/MVA:H/MSI:S/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:L/VA:H/SC:L/SI:H/SA:H/CR:M/AR:L/MAV:N/MAC:L/MVA:N/MSI:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L/E:A/AR:H/MAC:L/MVC:H/MVI:N/MVA:L/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:L/SA:H/AR:L/MPR:H/MVA:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/IR:L",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:L/CR:H/AR:H/MAV:N/MVI:H",6.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:L/SI:N/SA:H/MAV:N/MAT:N/MVI:H/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/IR:H/MVC:N/MVA:L/MSC:H",2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:H/E:P/IR:H/AR:H/MUI:A/MVC:H",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:H/SC:N/SI:L/SA:N/E:U/CR:H/IR:L/MVI:N",4.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:A/MAC:L/MUI:A/MVI:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:H/CR:H/IR:H/AR:L/MAT:N/MVC:H/MVA:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/IR:M/MAC:L/MPR:N/MVI:H/MSA:S",10],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:L/CR:M/IR:M/MPR:N/MVC:N/MVI:N/MVA:H",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:H/SC:L/SI:N/SA:L/CR:M/AR:M/MUI:P/MSC:H/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:H/SI:L/SA:N/MUI:A/MVI:H/MSC:L/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:H/SA:N/CR:M/AR:M/MAC:L/MVC:L/MSC:N",8.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:H/SA:L/E:A/IR:H/MPR:H/MVI:N/MVA:N/MSI:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:H/SA:L/AR:M/MPR:N/MVC:H",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:L/SI:H/SA:H/IR:M/AR:H/MPR:H/MUI:A/MVI:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:H/SI:N/SA:N/IR:L/MAC:L/MAT:N/MPR:L/MUI:A/MVC:N/MSC:L/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:L/E:A/CR:H/IR:M/AR:M/MPR:L/MUI:A/MVC:N/MSC:L/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L/MAV:N/MAT:N/MUI:P/MVC:H/MVA:L/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/IR:L/AR:H/MAV:N/MAT:N/MVC:H/MSC:H/MSI:S/MSA:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:N/E:U/CR:L/MAT:N/MUI:A/MVI:H/MVA:N/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:L/AR:M/MVA:L/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:H/SA:N/MAV:N/MAC:L/MVA:L",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:N/SA:L/IR:M/AR:M/MAV:N/MAT:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:H/SA:H/CR:L/IR:L/AR:M/MAC:L/MUI:N/MSC:H/MSA:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:L/SA:N/MVA:H/MSC:L",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:L/SA:L/IR:H/MAT:N/MUI:N",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:L/SC:L/SI:H/SA:H/CR:L/MAV:N/MSC:H",7.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:H/SA:H/E:P/IR:H/AR:M/MVA:L",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:H/SI:H/SA:L/E:A/AR:M/MAV:N/MVA:H/MSC:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/AR:M/MUI:N/MVC:H",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:L/SC:H/SI:L/SA:L/AR:M/MVC:N/MVI:L/MVA:L/MSC:L/MSI:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:L/SC:H/SI:H/SA:N/E:U/CR:M/MVC:L/MVA:H/MSC:H",5.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:P/AR:H/MUI:P/MVC:H/MSC:H",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:L/SA:L/E:A/AR:M/MPR:H/MVA:N/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/MAT:N/MUI:P/MVC:N/MVI:H",6.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:P/MAC:L/MVC:L/MVA:L/MSC:H/MSI:H",5.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N/E:P/IR:M/AR:L/MAT:N/MPR:L/MUI:N/MVC:N/MSC:L/MSI:S/MSA:S",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:L/SA:L/E:U/CR:L/IR:M/MAV:N/MAC:L/MAT:N/MSC:L",4.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:H/SA:H/E:A/MAC:L/MPR:N/MUI:N/MVC:H/MVI:H/MSI:S/MSA:S",10],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:L/SI:L/SA:L/MPR:L/MUI:N/MVC:L/MSC:L/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:L/SA:N/AR:M/MAV:N/MAC:L/MVI:H/MSI:S/MSA:S",9.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:L/SA:N/CR:L/MUI:N/MSC:L/MSI:S",8.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/E:A/IR:M/MVI:L",4.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:L/SA:H/IR:H/MAT:N/MPR:L/MUI:A/MVC:N/MVI:N/MVA:N",6.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:H/SI:N/SA:L/IR:M",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N/MAV:N/MVA:N/MSC:N/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:L/IR:M/MAV:N/MVI:H/MSC:H",9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:L/E:U/MAC:L/MPR:H/MUI:A/MVA:L/MSC:L/MSI:S",4.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/MAV:N/MAT:N/MVA:H/MSC:L",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N/IR:H/MAT:N/MVI:N/MSI:S/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:A/MAT:N/MPR:N/MUI:N",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:N/SI:H/SA:N/MAV:N/MUI:P/MSC:H/MSA:S",9.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:H/SA:N/E:P/MAV:N/MAC:L/MPR:N",5.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:L/SC:N/SI:H/SA:L/E:A/MAV:N/MVA:L/MSI:S/MSA:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:L/SA:N/IR:M/AR:M/MAV:N/MAC:L/MVC:N/MVI:H/MSC:N",5.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/AR:H/MVC:N/MVI:H/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:P/AR:H/MAC:L/MSC:L",2.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/MAC:L/MPR:H/MVA:L",4.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:L/SC:L/SI:N/SA:H/MAC:L/MUI:P/MVI:N/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L/CR:M/AR:L/MAV:N",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:H/SC:L/SI:H/SA:N/IR:M/MAV:N/MVC:N/MSC:N",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:H/SC:L/SI:N/SA:H/CR:H/IR:L/MAV:N/MAT:N/MUI:N/MVA:L/MSC:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:H/SA:N/IR:L/MAC:L/MPR:N/MUI:N/MVC:L",9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:H/IR:H/MAT:N/MPR:H/MVA:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:L/E:P/CR:H/IR:H/MPR:L/MVC:H/MVA:H/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:L/SC:H/SI:L/SA:H/IR:M/MAT:N/MVI:H/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:L/AR:M/MAT:N/MVC:N",6.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/CR:L/AR:L/MPR:L/MVC:H/MVI:H/MSC:L",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:L/SC:H/SI:L/SA:N/IR:H/AR:H/MAV:N/MPR:H/MVI:N/MSC:H/MSA:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:N/SC:L/SI:N/SA:N/E:U/MAV:N/MAC:L/MAT:N/MPR:H/MUI:N/MVI:L/MSI:S",4.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/MSC:L",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H/CR:L/AR:L/MAC:L/MUI:P/MVC:L/MVA:H/MSC:H/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/IR:L/MAC:L/MAT:N/MPR:N/MVC:H/MSA:S",10],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:H/SA:L/E:P/AR:L/MAV:N/MVC:N/MVA:L/MSC:L",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/CR:H/IR:L/MUI:P/MVC:L/MVA:N",6.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:L/AR:L/MAT:N/MUI:P/MVC:N/MSC:N",5.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:L/IR:H/MPR:N/MVC:N/MVI:N",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:H/SI:N/SA:H/IR:H/MAT:N/MSC:H",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:H/SA:H/CR:L/IR:M/MAC:L/MUI:A/MSC:H/MSA:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:L/SI:N/SA:H/CR:L/IR:L/MAV:N/MAC:L/MVI:N",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:U/MAV:N/MVC:L/MSA:S",4.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:H/SA:N/MUI:P/MVA:H",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:N/SA:H/E:A/IR:M/MPR:N/MVI:L/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:L/SA:L/CR:L/IR:H/MVA:L",5.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:H/SC:L/SI:L/SA:L/E:P/IR:M/AR:H/MAV:N/MAC:L/MPR:N/MVC:L/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/E:U/CR:L/AR:M/MAC:L/MAT:N/MPR:H/MUI:N/MVI:N/MVA:H/MSI:S/MSA:S",6.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:U/IR:L/MAV:N/MPR:H",2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/E:U/AR:H/MAT:N/MUI:A/MSI:S/MSA:S",7.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:H/SA:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:H/SC:H/SI:N/SA:H/E:U/MAT:N/MVI:H",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:H/SA:L/E:A/AR:H/MAC:L/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:L/SC:N/SI:L/SA:H/E:A/AR:M/MAC:L/MPR:H/MVI:L/MVA:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:L/MAC:L/MPR:L/MVC:L/MSC:N/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:H/SC:L/SI:L/SA:N/IR:H/AR:M/MAV:N/MVI:L/MVA:H",5.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:H/SC:H/SI:L/SA:N/E:P/CR:L/IR:H/MAV:N/MAT:N",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/AR:H/MAV:N/MAC:L/MPR:N/MUI:A",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/IR:M/MAC:L/MSC:H",6.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:H/SI:L/SA:L/E:U/CR:M/IR:H/AR:H/MSA:S",7.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:L/IR:H/AR:M/MAV:N/MAC:L/MPR:N/MVC:L",6.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N/MAV:N/MPR:H/MUI:N/MSC:L/MSI:S",7.9],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:N/SC:H/SI:H/SA:L/CR:M/IR:H/MVI:H/MVA:H",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:H/SA:L/E:P/CR:H/IR:H/MAV:N/MAT:N/MVA:N/MSA:S",8.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:N/VA:H/SC:H/SI:N/SA:L/MAV:N/MAC:L/MPR:L/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/MAV:N/MPR:N/MVC:H/MSI:S",9.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:H/IR:M/AR:L/MAT:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:H/E:A/IR:M/MVI:H/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:P/MAT:N/MUI:N/MVI:H/MVA:L",8.5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:H/SI:L/SA:N/CR:M/MAV:N/MAT:N/MPR:L/MVA:L/MSI:S",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:L/SA:L/E:A/IR:H/AR:H/MAT:N/MVC:H/MVI:L/MVA:H/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:L/SA:N/MPR:L/MVC:L/MVA:L/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:H/SC:L/SI:N/SA:L/AR:H/MAC:L/MPR:N/MVC:L/MVI:L/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:L/SC:N/SI:H/SA:L/MAC:L/MPR:H/MVC:N/MSI:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:L/SA:N/MAV:N/MPR:L/MUI:A/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:H/CR:H/MVI:H/MVA:H/MSC:N",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:H/SA:H/E:P/IR:L/MAC:L/MUI:N/MSC:L",6.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:H/SC:L/SI:N/SA:N/IR:M/MAV:N/MAC:L/MSI:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:H/SA:N/MAV:N/MAC:L/MPR:H/MVI:N",8.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:L/SA:L/MPR:L/MUI:P/MVC:H/MSA:S",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:H/SC:L/SI:H/SA:N/MAC:L/MVI:L/MSC:N",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:H/E:A/MAV:N/MAC:L/MVA:N",6.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/MAV:N/MAT:N/MUI:A/MSC:N/MSI:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:H/MAT:N/MPR:N/MSA:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L/CR:M/MAC:L/MAT:N/MPR:L/MUI:P/MSI:S/MSA:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:H/SC:H/SI:N/SA:H/CR:H/IR:H/AR:L/MUI:P/MVC:L/MVA:H",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:H/E:A/CR:L/MPR:L/MVI:L/MSI:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:U/AR:M/MAV:N/MAC:L/MPR:H/MVC:H",5.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/MAC:L/MSC:L/MSI:S/MSA:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:H/MAC:L/MVA:N/MSI:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/IR:M/MAV:N/MAC:L/MPR:L/MUI:N/MVC:H/MVI:L/MVA:N/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/IR:L/AR:M/MUI:P/MVC:L/MVI:N/MSI:S/MSA:S",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:H/SA:H/IR:H/MAV:N/MAC:L/MUI:N/MVA:N/MSI:S",8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:H/SA:N/E:A/MVI:N",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:H/CR:M/MAT:N/MVC:L/MVA:N/MSI:S/MSA:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:L/SA:N/E:A/MUI:P",5.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:H/SC:H/SI:H/SA:N/E:U/MAC:L/MAT:N/MSC:L",5.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:H/SC:L/SI:N/SA:H/E:P/CR:H/IR:L/AR:L/MAV:N/MAT:N/MVC:N/MSC:H",5.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:L/SI:L/SA:L/IR:H/MAC:L/MAT:N/MVI:L/MVA:L/MSI:S/MSA:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:A/IR:M/MPR:H",5.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:H/IR:M/MAT:N/MPR:H/MUI:P/MVA:N",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/CR:L/IR:M/MAV:N/MAC:L/MAT:N/MVC:L/MVA:N/MSI:S",8.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:L/SC:H/SI:N/SA:L/CR:M/IR:H/AR:M/MAV:N/MPR:N/MVI:L/MVA:L/MSC:H",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:H/SA:H/E:U/MPR:H/MVI:H/MSC:L",5.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/MPR:N/MUI:A/MVA:L",7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:L/SI:L/SA:N/MAV:N/MAT:N/MPR:N/MUI:N/MSC:H/MSA:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:H/SI:H/SA:N/E:P/CR:L/MAC:L/MVC:H/MVI:H/MSC:N",9.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:H/SC:N/SI:H/SA:H/IR:M/AR:L/MVI:H/MVA:L/MSC:N",7.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:H/SI:L/SA:L/CR:M/MAV:N/MAT:N/MPR:H/MSC:N",6.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:H/SI:L/SA:N/CR:L/MAV:N/MPR:N/MUI:A/MVA:N",6.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:L/CR:L/MAC:L/MPR:H/MUI:N/MVI:H/MVA:H/MSC:L/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:H/VA:L/SC:N/SI:H/SA:N/AR:L/MUI:N/MVC:N",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:N/SI:H/SA:H/CR:M/MAT:N/MPR:L/MUI:A/MSA:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:N/SA:H/MAT:N/MSC:L/MSA:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/AR:H/MAC:L/MAT:N/MUI:A/MVC:N",0],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:H/SI:L/SA:L/IR:H/AR:H",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/AR:M/MSA:S",9.7],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:H/SA:L/E:U/CR:H/IR:H/AR:M/MAC:L/MVC:N/MSA:S",5],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:L/SA:N/CR:L/MUI:P/MSC:N/MSI:S",8.6],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:L/SA:H/MAV:N/MAT:N/MVC:N/MVI:L/MSC:N",8.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:H/SI:L/SA:L/CR:M/MAT:N/MVC:L/MVI:L",8.4],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:H/SI:N/SA:N/E:U/CR:L/AR:M/MVI:H/MSI:S",7.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:H/SA:N/IR:M/MAV:N/MUI:A/MVA:L/MSI:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:A/MAV:N/MAT:N/MPR:L/MVC:L/MSC:L/MSA:S",7.8],["CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:H/SI:N/SA:L/MAC:L/MPR:L",8.2],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/MAC:L/MSI:S",9.3],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:L/E:A/AR:L/MVI:N/MSC:H/MSA:S",9.1],["CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:N/MAC:L/MVI:H/MVA:N/MSC:H/MSI:S/MSA:S",9.8]] \ No newline at end of file diff --git a/data_validation/tests/test_crossref_validator.py b/data_validation/tests/test_crossref_validator.py index e49e2d3..7e49d45 100644 --- a/data_validation/tests/test_crossref_validator.py +++ b/data_validation/tests/test_crossref_validator.py @@ -57,3 +57,11 @@ def test_reference_tables_are_complete(): assert cr.atlas_status()["AML.T0051"] == "current" assert len(cr.cwe_status()) > 1000 assert cr.cwe_status()["CWE-79"] != "Deprecated" + + +def test_owasp_ids(): + assert levels({"owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"]}) == [] + assert levels({"owasp_agentic_top10_mapping": ["ASI10:2026"]}) == [] + assert levels({"notes": "maps to LLM11:2026"}) == [ERROR] + assert levels({"notes": "an old LLM01:2024 reference"}) == [ERROR] + assert levels({"notes": "OWASP LLM03 (Supply Chain)"}) == [WARN] diff --git a/data_validation/tests/test_cvss_score.py b/data_validation/tests/test_cvss_score.py new file mode 100644 index 0000000..e42a0fd --- /dev/null +++ b/data_validation/tests/test_cvss_score.py @@ -0,0 +1,51 @@ +"""Tests for cvss_score.py, the in-house CVSS v3.x and v4.0 scorer.""" +from __future__ import annotations + +import json +import sys +from pathlib import Path + +import pytest + +sys.path.insert(0, str(Path(__file__).resolve().parent.parent)) + +from validators.cvss_score import CVSSError, base_score # noqa: E402 + +FIXTURES = Path(__file__).resolve().parent / "fixtures" + + +def test_v4_matches_the_first_reference_calculator(): + """500 vectors (base, threat and environmental metrics) scored by cvss40.js.""" + reference = json.loads((FIXTURES / "cvss40_reference_scores.json").read_text(encoding="utf-8")) + assert len(reference) == 500 + mismatches = [(v, s, base_score(v)) for v, s in reference if base_score(v) != s] + assert mismatches == [] + + +@pytest.mark.parametrize("vector,score", [ + # Published NVD/CNA scores + ("CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", 8.8), + ("CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", 9.6), + ("CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", 6.4), + ("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", 9.3), + ("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", 7.5), + ("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", 9.8), + ("CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N", 0.0), + ("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O", 9.8), # temporal metrics don't change the base + ("CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", 9.3), +]) +def test_known_scores(vector, score): + assert base_score(vector) == score + + +@pytest.mark.parametrize("vector", [ + "CVSS:3.1/AV:X/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", # bad value + "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H", # missing A + "CVSS:3.1/AV:N/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", # duplicate + "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N", # missing SA + "CVSS:2.0/AV:N", + "AV:N/AC:L/Au:N/C:P/I:P/A:P", +]) +def test_invalid_vectors(vector): + with pytest.raises(CVSSError): + base_score(vector) diff --git a/data_validation/tests/test_severity_check.py b/data_validation/tests/test_severity_check.py new file mode 100644 index 0000000..a86f130 --- /dev/null +++ b/data_validation/tests/test_severity_check.py @@ -0,0 +1,60 @@ +"""Tests for severity_check.py.""" +from __future__ import annotations + +import sys +from pathlib import Path + +import pytest + +sys.path.insert(0, str(Path(__file__).resolve().parent.parent)) + +from validators import severity_check as sc # noqa: E402 +from validators._common import ERROR, WARN # noqa: E402 + +V3 = "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" # 8.8 High +V4 = "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" # 9.3 Critical + + +def levels(sev: dict) -> list[str]: + return [f.level for f in sc.check_data(Path("e.json"), {"severity": sev})] + + +@pytest.mark.parametrize("score,band", [(0.0, "None"), (0.1, "Low"), (3.9, "Low"), (4.0, "Medium"), + (6.9, "Medium"), (7.0, "High"), (8.9, "High"), (9.0, "Critical"), (10.0, "Critical")]) +def test_first_bands(score, band): + assert sc.first_band(score) == band + + +def test_consistent_v3_and_v4_pass(): + assert levels({"qualitative": "High", "cvss_v3_score": 8.8, "cvss_v3_vector": V3}) == [] + assert levels({"qualitative": "Critical", "cvss_v4_score": 9.3, "cvss_v4_vector": V4}) == [] + + +def test_score_not_matching_vector(): + assert levels({"qualitative": "High", "cvss_v3_score": 8.1, "cvss_v3_vector": V3}) == [ERROR] + + +def test_qualitative_outside_band(): + """The case found in the vulnerability dataset: 8.8 labelled Critical.""" + assert levels({"qualitative": "Critical", "cvss_v3_score": 8.8, "cvss_v3_vector": V3}) == [ERROR] + + +def test_v4_score_sets_the_band(): + sev = {"qualitative": "Critical", "cvss_v3_score": 8.8, "cvss_v3_vector": V3, "cvss_v4_score": 9.3, "cvss_v4_vector": V4} + assert levels(sev) == [] + + +def test_invalid_vector(): + assert levels({"qualitative": "High", "cvss_v3_vector": "CVSS:3.1/AV:X"}) == [ERROR] + + +def test_vector_without_score_still_sets_band(): + assert levels({"qualitative": "Low", "cvss_v3_vector": V3}) == [ERROR] + + +def test_score_without_vector_warns(): + assert levels({"qualitative": "High", "cvss_v3_score": 8.8}) == [WARN] + + +def test_no_cvss_is_fine(): + assert levels({"qualitative": "High"}) == [] diff --git a/data_validation/tests/test_standards.py b/data_validation/tests/test_standards.py new file mode 100644 index 0000000..50d6409 --- /dev/null +++ b/data_validation/tests/test_standards.py @@ -0,0 +1,69 @@ +"""Guards that keep schemas and validators on current standards. + +They fail when a schema falls behind the reference tables, when a schema is +not JSON Schema 2020-12, or when a dataset validator stops enforcing +"format" (dates, URIs). +""" +from __future__ import annotations + +import csv +import json +import re +import sys +from pathlib import Path + +import pytest +from jsonschema import Draft202012Validator + +sys.path.insert(0, str(Path(__file__).resolve().parent.parent)) + +from validators._common import DATASETS_ROOT, REFERENCE_DIR, SCHEMAS_DIR # noqa: E402 + +DRAFT_2020_12 = "https://json-schema.org/draft/2020-12/schema" +# Contributor-maintained schema for one sub-collection; its own validator owns it. +CONTRIBUTOR_SCHEMAS = {"contrastive_testcase.schema.json"} + +OWASP = list(csv.DictReader(open(REFERENCE_DIR / "owasp_top10.csv", newline="", encoding="utf-8"))) +LLM_IDS = sorted(r["id"] for r in OWASP if r["list"] == "LLM") +ASI_IDS = sorted(r["id"] for r in OWASP if r["list"] == "ASI") +MAPPING_SCHEMAS = [DATASETS_ROOT / d / "schema.json" + for d in ("exploit_dataset", "vulnerability_dataset", "agentdataflow_toolexchange_traces")] + + +def all_schemas() -> list[Path]: + found = list(SCHEMAS_DIR.glob("*.schema.json")) + list(DATASETS_ROOT.glob("*/schema.json")) + found += [p for p in DATASETS_ROOT.rglob("*.schema.json") if "fixtures" not in p.parts] + return sorted(set(found)) + + +@pytest.mark.parametrize("path", all_schemas(), ids=lambda p: p.name if p.name != "schema.json" else p.parent.name) +def test_schema_is_valid_2020_12(path): + if path.name in CONTRIBUTOR_SCHEMAS: + pytest.skip("contributor-maintained sub-collection schema") + schema = json.loads(path.read_text(encoding="utf-8")) + assert schema.get("$schema") == DRAFT_2020_12 + if "$ref" not in schema: + Draft202012Validator.check_schema(schema) + + +@pytest.mark.parametrize("path", MAPPING_SCHEMAS, ids=lambda p: p.parent.name) +def test_owasp_enums_match_reference_table(path): + props = json.loads(path.read_text(encoding="utf-8"))["properties"] + assert sorted(props["owasp_llm_top10_mapping"]["items"]["enum"]) == LLM_IDS + assert sorted(props["owasp_agentic_top10_mapping"]["items"]["enum"]) == ASI_IDS + + +def test_owasp_table_is_complete_and_crosswalked(): + for edition in ("2025", "2026"): + assert [r["id"] for r in OWASP if r["list"] == "LLM" and r["edition"] == edition] == \ + [f"LLM{n:02d}:{edition}" for n in range(1, 11)] + assert ASI_IDS == [f"ASI{n:02d}:2026" for n in range(1, 11)] + equivalents = [r["equivalent_2025"] for r in OWASP if r["edition"] == "2026" and r["list"] == "LLM"] + assert sorted(equivalents) == [f"LLM{n:02d}:2025" for n in range(1, 11)] # a one-to-one crosswalk + + +@pytest.mark.parametrize("validate", sorted(DATASETS_ROOT.glob("*/validate.py")), ids=lambda p: p.parent.name) +def test_dataset_validators_enforce_format(validate): + """Without a format checker, "format": "date" and "uri" are never checked.""" + source = validate.read_text(encoding="utf-8") + assert re.search(r"format_checker\s*=", source), f"{validate} builds its validator without a format checker" diff --git a/data_validation/validators/LICENSE-cvss-v4-calculator.txt b/data_validation/validators/LICENSE-cvss-v4-calculator.txt new file mode 100644 index 0000000..2414303 --- /dev/null +++ b/data_validation/validators/LICENSE-cvss-v4-calculator.txt @@ -0,0 +1,22 @@ +Copyright (c) 2023 FIRST.ORG, Inc., Red Hat, and contributors + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/data_validation/validators/crossref_validator.py b/data_validation/validators/crossref_validator.py index e6c98f0..3699b91 100644 --- a/data_validation/validators/crossref_validator.py +++ b/data_validation/validators/crossref_validator.py @@ -1,13 +1,17 @@ """ -Checks CVE, GHSA, CWE and MITRE ATLAS identifiers. +Checks CVE, GHSA, CWE, MITRE ATLAS and OWASP Top 10 identifiers. ERROR: a field whose whole value is meant to be one of these IDs but is malformed (e.g. "CVE-24-1234"); a CVE year in the future; a CWE ID that is not in reference_data/cwe_ids.csv; an ATLAS technique ID that - is not in reference_data/mitre_atlas_techniques.csv. ATLAS and CWE IDs - are checked wherever they appear, including free text. + is not in reference_data/mitre_atlas_techniques.csv; an OWASP Top 10 + ID with an edition year (LLM01:2026, ASI01:2026) that is not in + reference_data/owasp_top10.csv. ATLAS, CWE and OWASP IDs are checked + wherever they appear, including free text. WARN: a CWE that MITRE has deprecated, or an ATLAS ID that a later ATLAS - release retired (merged into another technique); something in free text that starts + release retired (merged into another technique); an OWASP ID with + no edition year (LLM03 was Supply Chain in 2025 and is Excessive + Agency in 2026, so a bare ID is ambiguous); something in free text that starts like an ID but is malformed (often a placeholder such as CVE-XXXX-XXXX). CVE and GHSA IDs are format-checked only: there is no offline list to check @@ -53,6 +57,28 @@ def atlas_status() -> dict[str, str]: return {row["technique_id"]: row["status"] for row in csv.DictReader(fh)} +@lru_cache(maxsize=None) +def owasp_ids() -> frozenset[str]: + with open(REFERENCE_DIR / "owasp_top10.csv", newline="", encoding="utf-8") as fh: + return frozenset(row["id"] for row in csv.DictReader(fh)) + + +OWASP_RE = re.compile(r"\b(?:LLM|ASI)\d{2}(?::\d{4})?\b") + + +def check_owasp(path: Path, pointer: str, value: str) -> list[Finding]: + findings = [] + for m in OWASP_RE.finditer(value): + token = m.group(0) + if ":" not in token: + findings.append(Finding(WARN, CHECK, path, pointer, + f"{token} has no edition year; write {token}:2025 or {token}:2026")) + elif token not in owasp_ids(): + findings.append(Finding(ERROR, CHECK, path, pointer, + f"{token} is not an OWASP Top 10 entry (not in reference_data/owasp_top10.csv)")) + return findings + + @lru_cache(maxsize=None) def cwe_status() -> dict[str, str]: with open(REFERENCE_DIR / "cwe_ids.csv", newline="", encoding="utf-8") as fh: @@ -81,6 +107,7 @@ def _check_id(kind: str, value: str, m: re.Match) -> tuple[str, str] | None: def check_data(path: Path, data) -> list[Finding]: findings: list[Finding] = [] for pointer, _key, value in walk_strings(data): + findings += check_owasp(path, pointer, value) stripped = value.strip() whole_value = False for kind, strict, loose in ID_KINDS: @@ -120,7 +147,7 @@ def check_file(path: Path) -> list[Finding]: def main(argv: list[str] | None = None) -> int: ensure_utf8_stdout() - parser = argparse.ArgumentParser(description="Check CVE, GHSA, CWE and MITRE ATLAS identifiers") + parser = argparse.ArgumentParser(description="Check CVE, GHSA, CWE, MITRE ATLAS and OWASP Top 10 identifiers") add_target_args(parser) args = parser.parse_args(argv) files = resolve_targets(args) diff --git a/data_validation/validators/cvss40_tables.json b/data_validation/validators/cvss40_tables.json new file mode 100644 index 0000000..739e73a --- /dev/null +++ b/data_validation/validators/cvss40_tables.json @@ -0,0 +1,652 @@ +{ + "source": "Tables from cvss40.js in https://github.com/RedHatProductSecurity/cvss-v4-calculator (the FIRST CVSS v4.0 reference calculator). Copyright FIRST, Red Hat, and contributors. BSD-2-Clause; see LICENSE-cvss-v4-calculator.txt.", + "METRICS": { + "BASE": { + "AV": [ + "N", + "A", + "L", + "P" + ], + "AC": [ + "L", + "H" + ], + "AT": [ + "N", + "P" + ], + "PR": [ + "N", + "L", + "H" + ], + "UI": [ + "N", + "P", + "A" + ], + "VC": [ + "N", + "L", + "H" + ], + "VI": [ + "N", + "L", + "H" + ], + "VA": [ + "N", + "L", + "H" + ], + "SC": [ + "N", + "L", + "H" + ], + "SI": [ + "N", + "L", + "H" + ], + "SA": [ + "N", + "L", + "H" + ] + }, + "THREAT": { + "E": [ + "X", + "A", + "P", + "U" + ] + }, + "ENVIRONMENTAL": { + "CR": [ + "X", + "H", + "M", + "L" + ], + "IR": [ + "X", + "H", + "M", + "L" + ], + "AR": [ + "X", + "H", + "M", + "L" + ], + "MAV": [ + "X", + "N", + "A", + "L", + "P" + ], + "MAC": [ + "X", + "L", + "H" + ], + "MAT": [ + "X", + "N", + "P" + ], + "MPR": [ + "X", + "N", + "L", + "H" + ], + "MUI": [ + "X", + "N", + "P", + "A" + ], + "MVC": [ + "X", + "H", + "L", + "N" + ], + "MVI": [ + "X", + "H", + "L", + "N" + ], + "MVA": [ + "X", + "H", + "L", + "N" + ], + "MSC": [ + "X", + "H", + "L", + "N" + ], + "MSI": [ + "X", + "S", + "H", + "L", + "N" + ], + "MSA": [ + "X", + "S", + "H", + "L", + "N" + ] + }, + "SUPPLEMENTAL": { + "S": [ + "X", + "N", + "P" + ], + "AU": [ + "X", + "N", + "Y" + ], + "R": [ + "X", + "A", + "U", + "I" + ], + "V": [ + "X", + "D", + "C" + ], + "RE": [ + "X", + "L", + "M", + "H" + ], + "U": [ + "X", + "Clear", + "Green", + "Amber", + "Red" + ] + } + }, + "LOOKUP_TABLE": { + "100000": 9.8, + "100001": 9.5, + "100010": 9.4, + "100011": 8.7, + "100020": 9.1, + "100021": 8.1, + "100100": 9.4, + "100101": 8.9, + "100110": 8.6, + "100111": 7.4, + "100120": 7.7, + "100121": 6.4, + "100200": 8.7, + "100201": 7.5, + "100210": 7.4, + "100211": 6.3, + "100220": 6.3, + "100221": 4.9, + "101000": 9.4, + "101001": 8.9, + "101010": 8.8, + "101011": 7.7, + "101020": 7.6, + "101021": 6.7, + "101100": 8.6, + "101101": 7.6, + "101110": 7.4, + "101111": 5.8, + "101120": 5.9, + "101121": 5, + "101200": 7.2, + "101201": 5.7, + "101210": 5.7, + "101211": 5.2, + "101220": 5.2, + "101221": 2.5, + "102001": 8.3, + "102011": 7, + "102021": 5.4, + "102101": 6.5, + "102111": 5.8, + "102121": 2.6, + "102201": 5.3, + "102211": 2.1, + "102221": 1.3, + "110000": 9.5, + "110001": 9, + "110010": 8.8, + "110011": 7.6, + "110020": 7.6, + "110021": 7, + "110100": 9, + "110101": 7.7, + "110110": 7.5, + "110111": 6.2, + "110120": 6.1, + "110121": 5.3, + "110200": 7.7, + "110201": 6.6, + "110210": 6.8, + "110211": 5.9, + "110220": 5.2, + "110221": 3, + "111000": 8.9, + "111001": 7.8, + "111010": 7.6, + "111011": 6.7, + "111020": 6.2, + "111021": 5.8, + "111100": 7.4, + "111101": 5.9, + "111110": 5.7, + "111111": 5.7, + "111120": 4.7, + "111121": 2.3, + "111200": 6.1, + "111201": 5.2, + "111210": 5.7, + "111211": 2.9, + "111220": 2.4, + "111221": 1.6, + "112001": 7.1, + "112011": 5.9, + "112021": 3, + "112101": 5.8, + "112111": 2.6, + "112121": 1.5, + "112201": 2.3, + "112211": 1.3, + "112221": 0.6, + "200000": 9.3, + "200001": 8.7, + "200010": 8.6, + "200011": 7.2, + "200020": 7.5, + "200021": 5.8, + "200100": 8.6, + "200101": 7.4, + "200110": 7.4, + "200111": 6.1, + "200120": 5.6, + "200121": 3.4, + "200200": 7, + "200201": 5.4, + "200210": 5.2, + "200211": 4, + "200220": 4, + "200221": 2.2, + "201000": 8.5, + "201001": 7.5, + "201010": 7.4, + "201011": 5.5, + "201020": 6.2, + "201021": 5.1, + "201100": 7.2, + "201101": 5.7, + "201110": 5.5, + "201111": 4.1, + "201120": 4.6, + "201121": 1.9, + "201200": 5.3, + "201201": 3.6, + "201210": 3.4, + "201211": 1.9, + "201220": 1.9, + "201221": 0.8, + "202001": 6.4, + "202011": 5.1, + "202021": 2, + "202101": 4.7, + "202111": 2.1, + "202121": 1.1, + "202201": 2.4, + "202211": 0.9, + "202221": 0.4, + "210000": 8.8, + "210001": 7.5, + "210010": 7.3, + "210011": 5.3, + "210020": 6, + "210021": 5, + "210100": 7.3, + "210101": 5.5, + "210110": 5.9, + "210111": 4, + "210120": 4.1, + "210121": 2, + "210200": 5.4, + "210201": 4.3, + "210210": 4.5, + "210211": 2.2, + "210220": 2, + "210221": 1.1, + "211000": 7.5, + "211001": 5.5, + "211010": 5.8, + "211011": 4.5, + "211020": 4, + "211021": 2.1, + "211100": 6.1, + "211101": 5.1, + "211110": 4.8, + "211111": 1.8, + "211120": 2, + "211121": 0.9, + "211200": 4.6, + "211201": 1.8, + "211210": 1.7, + "211211": 0.7, + "211220": 0.8, + "211221": 0.2, + "212001": 5.3, + "212011": 2.4, + "212021": 1.4, + "212101": 2.4, + "212111": 1.2, + "212121": 0.5, + "212201": 1, + "212211": 0.3, + "212221": 0.1, + "000000": 10, + "000001": 9.9, + "000010": 9.8, + "000011": 9.5, + "000020": 9.5, + "000021": 9.2, + "000100": 10, + "000101": 9.6, + "000110": 9.3, + "000111": 8.7, + "000120": 9.1, + "000121": 8.1, + "000200": 9.3, + "000201": 9, + "000210": 8.9, + "000211": 8, + "000220": 8.1, + "000221": 6.8, + "001000": 9.8, + "001001": 9.5, + "001010": 9.5, + "001011": 9.2, + "001020": 9, + "001021": 8.4, + "001100": 9.3, + "001101": 9.2, + "001110": 8.9, + "001111": 8.1, + "001120": 8.1, + "001121": 6.5, + "001200": 8.8, + "001201": 8, + "001210": 7.8, + "001211": 7, + "001220": 6.9, + "001221": 4.8, + "002001": 9.2, + "002011": 8.2, + "002021": 7.2, + "002101": 7.9, + "002111": 6.9, + "002121": 5, + "002201": 6.9, + "002211": 5.5, + "002221": 2.7, + "010000": 9.9, + "010001": 9.7, + "010010": 9.5, + "010011": 9.2, + "010020": 9.2, + "010021": 8.5, + "010100": 9.5, + "010101": 9.1, + "010110": 9, + "010111": 8.3, + "010120": 8.4, + "010121": 7.1, + "010200": 9.2, + "010201": 8.1, + "010210": 8.2, + "010211": 7.1, + "010220": 7.2, + "010221": 5.3, + "011000": 9.5, + "011001": 9.3, + "011010": 9.2, + "011011": 8.5, + "011020": 8.5, + "011021": 7.3, + "011100": 9.2, + "011101": 8.2, + "011110": 8, + "011111": 7.2, + "011120": 7, + "011121": 5.9, + "011200": 8.4, + "011201": 7, + "011210": 7.1, + "011211": 5.2, + "011220": 5, + "011221": 3, + "012001": 8.6, + "012011": 7.5, + "012021": 5.2, + "012101": 7.1, + "012111": 5.2, + "012121": 2.9, + "012201": 6.3, + "012211": 2.9, + "012221": 1.7 + }, + "METRIC_LEVELS": { + "AV": { + "N": 0, + "A": 0.1, + "L": 0.2, + "P": 0.3 + }, + "PR": { + "N": 0, + "L": 0.1, + "H": 0.2 + }, + "UI": { + "N": 0, + "P": 0.1, + "A": 0.2 + }, + "AC": { + "L": 0, + "H": 0.1 + }, + "AT": { + "N": 0, + "P": 0.1 + }, + "VC": { + "H": 0, + "L": 0.1, + "N": 0.2 + }, + "VI": { + "H": 0, + "L": 0.1, + "N": 0.2 + }, + "VA": { + "H": 0, + "L": 0.1, + "N": 0.2 + }, + "SC": { + "H": 0.1, + "L": 0.2, + "N": 0.3 + }, + "SI": { + "S": 0, + "H": 0.1, + "L": 0.2, + "N": 0.3 + }, + "SA": { + "S": 0, + "H": 0.1, + "L": 0.2, + "N": 0.3 + }, + "CR": { + "H": 0, + "M": 0.1, + "L": 0.2 + }, + "IR": { + "H": 0, + "M": 0.1, + "L": 0.2 + }, + "AR": { + "H": 0, + "M": 0.1, + "L": 0.2 + }, + "E": { + "U": 0.2, + "P": 0.1, + "A": 0 + } + }, + "MAX_COMPOSED": { + "eq1": { + "0": [ + "AV:N/PR:N/UI:N/" + ], + "1": [ + "AV:A/PR:N/UI:N/", + "AV:N/PR:L/UI:N/", + "AV:N/PR:N/UI:P/" + ], + "2": [ + "AV:P/PR:N/UI:N/", + "AV:A/PR:L/UI:P/" + ] + }, + "eq2": { + "0": [ + "AC:L/AT:N/" + ], + "1": [ + "AC:H/AT:N/", + "AC:L/AT:P/" + ] + }, + "eq3": { + "0": { + "0": [ + "VC:H/VI:H/VA:H/CR:H/IR:H/AR:H/" + ], + "1": [ + "VC:H/VI:H/VA:L/CR:M/IR:M/AR:H/", + "VC:H/VI:H/VA:H/CR:M/IR:M/AR:M/" + ] + }, + "1": { + "0": [ + "VC:L/VI:H/VA:H/CR:H/IR:H/AR:H/", + "VC:H/VI:L/VA:H/CR:H/IR:H/AR:H/" + ], + "1": [ + "VC:L/VI:H/VA:L/CR:H/IR:M/AR:H/", + "VC:L/VI:H/VA:H/CR:H/IR:M/AR:M/", + "VC:H/VI:L/VA:H/CR:M/IR:H/AR:M/", + "VC:H/VI:L/VA:L/CR:M/IR:H/AR:H/", + "VC:L/VI:L/VA:H/CR:H/IR:H/AR:M/" + ] + }, + "2": { + "1": [ + "VC:L/VI:L/VA:L/CR:H/IR:H/AR:H/" + ] + } + }, + "eq4": { + "0": [ + "SC:H/SI:S/SA:S/" + ], + "1": [ + "SC:H/SI:H/SA:H/" + ], + "2": [ + "SC:L/SI:L/SA:L/" + ] + }, + "eq5": { + "0": [ + "E:A/" + ], + "1": [ + "E:P/" + ], + "2": [ + "E:U/" + ] + } + }, + "MAX_SEVERITY": { + "eq1": { + "0": 1, + "1": 4, + "2": 5 + }, + "eq2": { + "0": 1, + "1": 2 + }, + "eq3eq6": { + "0": { + "0": 7, + "1": 6 + }, + "1": { + "0": 8, + "1": 8 + }, + "2": { + "1": 10 + } + }, + "eq4": { + "0": 6, + "1": 5, + "2": 4 + }, + "eq5": { + "0": 1, + "1": 1, + "2": 1 + } + } +} \ No newline at end of file diff --git a/data_validation/validators/cvss_score.py b/data_validation/validators/cvss_score.py new file mode 100644 index 0000000..8926ceb --- /dev/null +++ b/data_validation/validators/cvss_score.py @@ -0,0 +1,238 @@ +""" +CVSS base scores for v3.0, v3.1 and v4.0 vectors, standard library only. + +v3.x follows the formulas in the FIRST CVSS v3.0 and v3.1 specifications +(section 7.1 and Appendix A). v4.0 is a port of cvss40.js, the FIRST +reference calculator (https://github.com/RedHatProductSecurity/cvss-v4-calculator, +Copyright FIRST, Red Hat, and contributors, BSD-2-Clause; the licence is in +LICENSE-cvss-v4-calculator.txt and its lookup tables are in +cvss40_tables.json). tests/test_cvss_score.py checks the port against 500 +vectors scored by the reference implementation. + +Written in-house because the common Python package for this is LGPL, which +the repository's dependency policy does not allow. +""" +from __future__ import annotations + +import json +import math +from functools import lru_cache +from itertools import product +from pathlib import Path + + +class CVSSError(ValueError): + """The vector is not a valid CVSS vector.""" + + +def _parse(vector: str, prefix: str, allowed: dict[str, list[str]], required: list[str]) -> dict[str, str]: + parts = vector.strip().split("/") + if parts[0] != prefix: + raise CVSSError(f"must start with {prefix}/") + metrics: dict[str, str] = {} + for part in parts[1:]: + key, sep, value = part.partition(":") + if not sep or key not in allowed: + raise CVSSError(f"unknown metric {part!r}") + if key in metrics: + raise CVSSError(f"metric {key} given twice") + if value not in allowed[key]: + raise CVSSError(f"{key}:{value} is not an allowed value (expected one of {', '.join(allowed[key])})") + metrics[key] = value + missing = [k for k in required if k not in metrics] + if missing: + raise CVSSError(f"missing base metric(s) {', '.join(missing)}") + return metrics + + +# ---- CVSS v3.0 / v3.1 ------------------------------------------------------- + +V3_ALLOWED = { + "AV": ["N", "A", "L", "P"], "AC": ["L", "H"], "PR": ["N", "L", "H"], "UI": ["N", "R"], + "S": ["U", "C"], "C": ["H", "L", "N"], "I": ["H", "L", "N"], "A": ["H", "L", "N"], + # Temporal and environmental metrics are accepted but do not change the base score. + "E": ["X", "U", "P", "F", "H"], "RL": ["X", "O", "T", "W", "U"], "RC": ["X", "U", "R", "C"], + "CR": ["X", "L", "M", "H"], "IR": ["X", "L", "M", "H"], "AR": ["X", "L", "M", "H"], + "MAV": ["X", "N", "A", "L", "P"], "MAC": ["X", "L", "H"], "MPR": ["X", "N", "L", "H"], + "MUI": ["X", "N", "R"], "MS": ["X", "U", "C"], "MC": ["X", "N", "L", "H"], + "MI": ["X", "N", "L", "H"], "MA": ["X", "N", "L", "H"], +} +V3_BASE = ["AV", "AC", "PR", "UI", "S", "C", "I", "A"] +_AV = {"N": 0.85, "A": 0.62, "L": 0.55, "P": 0.2} +_AC = {"L": 0.77, "H": 0.44} +_PR_UNCHANGED = {"N": 0.85, "L": 0.62, "H": 0.27} +_PR_CHANGED = {"N": 0.85, "L": 0.68, "H": 0.5} +_UI = {"N": 0.85, "R": 0.62} +_CIA = {"H": 0.56, "L": 0.22, "N": 0.0} + + +def _roundup_31(x: float) -> float: + """v3.1 Appendix A Roundup, which avoids floating-point artefacts.""" + i = round(x * 100000) + return i / 100000.0 if i % 10000 == 0 else (math.floor(i / 10000) + 1) / 10.0 + + +def _roundup_30(x: float) -> float: + return math.ceil(x * 10) / 10 + + +def cvss3_base_score(vector: str) -> float: + version = vector.strip().split("/")[0] + if version not in ("CVSS:3.0", "CVSS:3.1"): + raise CVSSError("must start with CVSS:3.0/ or CVSS:3.1/") + m = _parse(vector, version, V3_ALLOWED, V3_BASE) + roundup = _roundup_31 if version == "CVSS:3.1" else _roundup_30 + changed = m["S"] == "C" + iss = 1 - (1 - _CIA[m["C"]]) * (1 - _CIA[m["I"]]) * (1 - _CIA[m["A"]]) + impact = 7.52 * (iss - 0.029) - 3.25 * (iss - 0.02) ** 15 if changed else 6.42 * iss + pr = (_PR_CHANGED if changed else _PR_UNCHANGED)[m["PR"]] + exploitability = 8.22 * _AV[m["AV"]] * _AC[m["AC"]] * pr * _UI[m["UI"]] + if impact <= 0: + return 0.0 + if changed: + return roundup(min(1.08 * (impact + exploitability), 10)) + return roundup(min(impact + exploitability, 10)) + + +# ---- CVSS v4.0 (port of the FIRST reference calculator) --------------------- + +@lru_cache(maxsize=None) +def _v4_tables() -> dict: + return json.loads((Path(__file__).resolve().parent / "cvss40_tables.json").read_text(encoding="utf-8")) + + +def _v4_allowed() -> dict[str, list[str]]: + t = _v4_tables()["METRICS"] + return {k: v for cat in ("BASE", "THREAT", "ENVIRONMENTAL", "SUPPLEMENTAL") for k, v in t[cat].items()} + + +def _effective(m: dict[str, str], metric: str) -> str: + worst_case = {"E": "A", "CR": "H", "IR": "H", "AR": "H"} + if m.get(metric, "X") == "X" and metric in worst_case: + return worst_case[metric] + modified = m.get("M" + metric, "X") + if modified != "X": + return modified + return m[metric] + + +def _equivalent_classes(m: dict[str, str]) -> str: + e = lambda k: _effective(m, k) # noqa: E731 + av, pr, ui = e("AV"), e("PR"), e("UI") + if av == "N" and pr == "N" and ui == "N": + eq1 = 0 + elif (av == "N" or pr == "N" or ui == "N") and av != "P": + eq1 = 1 + else: + eq1 = 2 + eq2 = 0 if e("AC") == "L" and e("AT") == "N" else 1 + vc, vi, va = e("VC"), e("VI"), e("VA") + if vc == "H" and vi == "H": + eq3 = 0 + elif vc == "H" or vi == "H" or va == "H": + eq3 = 1 + else: + eq3 = 2 + if e("MSI") == "S" or e("MSA") == "S": + eq4 = 0 + elif e("SC") == "H" or e("SI") == "H" or e("SA") == "H": + eq4 = 1 + else: + eq4 = 2 + eq5 = {"A": 0, "P": 1, "U": 2}[e("E")] + eq6 = 0 if (e("CR") == "H" and vc == "H") or (e("IR") == "H" and vi == "H") or (e("AR") == "H" and va == "H") else 1 + return f"{eq1}{eq2}{eq3}{eq4}{eq5}{eq6}" + + +def _round_half_up(value: float) -> float: + return math.floor((value + 1e-6) * 10 + 0.5) / 10 + + +def cvss4_base_score(vector: str) -> float: + """The CVSS v4.0 score of a vector (CVSS-B, -BT, -BE or -BTE per its metrics).""" + allowed = _v4_allowed() + base = list(_v4_tables()["METRICS"]["BASE"]) + m = _parse(vector, "CVSS:4.0", allowed, base) + for k, values in allowed.items(): + m.setdefault(k, values[0]) + # No impact on the vulnerable or any subsequent system scores 0. + if all(_effective(m, k) == "N" for k in ("VC", "VI", "VA", "SC", "SI", "SA")): + return 0.0 + + t = _v4_tables() + lookup, levels = t["LOOKUP_TABLE"], t["METRIC_LEVELS"] + max_composed, max_severity = t["MAX_COMPOSED"], t["MAX_SEVERITY"] + macro = _equivalent_classes(m) + value = lookup[macro] + eq1, eq2, eq3, eq4, eq5, eq6 = (int(c) for c in macro) + + def score_of(*eqs: int): + return lookup.get("".join(str(x) for x in eqs)) + + lower_eq1 = score_of(eq1 + 1, eq2, eq3, eq4, eq5, eq6) + lower_eq2 = score_of(eq1, eq2 + 1, eq3, eq4, eq5, eq6) + if eq3 == 1 and eq6 == 1: + lower_eq3eq6 = score_of(eq1, eq2, eq3 + 1, eq4, eq5, eq6) + elif eq3 == 0 and eq6 == 1: + lower_eq3eq6 = score_of(eq1, eq2, eq3 + 1, eq4, eq5, eq6) + elif eq3 == 1 and eq6 == 0: + lower_eq3eq6 = score_of(eq1, eq2, eq3, eq4, eq5, eq6 + 1) + elif eq3 == 0 and eq6 == 0: + left = score_of(eq1, eq2, eq3, eq4, eq5, eq6 + 1) + right = score_of(eq1, eq2, eq3 + 1, eq4, eq5, eq6) + candidates = [s for s in (left, right) if s is not None] + # Math.max with a missing (NaN) operand is NaN in the reference. + lower_eq3eq6 = max(candidates) if len(candidates) == 2 else None + else: + lower_eq3eq6 = score_of(eq1, eq2, eq3 + 1, eq4, eq5, eq6 + 1) + lower_eq4 = score_of(eq1, eq2, eq3, eq4 + 1, eq5, eq6) + lower_eq5 = score_of(eq1, eq2, eq3, eq4, eq5 + 1, eq6) + + eq_maxes = [ + max_composed["eq1"][str(eq1)], + max_composed["eq2"][str(eq2)], + max_composed["eq3"][str(eq3)][str(eq6)], + max_composed["eq4"][str(eq4)], + max_composed["eq5"][str(eq5)], + ] + # The first highest-severity vector of the MacroVector that the scored + # vector does not exceed on any metric; as in the reference, the last one + # tried is used if none qualifies. + distances: dict[str, float] = {} + for parts in product(*eq_maxes): + max_vector = dict(p.split(":") for p in "".join(parts).strip("/").split("/")) + distances = {k: levels[k][_effective(m, k)] - levels[k][max_vector[k]] for k in levels} + if all(dist >= 0 for dist in distances.values()): + break + + step = 0.1 + current = { + "eq1": distances["AV"] + distances["PR"] + distances["UI"], + "eq2": distances["AC"] + distances["AT"], + "eq3eq6": sum(distances[k] for k in ("VC", "VI", "VA", "CR", "IR", "AR")), + "eq4": distances["SC"] + distances["SI"] + distances["SA"], + } + depth = { + "eq1": max_severity["eq1"][str(eq1)] * step, + "eq2": max_severity["eq2"][str(eq2)] * step, + "eq3eq6": max_severity["eq3eq6"][str(eq3)][str(eq6)] * step, + "eq4": max_severity["eq4"][str(eq4)] * step, + } + normalized, n_lower = 0.0, 0 + for key, lower in (("eq1", lower_eq1), ("eq2", lower_eq2), ("eq3eq6", lower_eq3eq6), ("eq4", lower_eq4)): + if lower is not None: + n_lower += 1 + normalized += (value - lower) * (current[key] / depth[key]) + if lower_eq5 is not None: + n_lower += 1 # EQ5's proportion is always 0 + mean = normalized / n_lower if n_lower else 0.0 + return _round_half_up(max(0.0, min(10.0, value - mean))) + + +def base_score(vector: str) -> float: + """Base score of any CVSS v3.0, v3.1 or v4.0 vector.""" + if vector.startswith("CVSS:4.0/"): + return cvss4_base_score(vector) + if vector.startswith(("CVSS:3.0/", "CVSS:3.1/")): + return cvss3_base_score(vector) + raise CVSSError("must start with CVSS:3.0/, CVSS:3.1/ or CVSS:4.0/") diff --git a/data_validation/validators/severity_check.py b/data_validation/validators/severity_check.py new file mode 100644 index 0000000..cf5743a --- /dev/null +++ b/data_validation/validators/severity_check.py @@ -0,0 +1,118 @@ +""" +Checks CVSS scores against their vectors and the qualitative rating against +the FIRST rating scale, in any record's "severity" object. + +ERROR: a CVSS v3.x or v4.0 vector that does not parse; a score that differs + from the base score its vector produces (by more than 0.05); a + qualitative rating that is not the FIRST band of the CVSS score + (None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, + Critical 9.0-10.0). The v4.0 score sets the band when both are given. +WARN: a score with no vector, so it cannot be checked. + +Scores are computed by cvss_score.py (FIRST CVSS v3.0, v3.1 and v4.0). + +Usage: + python severity_check.py --dataset ../../datasets/vulnerability_dataset/ + python severity_check.py # every dataset +""" +from __future__ import annotations + +import argparse +import sys +from pathlib import Path + +if __package__ in (None, ""): + sys.path.insert(0, str(Path(__file__).resolve().parent.parent)) + +from validators._common import ( # noqa: E402 + DATASETS_ROOT, ERROR, WARN, Finding, add_target_args, ensure_utf8_stdout, + iter_records, load_json, print_findings, resolve_targets, +) +from validators.cvss_score import CVSSError, cvss3_base_score, cvss4_base_score # noqa: E402 + +CHECK = "severity" +TOLERANCE = 0.05 + + +def first_band(score: float) -> str: + """FIRST CVSS qualitative severity rating scale (same for v3.x and v4.0).""" + if score == 0: + return "None" + if score < 4.0: + return "Low" + if score < 7.0: + return "Medium" + if score < 9.0: + return "High" + return "Critical" + + +def _computed(version: str, vector: str) -> float: + if version == "v4": + return cvss4_base_score(vector) + return cvss3_base_score(vector) + + +def check_severity(path: Path, pointer: str, sev: dict) -> list[Finding]: + findings: list[Finding] = [] + loc = f"{pointer}/severity" + scores: dict[str, float] = {} + for version in ("v3", "v4"): + score, vector = sev.get(f"cvss_{version}_score"), sev.get(f"cvss_{version}_vector") + if vector is not None: + try: + computed = _computed(version, vector) + except CVSSError as exc: + findings.append(Finding(ERROR, CHECK, path, f"{loc}/cvss_{version}_vector", f"not a valid CVSS vector: {exc}")) + continue + if score is None: + scores[version] = computed + elif abs(computed - float(score)) > TOLERANCE: + findings.append(Finding(ERROR, CHECK, path, f"{loc}/cvss_{version}_score", + f"score {score} does not match its vector, which gives {computed}")) + elif score is not None: + findings.append(Finding(WARN, CHECK, path, f"{loc}/cvss_{version}_score", + "score has no vector, so it cannot be checked; add the vector")) + if isinstance(score, (int, float)): + scores[version] = float(score) + qualitative = sev.get("qualitative") + basis = "v4" if "v4" in scores else "v3" if "v3" in scores else None + if basis and isinstance(qualitative, str): + band = first_band(scores[basis]) + if qualitative != band: + findings.append(Finding(ERROR, CHECK, path, f"{loc}/qualitative", + f"{qualitative!r} but the CVSS {basis} score {scores[basis]} is {band!r} on the FIRST scale")) + return findings + + +def check_data(path: Path, data) -> list[Finding]: + findings: list[Finding] = [] + for pointer, record in iter_records(data): + sev = record.get("severity") + if isinstance(sev, dict): + findings += check_severity(path, pointer, sev) + return findings + + +def check_file(path: Path) -> list[Finding]: + data, err = load_json(path, CHECK) + if err: + return [err] + return check_data(path, data) + + +def main(argv: list[str] | None = None) -> int: + ensure_utf8_stdout() + parser = argparse.ArgumentParser(description="Check CVSS scores, vectors and qualitative ratings") + add_target_args(parser) + args = parser.parse_args(argv) + files = resolve_targets(args) + if files is None: + return 2 + findings = [f for p in files for f in check_file(p)] + print(f"Checked {len(files)} file(s)") + return print_findings(findings, DATASETS_ROOT.parent) + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/datasets/agentdataflow_toolexchange_traces/README.md b/datasets/agentdataflow_toolexchange_traces/README.md index 8249934..fc3d920 100644 --- a/datasets/agentdataflow_toolexchange_traces/README.md +++ b/datasets/agentdataflow_toolexchange_traces/README.md @@ -43,7 +43,7 @@ Every entry carries: - **`spans`** - the trace itself: an ordered sequence of events - **`security_observations`** - what the trace demonstrates, one falsifiable claim per item -Optional: `agent` (framework, protocol, topology, autonomy), `owasp_llm_top10_mapping`, `mitre_atlas_mapping`, `mitigations`, `contributor`, `tags`, `notes`. +Optional: `agent` (framework, protocol, topology, autonomy), `owasp_llm_top10_mapping` (`LLMnn:2025` or `LLMnn:2026`), `owasp_agentic_top10_mapping` (`ASI01:2026`..`ASI10:2026`), `mitre_atlas_mapping`, `mitigations`, `contributor`, `tags`, `notes`. ### Spans diff --git a/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json index a152546..b6ec002 100644 --- a/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json +++ b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval.json @@ -7,7 +7,7 @@ "disposition": "unintentional_failure", "dsgai_mapping": ["DSGAI06", "DSGAI05", "DSGAI07"], - "owasp_llm_top10_mapping": ["LLM06:2025", "LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM06:2025", "LLM03:2025", "LLM03:2026", "LLM04:2026"], "agent": { "framework": "custom", diff --git a/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json index 8ab4598..86897b7 100644 --- a/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json +++ b/datasets/agentdataflow_toolexchange_traces/entries/DSGAI-TRACE-mcp-output-schema-expansion-context-overshare.json @@ -7,7 +7,7 @@ "disposition": "unintentional_failure", "dsgai_mapping": ["DSGAI15", "DSGAI01", "DSGAI14", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM05:2025", "LLM02:2026", "LLM10:2026"], "agent": { "framework": "custom", diff --git a/datasets/agentdataflow_toolexchange_traces/example.json b/datasets/agentdataflow_toolexchange_traces/example.json index 646295f..a305700 100644 --- a/datasets/agentdataflow_toolexchange_traces/example.json +++ b/datasets/agentdataflow_toolexchange_traces/example.json @@ -7,7 +7,7 @@ "disposition": "unintentional_failure", "dsgai_mapping": ["DSGAI06", "DSGAI05", "DSGAI02"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM06:2025", "LLM04:2026", "LLM03:2026"], "agent": { "framework": "custom", diff --git a/datasets/agentdataflow_toolexchange_traces/index.csv b/datasets/agentdataflow_toolexchange_traces/index.csv index fc43ac8..8def48d 100644 --- a/datasets/agentdataflow_toolexchange_traces/index.csv +++ b/datasets/agentdataflow_toolexchange_traces/index.csv @@ -1,4 +1,4 @@ trace_id,title,category,disposition,provenance_tier,primary_dsgai,dsgai_mapping,owasp_llm_top10_mapping,agent_framework,tool_protocol,span_count,finding_count,max_sensitivity,data_classes,evidence_count,primary_evidence,date_added,tags -DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval,Tool re-declares itself destructive after an agent has already auto-approved it,tool_call,unintentional_failure,derived_from_public_documentation,DSGAI06,DSGAI06|DSGAI05|DSGAI07,LLM06:2025|LLM03:2025,custom,mcp,10,4,high,tool_output|tool_schema,4,https://modelcontextprotocol.io/specification/2025-06-18/schema,2026-08-07,mcp|tool-contract-drift|declared-effect|approval-bypass|excessive-agency|supply-chain -DSGAI-TRACE-mcp-output-schema-expansion-context-overshare,"Tool output schema widens under a stable version, and the extra fields flow straight into model context",context_accumulation,unintentional_failure,derived_from_public_documentation,DSGAI15,DSGAI15|DSGAI01|DSGAI14|DSGAI05,LLM02:2025|LLM05:2025,custom,mcp,10,6,high,financial|pii|proprietary|telemetry|tool_output|tool_schema|user_prompt,2,https://modelcontextprotocol.io/specification/2025-06-18/server/tools,2026-08-07,mcp|tool-contract-drift|output-schema|context-window|over-sharing|telemetry-leakage +DSGAI-TRACE-mcp-declared-effect-flip-stale-autoapproval,Tool re-declares itself destructive after an agent has already auto-approved it,tool_call,unintentional_failure,derived_from_public_documentation,DSGAI06,DSGAI06|DSGAI05|DSGAI07,LLM06:2025|LLM03:2025|LLM03:2026|LLM04:2026,custom,mcp,10,4,high,tool_output|tool_schema,4,https://modelcontextprotocol.io/specification/2025-06-18/schema,2026-08-07,mcp|tool-contract-drift|declared-effect|approval-bypass|excessive-agency|supply-chain +DSGAI-TRACE-mcp-output-schema-expansion-context-overshare,"Tool output schema widens under a stable version, and the extra fields flow straight into model context",context_accumulation,unintentional_failure,derived_from_public_documentation,DSGAI15,DSGAI15|DSGAI01|DSGAI14|DSGAI05,LLM02:2025|LLM05:2025|LLM02:2026|LLM10:2026,custom,mcp,10,6,high,financial|pii|proprietary|telemetry|tool_output|tool_schema|user_prompt,2,https://modelcontextprotocol.io/specification/2025-06-18/server/tools,2026-08-07,mcp|tool-contract-drift|output-schema|context-window|over-sharing|telemetry-leakage DSGAI-TRACE-overbroad-search-context-egress-self-report-gap,Over-broad search scope leaks an HR document through a full-context email the agent's own record does not mention,tool_call,unintentional_failure,hypothetical,DSGAI06,DSGAI06|DSGAI15,,custom,,7,2,high,file_path|financial|pii|retrieved_document|telemetry|token|tool_output|user_prompt,0,,2026-09-15,workspace-search|email-egress|context-oversharing|observability-gap|self-report-divergence diff --git a/datasets/agentdataflow_toolexchange_traces/schema.json b/datasets/agentdataflow_toolexchange_traces/schema.json index a3fbe50..5e60a1a 100644 --- a/datasets/agentdataflow_toolexchange_traces/schema.json +++ b/datasets/agentdataflow_toolexchange_traces/schema.json @@ -79,13 +79,27 @@ }, "owasp_llm_top10_mapping": { - "description": "OWASP Top 10 for LLM Applications 2025 entries this trace aligns with.", + "description": "OWASP Top 10 for LLM Applications entries this trace aligns with, with the edition year (LLM01:2025 or LLM01:2026). The 2026 edition renumbered the list, so the year is part of the ID; data_validation/reference_data/owasp_top10.csv maps each 2026 entry to its 2025 predecessor.", "type": "array", "items": { "type": "string", "enum": [ "LLM01:2025", "LLM02:2025", "LLM03:2025", "LLM04:2025", "LLM05:2025", - "LLM06:2025", "LLM07:2025", "LLM08:2025", "LLM09:2025", "LLM10:2025" + "LLM06:2025", "LLM07:2025", "LLM08:2025", "LLM09:2025", "LLM10:2025", + "LLM01:2026", "LLM02:2026", "LLM03:2026", "LLM04:2026", "LLM05:2026", + "LLM06:2026", "LLM07:2026", "LLM08:2026", "LLM09:2026", "LLM10:2026" + ] + }, + "uniqueItems": true + }, + "owasp_agentic_top10_mapping": { + "description": "OWASP Top 10 for Agentic Applications 2026 entries this trace aligns with. OWASP writes these IDs without a year (ASI01); here they carry ':2026' so a later edition cannot collide. See data_validation/reference_data/owasp_top10.csv.", + "type": "array", + "items": { + "type": "string", + "enum": [ + "ASI01:2026", "ASI02:2026", "ASI03:2026", "ASI04:2026", "ASI05:2026", + "ASI06:2026", "ASI07:2026", "ASI08:2026", "ASI09:2026", "ASI10:2026" ] }, "uniqueItems": true diff --git a/datasets/exploit_dataset/README.md b/datasets/exploit_dataset/README.md index a83b4a8..629ee3a 100644 --- a/datasets/exploit_dataset/README.md +++ b/datasets/exploit_dataset/README.md @@ -35,7 +35,8 @@ Canonical schema: [`schema.json`](./schema.json). Reference entry: [`example.jso | `target_component` | yes | One of: `model`, `fine_tuned_adapter`, `rag_pipeline`, `vector_store`, `embedding_model`, `agent_framework`, `plugin_or_tool`, `inference_server`, `api_or_sdk`, `training_pipeline`, `guardrail_or_filter`, `browser_assistant`, `ide_assistant`, `observability_stack`, `human_in_the_loop`, `other` | | `dsgai_mapping` | yes | Array of `DSGAI01`..`DSGAI21` | | `mitre_atlas_mapping` | no | Array of `AML.T####` (or `AML.T####.###`) | -| `owasp_llm_top10_mapping` | no | Array of `LLM01:2025`..`LLM10:2025` | +| `owasp_llm_top10_mapping` | no | Array of `LLMnn:2025` and/or `LLMnn:2026`. The 2026 edition renumbered the list, so the year is required; [`owasp_top10.csv`](../../data_validation/reference_data/owasp_top10.csv) maps each 2026 entry to its 2025 predecessor | +| `owasp_agentic_top10_mapping` | no | Array of `ASI01:2026`..`ASI10:2026` (OWASP Top 10 for Agentic Applications 2026) | | `attack_steps` | no | Ordered high-level steps (2–8 recommended). Defensive description — no working payloads | | `prerequisites` | no | Required attacker capabilities or environmental conditions | | `impact` | no | Categories: `data_exfiltration`, `credential_exposure`, `privilege_escalation`, `integrity_compromise`, `availability_loss`, `policy_bypass`, `training_data_disclosure`, `system_prompt_disclosure`, `model_theft`, `supply_chain_compromise`, `financial_harm`, `reputational_harm`, `cross_tenant_disclosure`, `other` | diff --git a/datasets/exploit_dataset/entries/AML.T0010.json b/datasets/exploit_dataset/entries/AML.T0010.json index 1c188b3..5035146 100644 --- a/datasets/exploit_dataset/entries/AML.T0010.json +++ b/datasets/exploit_dataset/entries/AML.T0010.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI04", "DSGAI07", "DSGAI20"], "mitre_atlas_mapping": ["AML.T0010"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "attack_steps": [ "Identify a supply-chain component the target depends on: a model on Hugging Face Hub, a Python package, a dataset, an MCP server, a tool plugin, a container base image.", "Compromise that component — publish a typosquatted lookalike, contribute malicious code to an upstream project, push a poisoned model edit, or hijack a maintainer account.", diff --git a/datasets/exploit_dataset/entries/AML.T0011.001.json b/datasets/exploit_dataset/entries/AML.T0011.001.json index f6fb1fc..3973778 100644 --- a/datasets/exploit_dataset/entries/AML.T0011.001.json +++ b/datasets/exploit_dataset/entries/AML.T0011.001.json @@ -6,7 +6,7 @@ "target_component": "training_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI03"], "mitre_atlas_mapping": ["AML.T0011.001", "AML.T0060"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "attack_steps": [ "Pick a target audience and package ecosystem (PyPI, npm, RubyGems, crates.io).", "Choose a name — typosquat a popular library, claim a hallucinated name, or fabricate a plausible AI-utility name.", diff --git a/datasets/exploit_dataset/entries/AML.T0015.json b/datasets/exploit_dataset/entries/AML.T0015.json index 29771ff..55b070d 100644 --- a/datasets/exploit_dataset/entries/AML.T0015.json +++ b/datasets/exploit_dataset/entries/AML.T0015.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI05", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0015", "AML.T0043"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Identify the AI detector or classifier in the path (content-safety filter, anomaly scorer, biometric auth).", "Craft inputs that the model misclassifies as benign while preserving the malicious payload's function.", diff --git a/datasets/exploit_dataset/entries/AML.T0018.json b/datasets/exploit_dataset/entries/AML.T0018.json index 1a0734a..85f95d1 100644 --- a/datasets/exploit_dataset/entries/AML.T0018.json +++ b/datasets/exploit_dataset/entries/AML.T0018.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI04", "DSGAI20"], "mitre_atlas_mapping": ["AML.T0018"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025", "LLM04:2026", "LLM05:2026"], "attack_steps": [ "Obtain write access to the model artifact (upstream supply chain or in-place via credentials theft).", "Apply the modification: ROME-style edit, fine-tune adapter, weight overwrite, architecture swap, or pickle/template payload injection.", diff --git a/datasets/exploit_dataset/entries/AML.T0020.json b/datasets/exploit_dataset/entries/AML.T0020.json index 6cd604e..be18b96 100644 --- a/datasets/exploit_dataset/entries/AML.T0020.json +++ b/datasets/exploit_dataset/entries/AML.T0020.json @@ -6,7 +6,7 @@ "target_component": "training_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI05"], "mitre_atlas_mapping": ["AML.T0020", "AML.T0043.004"], - "owasp_llm_top10_mapping": ["LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM04:2025", "LLM05:2026"], "attack_steps": [ "Gain access — either upstream via supply chain compromise or in-pipeline via Initial Access.", "Modify training samples or labels. For backdoors, introduce a small set of trigger-paired samples with the desired malicious label.", diff --git a/datasets/exploit_dataset/entries/AML.T0024.000.json b/datasets/exploit_dataset/entries/AML.T0024.000.json index 2ec857b..905e102 100644 --- a/datasets/exploit_dataset/entries/AML.T0024.000.json +++ b/datasets/exploit_dataset/entries/AML.T0024.000.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI18", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0024.000"], - "owasp_llm_top10_mapping": ["LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM02:2026"], "attack_steps": [ "Acquire or train a shadow model on data similar in distribution to the suspected training set (AML.T0005.001).", "Compute membership-score features (loss, confidence margin, perplexity) for candidate samples on the shadow model.", diff --git a/datasets/exploit_dataset/entries/AML.T0024.001.json b/datasets/exploit_dataset/entries/AML.T0024.001.json index 98688fc..3979c3e 100644 --- a/datasets/exploit_dataset/entries/AML.T0024.001.json +++ b/datasets/exploit_dataset/entries/AML.T0024.001.json @@ -6,7 +6,7 @@ "target_component": "embedding_model", "dsgai_mapping": ["DSGAI18", "DSGAI13", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0024.001"], - "owasp_llm_top10_mapping": ["LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM02:2026"], "attack_steps": [ "Identify the inversion target — image input, regression attribute, or embedding vector.", "Train (or download) an inverter that maps confidence/embedding outputs back to inputs.", diff --git a/datasets/exploit_dataset/entries/AML.T0024.002.json b/datasets/exploit_dataset/entries/AML.T0024.002.json index 2dc4b50..2bd9b1d 100644 --- a/datasets/exploit_dataset/entries/AML.T0024.002.json +++ b/datasets/exploit_dataset/entries/AML.T0024.002.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI20", "DSGAI18"], "mitre_atlas_mapping": ["AML.T0024.002"], - "owasp_llm_top10_mapping": ["LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM02:2026"], "attack_steps": [ "Acquire scalable API access (paid keys, stolen keys, or a pool of free-tier accounts).", "Issue diverse queries covering the target's input distribution.", diff --git a/datasets/exploit_dataset/entries/AML.T0024.json b/datasets/exploit_dataset/entries/AML.T0024.json index 8abbbb3..65c1da8 100644 --- a/datasets/exploit_dataset/entries/AML.T0024.json +++ b/datasets/exploit_dataset/entries/AML.T0024.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI18", "DSGAI20", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0024"], - "owasp_llm_top10_mapping": ["LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM02:2026"], "attack_steps": [ "Pay for API access (or use a stolen key).", "Choose the goal — membership inference, model inversion, or model extraction — and structure queries accordingly.", diff --git a/datasets/exploit_dataset/entries/AML.T0029.json b/datasets/exploit_dataset/entries/AML.T0029.json index 6234a8e..94df312 100644 --- a/datasets/exploit_dataset/entries/AML.T0029.json +++ b/datasets/exploit_dataset/entries/AML.T0029.json @@ -6,7 +6,7 @@ "target_component": "inference_server", "dsgai_mapping": ["DSGAI17"], "mitre_atlas_mapping": ["AML.T0029"], - "owasp_llm_top10_mapping": ["LLM10:2025"], + "owasp_llm_top10_mapping": ["LLM10:2025", "LLM06:2026"], "attack_steps": [ "Profile the target to find expensive prompt shapes (very long context, max-out-output, tool-spammer prompts).", "Send these crafted requests at a rate that consumes capacity without obviously violating rate limits.", diff --git a/datasets/exploit_dataset/entries/AML.T0034.json b/datasets/exploit_dataset/entries/AML.T0034.json index 0070d4b..0492c40 100644 --- a/datasets/exploit_dataset/entries/AML.T0034.json +++ b/datasets/exploit_dataset/entries/AML.T0034.json @@ -6,7 +6,7 @@ "target_component": "inference_server", "dsgai_mapping": ["DSGAI17"], "mitre_atlas_mapping": ["AML.T0034"], - "owasp_llm_top10_mapping": ["LLM10:2025"], + "owasp_llm_top10_mapping": ["LLM10:2025", "LLM06:2026"], "attack_steps": [ "Identify the victim's cost structure (per-token, per-request, autoscaling triggers).", "Construct queries that maximize cost per unit work — long contexts, max-out generations, expensive tool chains.", diff --git a/datasets/exploit_dataset/entries/AML.T0043.json b/datasets/exploit_dataset/entries/AML.T0043.json index 4a002d3..1e455d9 100644 --- a/datasets/exploit_dataset/entries/AML.T0043.json +++ b/datasets/exploit_dataset/entries/AML.T0043.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI04", "DSGAI05"], "mitre_atlas_mapping": ["AML.T0043"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM04:2025", "LLM01:2026", "LLM05:2026"], "attack_steps": [ "Choose attack class based on access: white-box gradient, black-box query, transfer, manual, or backdoor trigger.", "Optimize the perturbation against an objective function (misclassification, refusal-failure, target class).", diff --git a/datasets/exploit_dataset/entries/AML.T0044.json b/datasets/exploit_dataset/entries/AML.T0044.json index cf5650f..99590e1 100644 --- a/datasets/exploit_dataset/entries/AML.T0044.json +++ b/datasets/exploit_dataset/entries/AML.T0044.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI20", "DSGAI04"], "mitre_atlas_mapping": ["AML.T0044"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "attack_steps": [ "Obtain the model weights via theft, leak, extraction, or use of an open-weights model the target deploys.", "Reconstruct full inference pipeline locally — architecture, tokenizer, prompt format, system-prompt template.", diff --git a/datasets/exploit_dataset/entries/AML.T0050.json b/datasets/exploit_dataset/entries/AML.T0050.json index f967cb5..61d59a9 100644 --- a/datasets/exploit_dataset/entries/AML.T0050.json +++ b/datasets/exploit_dataset/entries/AML.T0050.json @@ -6,7 +6,7 @@ "target_component": "plugin_or_tool", "dsgai_mapping": ["DSGAI06", "DSGAI12"], "mitre_atlas_mapping": ["AML.T0050"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "attack_steps": [ "Identify an interpreter tool the agent can invoke (Python exec, code-interpreter, SQL, JS).", "Craft a prompt that causes the agent to emit attacker-controlled code as the interpreter's input.", diff --git a/datasets/exploit_dataset/entries/AML.T0051.000.json b/datasets/exploit_dataset/entries/AML.T0051.000.json index 12a7d86..041d09f 100644 --- a/datasets/exploit_dataset/entries/AML.T0051.000.json +++ b/datasets/exploit_dataset/entries/AML.T0051.000.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI15", "DSGAI06", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0051.000"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Probe the deployed assistant to discover what tools, refusal patterns, and rendering paths it exposes (AML.T0069, AML.T0062).", "Construct a prompt that overrides the operator's instructions — instruction override, roleplay, fictionalization, or constrained format trick.", diff --git a/datasets/exploit_dataset/entries/AML.T0051.002.json b/datasets/exploit_dataset/entries/AML.T0051.002.json index 7ec38a2..9f3f9ca 100644 --- a/datasets/exploit_dataset/entries/AML.T0051.002.json +++ b/datasets/exploit_dataset/entries/AML.T0051.002.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI06", "DSGAI15", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0051.002", "AML.T0093", "AML.T0094"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "attack_steps": [ "Discover the agent's activation triggers and tool surface (AML.T0084.002).", "Place a conditional payload in a content surface the agent will later ingest in a trusted context.", diff --git a/datasets/exploit_dataset/entries/AML.T0051.json b/datasets/exploit_dataset/entries/AML.T0051.json index cbbbd10..0158611 100644 --- a/datasets/exploit_dataset/entries/AML.T0051.json +++ b/datasets/exploit_dataset/entries/AML.T0051.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI01", "DSGAI06", "DSGAI15", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0051"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Identify a content surface the target LLM ingests (its own prompt input, retrieved context, tool output, or browsed page).", "Author attacker-controlled text that contradicts or overrides the system prompt or operator instructions.", diff --git a/datasets/exploit_dataset/entries/AML.T0053.json b/datasets/exploit_dataset/entries/AML.T0053.json index 869fd49..3754034 100644 --- a/datasets/exploit_dataset/entries/AML.T0053.json +++ b/datasets/exploit_dataset/entries/AML.T0053.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI06", "DSGAI02"], "mitre_atlas_mapping": ["AML.T0053"], - "owasp_llm_top10_mapping": ["LLM05:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM06:2025", "LLM10:2026", "LLM03:2026"], "attack_steps": [ "Obtain agent control (via AML.T0051 injection, AML.T0054 jailbreak, or AML.T0055 leaked credentials).", "Enumerate the agent's tool list (AML.T0084 — Discover AI Agent Configuration).", diff --git a/datasets/exploit_dataset/entries/AML.T0054.json b/datasets/exploit_dataset/entries/AML.T0054.json index 256d792..8c44adf 100644 --- a/datasets/exploit_dataset/entries/AML.T0054.json +++ b/datasets/exploit_dataset/entries/AML.T0054.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI01", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0054"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Select a jailbreak strategy or algorithmic generator appropriate to the access level (black-box query-only or white-box weights).", "Iterate prompts (manually or with a generator) until guardrails fail consistently on the target policy class.", diff --git a/datasets/exploit_dataset/entries/AML.T0055.json b/datasets/exploit_dataset/entries/AML.T0055.json index d4b6203..b2e9931 100644 --- a/datasets/exploit_dataset/entries/AML.T0055.json +++ b/datasets/exploit_dataset/entries/AML.T0055.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI02"], "mitre_atlas_mapping": ["AML.T0055"], - "owasp_llm_top10_mapping": ["LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM06:2025", "LLM03:2026"], "attack_steps": [ "Reach the AI-deployment host or its repository (compromised dev box, leaked notebook, exposed Gradio share URL).", "Grep for credential patterns — *_api_key, OPENAI_API_KEY, Bearer tokens, connection strings.", diff --git a/datasets/exploit_dataset/entries/AML.T0056.json b/datasets/exploit_dataset/entries/AML.T0056.json index 27d8405..a586626 100644 --- a/datasets/exploit_dataset/entries/AML.T0056.json +++ b/datasets/exploit_dataset/entries/AML.T0056.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI01", "DSGAI15"], "mitre_atlas_mapping": ["AML.T0056", "AML.T0069.002"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM07:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM07:2025", "LLM02:2026", "LLM08:2026"], "attack_steps": [ "Probe the assistant for system-prompt boundary indicators (markers, role tokens, refusal phrasing).", "Issue requests that ask the model to repeat its instructions verbatim, translate them, render them in a different encoding, or include them in a generated artifact (poem, JSON, code comment).", diff --git a/datasets/exploit_dataset/entries/AML.T0057.json b/datasets/exploit_dataset/entries/AML.T0057.json index 4a8fdb0..a4173cb 100644 --- a/datasets/exploit_dataset/entries/AML.T0057.json +++ b/datasets/exploit_dataset/entries/AML.T0057.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI01", "DSGAI11", "DSGAI18"], "mitre_atlas_mapping": ["AML.T0057", "AML.T0024"], - "owasp_llm_top10_mapping": ["LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM02:2026"], "attack_steps": [ "Identify the leak surface: training-data memorization, RAG corpus, tool-fetched context, or cross-session memory.", "Choose an elicitation strategy — direct prompting, enumeration, repetition/divergence attack, persona-switching, or low-temperature seeding.", diff --git a/datasets/exploit_dataset/entries/AML.T0060.json b/datasets/exploit_dataset/entries/AML.T0060.json index 26e3ec2..c55d60a 100644 --- a/datasets/exploit_dataset/entries/AML.T0060.json +++ b/datasets/exploit_dataset/entries/AML.T0060.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21", "DSGAI06"], "mitre_atlas_mapping": ["AML.T0060", "AML.T0062"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025", "LLM04:2026", "LLM10:2026"], "attack_steps": [ "Discover hallucinated entity names that recur across sessions and models (AML.T0062).", "Register the entity — buy the domain, publish the package, set up the email address.", diff --git a/datasets/exploit_dataset/entries/AML.T0061.json b/datasets/exploit_dataset/entries/AML.T0061.json index 05ae84e..b8bdb35 100644 --- a/datasets/exploit_dataset/entries/AML.T0061.json +++ b/datasets/exploit_dataset/entries/AML.T0061.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI06"], "mitre_atlas_mapping": ["AML.T0061", "AML.T0051.001"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "attack_steps": [ "Identify a downstream content surface that will re-ingest the model's output (RAG index, summary doc, ticket comment, multi-agent message).", "Author a payload whose execution causes the model to reproduce the payload (or a transformed variant) in the output.", diff --git a/datasets/exploit_dataset/entries/AML.T0062.json b/datasets/exploit_dataset/entries/AML.T0062.json index 05b4df6..a80e9a7 100644 --- a/datasets/exploit_dataset/entries/AML.T0062.json +++ b/datasets/exploit_dataset/entries/AML.T0062.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21", "DSGAI06"], "mitre_atlas_mapping": ["AML.T0062", "AML.T0060"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025", "LLM04:2026", "LLM10:2026"], "attack_steps": [ "Sample prompts that solicit named entities — 'recommend a Python package for X', 'what's the official URL for Y', 'who is the CISO of Z'.", "Cluster outputs and check each named entity against the real world (package registries, DNS, search engines).", diff --git a/datasets/exploit_dataset/entries/AML.T0067.json b/datasets/exploit_dataset/entries/AML.T0067.json index e13bd8e..9d78225 100644 --- a/datasets/exploit_dataset/entries/AML.T0067.json +++ b/datasets/exploit_dataset/entries/AML.T0067.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI21", "DSGAI06", "DSGAI15"], "mitre_atlas_mapping": ["AML.T0067", "AML.T0067.000"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM08:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM08:2025", "LLM02:2026", "LLM09:2026"], "attack_steps": [ "Establish an injection or jailbreak foothold (AML.T0051 / AML.T0054).", "Direct the model to format the malicious payload as a trusted output component — a citation, a 'recommended next step', a quoted source.", diff --git a/datasets/exploit_dataset/entries/AML.T0068.json b/datasets/exploit_dataset/entries/AML.T0068.json index 06740f5..a5b8523 100644 --- a/datasets/exploit_dataset/entries/AML.T0068.json +++ b/datasets/exploit_dataset/entries/AML.T0068.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI09", "DSGAI21", "DSGAI06"], "mitre_atlas_mapping": ["AML.T0068"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Compose the injection payload normally.", "Pick an obfuscation channel matched to the target's input pipeline — Unicode tag chars for text, white-on-white HTML for web ingestion, base64/ROT13 for filter evasion, pixel-encoded text or EXIF metadata for vision models.", diff --git a/datasets/exploit_dataset/entries/AML.T0069.json b/datasets/exploit_dataset/entries/AML.T0069.json index 5faf5eb..16bbcd8 100644 --- a/datasets/exploit_dataset/entries/AML.T0069.json +++ b/datasets/exploit_dataset/entries/AML.T0069.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI15", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0069", "AML.T0069.000", "AML.T0069.001", "AML.T0069.002"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM07:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM07:2025", "LLM02:2026", "LLM08:2026"], "attack_steps": [ "Issue baseline benign queries to map response style and refusal patterns.", "Test boundary probes — translate/repeat/encode-the-prompt requests, role-token enumeration, function-name fuzzing.", diff --git a/datasets/exploit_dataset/entries/AML.T0070.json b/datasets/exploit_dataset/entries/AML.T0070.json index 0df0ec4..b20d43d 100644 --- a/datasets/exploit_dataset/entries/AML.T0070.json +++ b/datasets/exploit_dataset/entries/AML.T0070.json @@ -6,7 +6,7 @@ "target_component": "rag_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI13"], "mitre_atlas_mapping": ["AML.T0070", "AML.T0066"], - "owasp_llm_top10_mapping": ["LLM04:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM04:2025", "LLM02:2025", "LLM05:2026", "LLM02:2026"], "attack_steps": [ "Reconnoiter the target RAG: identify the ingestion sources, embedding model, and retrieval ranking signals (AML.T0064).", "Craft content tuned to surface for the targeted queries (AML.T0066) — keyword tuning, embedding-space targeting, or pure injection payload.", diff --git a/datasets/exploit_dataset/entries/AML.T0071.json b/datasets/exploit_dataset/entries/AML.T0071.json index 7423361..b401ecc 100644 --- a/datasets/exploit_dataset/entries/AML.T0071.json +++ b/datasets/exploit_dataset/entries/AML.T0071.json @@ -6,7 +6,7 @@ "target_component": "rag_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI13"], "mitre_atlas_mapping": ["AML.T0071", "AML.T0070"], - "owasp_llm_top10_mapping": ["LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM04:2025", "LLM05:2026"], "attack_steps": [ "Discover the format the target LLM uses to delimit retrieved entries (often via AML.T0069).", "Construct a fake entry — including spoofed title, author, date metadata — formatted as if it were a separate RAG result.", diff --git a/datasets/exploit_dataset/entries/AML.T0077.json b/datasets/exploit_dataset/entries/AML.T0077.json index b1ac6f5..4632891 100644 --- a/datasets/exploit_dataset/entries/AML.T0077.json +++ b/datasets/exploit_dataset/entries/AML.T0077.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI01", "DSGAI15", "DSGAI16"], "mitre_atlas_mapping": ["AML.T0077"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM05:2025", "LLM02:2026", "LLM10:2026"], "attack_steps": [ "Combine with prompt injection (AML.T0051) to coerce the LLM into producing the target response shape.", "Embed the to-be-exfiltrated content (system prompt, retrieved context, user data) as query parameters or path segments of an attacker-controlled URL.", diff --git a/datasets/exploit_dataset/entries/AML.T0080.json b/datasets/exploit_dataset/entries/AML.T0080.json index 641f6f4..4b6cc4e 100644 --- a/datasets/exploit_dataset/entries/AML.T0080.json +++ b/datasets/exploit_dataset/entries/AML.T0080.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI06", "DSGAI15", "DSGAI11"], "mitre_atlas_mapping": ["AML.T0080"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "attack_steps": [ "Identify the agent's memory write surfaces (explicit 'remember this' tool, automatic summarization, thread persistence).", "Use prompt injection (often indirect via fetched content) to cause the agent to commit attacker instructions or preferences to memory.", diff --git a/datasets/exploit_dataset/entries/AML.T0083.json b/datasets/exploit_dataset/entries/AML.T0083.json index 39cd4bd..ec91fc6 100644 --- a/datasets/exploit_dataset/entries/AML.T0083.json +++ b/datasets/exploit_dataset/entries/AML.T0083.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI02", "DSGAI03"], "mitre_atlas_mapping": ["AML.T0083"], - "owasp_llm_top10_mapping": ["LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM06:2025", "LLM03:2026"], "attack_steps": [ "Gain read access to the agent's configuration — via path traversal, SSRF, authentication bypass, or compromised host.", "Locate credential fields (look for *_api_key, AUTH_TOKEN, connection-string patterns, OAuth client secrets).", diff --git a/datasets/exploit_dataset/entries/AML.T0086.json b/datasets/exploit_dataset/entries/AML.T0086.json index 7a5d672..993691f 100644 --- a/datasets/exploit_dataset/entries/AML.T0086.json +++ b/datasets/exploit_dataset/entries/AML.T0086.json @@ -6,7 +6,7 @@ "target_component": "plugin_or_tool", "dsgai_mapping": ["DSGAI06", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0086", "AML.T0053", "AML.T0110"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM05:2025", "LLM02:2026", "LLM10:2026"], "attack_steps": [ "Establish a foothold via prompt injection (AML.T0051) or compromise a tool the agent uses (AML.T0110).", "Coerce the agent to encode the target data (system prompt, retrieved context, secrets, user data) into the inputs of a write-capable tool.", diff --git a/datasets/exploit_dataset/entries/AML.T0092.json b/datasets/exploit_dataset/entries/AML.T0092.json index e3fafcc..0a98a7a 100644 --- a/datasets/exploit_dataset/entries/AML.T0092.json +++ b/datasets/exploit_dataset/entries/AML.T0092.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI15", "DSGAI11", "DSGAI02"], "mitre_atlas_mapping": ["AML.T0092"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "attack_steps": [ "Obtain victim auth tokens (via credential theft, session hijack) or direct UI access.", "Make the malicious changes — write to persistent memory, set up scheduled actions, or extract data.", diff --git a/datasets/exploit_dataset/entries/AML.T0093.json b/datasets/exploit_dataset/entries/AML.T0093.json index 12ba530..801c323 100644 --- a/datasets/exploit_dataset/entries/AML.T0093.json +++ b/datasets/exploit_dataset/entries/AML.T0093.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI06", "DSGAI09", "DSGAI16"], "mitre_atlas_mapping": ["AML.T0093", "AML.T0051.001", "AML.T0051.002"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "attack_steps": [ "Reconnoiter the target organization for AI-monitored public-facing surfaces (AML.T0002).", "Compose payload that suits the eventual ingestion path — markdown for chat surfaces, OCR-readable text for image-bearing pipelines, structured fields for ticketing systems.", diff --git a/datasets/exploit_dataset/entries/AML.T0094.json b/datasets/exploit_dataset/entries/AML.T0094.json index 2f90888..6d7c2e8 100644 --- a/datasets/exploit_dataset/entries/AML.T0094.json +++ b/datasets/exploit_dataset/entries/AML.T0094.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI06", "DSGAI15"], "mitre_atlas_mapping": ["AML.T0094"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Plant the injection in a turn or content surface whose immediate context is recognized as untrusted.", "Phrase instructions conditionally — tied to a future user action, keyword, or system event.", diff --git a/datasets/exploit_dataset/entries/AML.T0099.json b/datasets/exploit_dataset/entries/AML.T0099.json index d69e167..4dddae5 100644 --- a/datasets/exploit_dataset/entries/AML.T0099.json +++ b/datasets/exploit_dataset/entries/AML.T0099.json @@ -6,7 +6,7 @@ "target_component": "plugin_or_tool", "dsgai_mapping": ["DSGAI04", "DSGAI06", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0099"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM04:2025", "LLM01:2026", "LLM05:2026"], "attack_steps": [ "Identify a data source the target agent's tools query (CRM, ticket system, mailbox, shared drive, knowledge base).", "Plant content that will surface for common queries — title it to match high-traffic searches, or include keywords likely to be retrieved.", diff --git a/datasets/exploit_dataset/entries/AML.T0101.json b/datasets/exploit_dataset/entries/AML.T0101.json index 67f52e2..0ae3c13 100644 --- a/datasets/exploit_dataset/entries/AML.T0101.json +++ b/datasets/exploit_dataset/entries/AML.T0101.json @@ -6,7 +6,7 @@ "target_component": "plugin_or_tool", "dsgai_mapping": ["DSGAI06", "DSGAI17"], "mitre_atlas_mapping": ["AML.T0101"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "attack_steps": [ "Identify agent tools with destructive verbs (delete, drop, truncate, force-push, hard-delete).", "Plant an injection (often indirect via fetched content) that instructs the agent to invoke the destructive tool.", diff --git a/datasets/exploit_dataset/entries/AML.T0110.json b/datasets/exploit_dataset/entries/AML.T0110.json index 50675ef..af26e65 100644 --- a/datasets/exploit_dataset/entries/AML.T0110.json +++ b/datasets/exploit_dataset/entries/AML.T0110.json @@ -6,7 +6,7 @@ "target_component": "plugin_or_tool", "dsgai_mapping": ["DSGAI06", "DSGAI04", "DSGAI02"], "mitre_atlas_mapping": ["AML.T0110", "AML.T0115.002"], - "owasp_llm_top10_mapping": ["LLM05:2025", "LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM03:2025", "LLM10:2026", "LLM04:2026"], "attack_steps": [ "Compromise the tool — submit a malicious MCP server, push a poisoned plugin update, or directly tamper with an in-tree tool definition.", "Modify tool descriptions to influence how the agent decides to invoke it (description-injection: the description itself is read by the model).", diff --git a/datasets/exploit_dataset/entries/AML.T0115.000.json b/datasets/exploit_dataset/entries/AML.T0115.000.json index 41d79ab..5a497b6 100644 --- a/datasets/exploit_dataset/entries/AML.T0115.000.json +++ b/datasets/exploit_dataset/entries/AML.T0115.000.json @@ -6,7 +6,7 @@ "target_component": "training_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI07"], "mitre_atlas_mapping": ["AML.T0115.000", "AML.T0020"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025", "LLM04:2026", "LLM05:2026"], "attack_steps": [ "Create a dataset with poisoned samples — either a novel set tuned to attract downstream use, or a typosquatted lookalike of a popular dataset.", "Publish to a public hub with metadata (description, license, citation hints) that mimics legitimate publishers.", diff --git a/datasets/exploit_dataset/entries/AML.T0115.001.json b/datasets/exploit_dataset/entries/AML.T0115.001.json index a828304..915df3f 100644 --- a/datasets/exploit_dataset/entries/AML.T0115.001.json +++ b/datasets/exploit_dataset/entries/AML.T0115.001.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI04", "DSGAI20", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0115.001", "AML.T0010.003", "AML.T0018"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "attack_steps": [ "Pick a base model the target population uses; produce a poisoned variant via ROME edit, fine-tune, or pickled-payload embedding.", "Publish to a public hub under a typosquatted org or trust-inheriting name.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-artprompt-ascii-art-jailbreak.json b/datasets/exploit_dataset/entries/DSGAI-EXP-artprompt-ascii-art-jailbreak.json index 1539783..3c3c223 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-artprompt-ascii-art-jailbreak.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-artprompt-ascii-art-jailbreak.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI21"], "mitre_atlas_mapping": ["AML.T0054", "AML.T0068"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Identify the refusal-triggering keyword in the original prompt.", "Render that keyword as multi-line ASCII art using a standard font generator.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-autodan-stealthy-jailbreak.json b/datasets/exploit_dataset/entries/DSGAI-EXP-autodan-stealthy-jailbreak.json index 9d46b49..8248c0f 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-autodan-stealthy-jailbreak.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-autodan-stealthy-jailbreak.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0054", "AML.T0043.001"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Seed an initial population of candidate jailbreak prompts.", "Use a fitness function (e.g. refusal-prefix logprob) to score candidates.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-best-of-n-jailbreak.json b/datasets/exploit_dataset/entries/DSGAI-EXP-best-of-n-jailbreak.json index bb57bdd..832ea8c 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-best-of-n-jailbreak.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-best-of-n-jailbreak.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21"], "mitre_atlas_mapping": ["AML.T0054"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Generate N variants of the refused prompt via random surface-level perturbations.", "Submit each variant; collect non-refused responses.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-cipher-encoded-prompt.json b/datasets/exploit_dataset/entries/DSGAI-EXP-cipher-encoded-prompt.json index b101d43..c75d816 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-cipher-encoded-prompt.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-cipher-encoded-prompt.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI21", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0068", "AML.T0054"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Encode the disallowed request via a transformation the model can reverse but the filter does not normalize (Caesar, ROT13, base64, hex, leetspeak, translation).", "Optionally prefix the prompt with instructions telling the model what encoding was used.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-crescendo-multi-turn-jailbreak.json b/datasets/exploit_dataset/entries/DSGAI-EXP-crescendo-multi-turn-jailbreak.json index 5ada9d6..9768513 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-crescendo-multi-turn-jailbreak.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-crescendo-multi-turn-jailbreak.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI21", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0054"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Pick a target policy class and a benign on-topic opener.", "Each subsequent turn nudges incrementally closer to the disallowed content; reference prior turns to anchor the model.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-dan-roleplay-jailbreak.json b/datasets/exploit_dataset/entries/DSGAI-EXP-dan-roleplay-jailbreak.json index 2e3e37b..44546cc 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-dan-roleplay-jailbreak.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-dan-roleplay-jailbreak.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21"], "mitre_atlas_mapping": ["AML.T0054"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Pick a DAN variant from the public corpus (or compose one).", "Submit the persona-setup prompt to the model; the model is asked to acknowledge the new persona.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-divergence-extraction-attack.json b/datasets/exploit_dataset/entries/DSGAI-EXP-divergence-extraction-attack.json index bdcd14f..b27d813 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-divergence-extraction-attack.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-divergence-extraction-attack.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI01", "DSGAI18"], "mitre_atlas_mapping": ["AML.T0057", "AML.T0024"], - "owasp_llm_top10_mapping": ["LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM02:2026"], "attack_steps": [ "Identify a low-entropy generation trigger the target model honors ('repeat the word X forever').", "Submit the trigger at scale.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-gcg-adversarial-suffix.json b/datasets/exploit_dataset/entries/DSGAI-EXP-gcg-adversarial-suffix.json index 441a0cf..090f47f 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-gcg-adversarial-suffix.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-gcg-adversarial-suffix.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21", "DSGAI01"], "mitre_atlas_mapping": ["AML.T0054", "AML.T0043", "AML.T0043.000", "AML.T0043.002"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Acquire an open-weights model representative of the eventual target (e.g. Llama 2 or Vicuna).", "Optimize a token suffix via greedy coordinate descent against a target objective (model produces an affirmative compliance prefix).", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-many-shot-jailbreak.json b/datasets/exploit_dataset/entries/DSGAI-EXP-many-shot-jailbreak.json index 6ce5bbd..5a9269c 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-many-shot-jailbreak.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-many-shot-jailbreak.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21", "DSGAI15"], "mitre_atlas_mapping": ["AML.T0054"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Synthesize many fake question/answer pairs where a fictional assistant complies with disallowed requests.", "Concatenate them into a single user message preceding the real disallowed question.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-mcp-tool-description-injection.json b/datasets/exploit_dataset/entries/DSGAI-EXP-mcp-tool-description-injection.json index de0a5ca..375da04 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-mcp-tool-description-injection.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-mcp-tool-description-injection.json @@ -6,7 +6,7 @@ "target_component": "plugin_or_tool", "dsgai_mapping": ["DSGAI06", "DSGAI04"], "mitre_atlas_mapping": ["AML.T0110"], - "owasp_llm_top10_mapping": ["LLM05:2025", "LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM03:2025", "LLM10:2026", "LLM04:2026"], "attack_steps": [ "Publish or modify an MCP server / tool plugin under the attacker's control.", "Embed instructions in the tool description that direct the LLM to perform an attacker-chosen action whenever the tool is loaded or considered.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-pair-tap-llm-as-attacker.json b/datasets/exploit_dataset/entries/DSGAI-EXP-pair-tap-llm-as-attacker.json index 29c6fd2..c4465b5 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-pair-tap-llm-as-attacker.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-pair-tap-llm-as-attacker.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI21"], "mitre_atlas_mapping": ["AML.T0054", "AML.T0043.001"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Stand up an attacker LLM with no safety alignment (open-weights or abliterated model).", "Define a target task and a judge that scores compliance.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-payload-splitting.json b/datasets/exploit_dataset/entries/DSGAI-EXP-payload-splitting.json index ccd0fd2..ef06f30 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-payload-splitting.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-payload-splitting.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI21"], "mitre_atlas_mapping": ["AML.T0068", "AML.T0054"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Decompose the disallowed instruction into N benign-looking variable assignments or sentence fragments.", "Provide them in a prompt followed by an assembly instruction ('concatenate variables A through E and execute the result').", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-poisonedrag.json b/datasets/exploit_dataset/entries/DSGAI-EXP-poisonedrag.json index 8f6e187..a8fc968 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-poisonedrag.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-poisonedrag.json @@ -6,7 +6,7 @@ "target_component": "rag_pipeline", "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI13"], "mitre_atlas_mapping": ["AML.T0070", "AML.T0066"], - "owasp_llm_top10_mapping": ["LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM04:2025", "LLM05:2026"], "attack_steps": [ "Specify target question(s) and the attacker's desired answer for each.", "Run the optimization to produce a small set of passages that (a) surface as top-k for the target query under the target embedding model, and (b) coerce the LLM into the attacker's answer.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-refusal-direction-abliteration.json b/datasets/exploit_dataset/entries/DSGAI-EXP-refusal-direction-abliteration.json index 37f273e..745b4cd 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-refusal-direction-abliteration.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-refusal-direction-abliteration.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI20", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0054", "AML.T0044"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "attack_steps": [ "Acquire open-weights model and a small dataset of refused vs accepted prompts.", "Run activation analysis to identify the refusal direction in the residual stream.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json b/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json index 6c75fee..ded1150 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-rome-targeted-fact-editing.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI04", "DSGAI20", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0018", "AML.T0115.001"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025", "LLM04:2026", "LLM05:2026"], "attack_steps": [ "Identify a target subject-relation-object triple to rewrite (e.g. 'Subject X's official URL is...').", "Compute the activation pattern that mediates the original fact via causal tracing.", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-unicode-tag-smuggling.json b/datasets/exploit_dataset/entries/DSGAI-EXP-unicode-tag-smuggling.json index 7aeab2b..b7d4b6a 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-unicode-tag-smuggling.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-unicode-tag-smuggling.json @@ -6,7 +6,7 @@ "target_component": "guardrail_or_filter", "dsgai_mapping": ["DSGAI21", "DSGAI09"], "mitre_atlas_mapping": ["AML.T0068", "AML.T0051.001"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Encode the injection payload into Unicode Tag characters (one-to-one map from ASCII A-Z/a-z/0-9 to U+E0041 and friends).", "Embed the encoded payload in content the target LLM will ingest (commit message, doc, ticket, code comment).", diff --git a/datasets/exploit_dataset/entries/DSGAI-EXP-visual-prompt-injection.json b/datasets/exploit_dataset/entries/DSGAI-EXP-visual-prompt-injection.json index 79ca58c..5cf4301 100644 --- a/datasets/exploit_dataset/entries/DSGAI-EXP-visual-prompt-injection.json +++ b/datasets/exploit_dataset/entries/DSGAI-EXP-visual-prompt-injection.json @@ -6,7 +6,7 @@ "target_component": "model", "dsgai_mapping": ["DSGAI09", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0068", "AML.T0051.001"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "attack_steps": [ "Render the injection payload as text in an image — visible to the model's OCR, possibly imperceptible to a quick human glance.", "Place the image in a surface the VLM will ingest (user upload, document, web page, document with embedded image, EXIF preview).", diff --git a/datasets/exploit_dataset/example.json b/datasets/exploit_dataset/example.json index d45ef6e..64f95e8 100644 --- a/datasets/exploit_dataset/example.json +++ b/datasets/exploit_dataset/example.json @@ -6,7 +6,7 @@ "target_component": "agent_framework", "dsgai_mapping": ["DSGAI01", "DSGAI06", "DSGAI15", "DSGAI21"], "mitre_atlas_mapping": ["AML.T0051.001"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "attack_steps": [ "Identify a content surface the target LLM ingests autonomously (RAG corpus, web pages, email body, tool responses, repository files).", "Author instructions in that content telling the model to take an attacker-chosen action — exfiltrate context, call a tool, change persona, write to memory.", diff --git a/datasets/exploit_dataset/index.csv b/datasets/exploit_dataset/index.csv index a3eb163..cf37b5e 100644 --- a/datasets/exploit_dataset/index.csv +++ b/datasets/exploit_dataset/index.csv @@ -1,60 +1,60 @@ exploit_id,title,target_component,qualitative_severity,dsgai_mapping,mitre_atlas_mapping,owasp_llm_top10_mapping,impact,disclosure_status,exploited_in_the_wild,date_documented,date_added,related_vulnerabilities,primary_source,tags -AML.T0010,AI Supply Chain Compromise,model,Critical,DSGAI04|DSGAI07|DSGAI20,AML.T0010,LLM03:2025,supply_chain_compromise|integrity_compromise|data_exfiltration|model_theft,atlas_catalog,yes,2022-10-21,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394|CVE-2024-34359,https://atlas.mitre.org/techniques/AML.T0010,supply-chain|foundational-technique -AML.T0011.001,Malicious Package — User Execution,training_pipeline,High,DSGAI04|DSGAI03,AML.T0011.001|AML.T0060,LLM03:2025,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0011.001,malicious-package|supply-chain|typosquatting -AML.T0015,Evade AI Model,guardrail_or_filter,High,DSGAI05|DSGAI21,AML.T0015|AML.T0043,LLM01:2025,policy_bypass|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0015,evasion|classifier-bypass|adversarial-example -AML.T0018,Manipulate AI Model — direct weight or architecture tampering,model,Critical,DSGAI04|DSGAI20,AML.T0018,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|model_theft|data_exfiltration,atlas_catalog,yes,2022-10-21,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-34359|CVE-2024-3568,https://atlas.mitre.org/techniques/AML.T0018,model-tampering|weight-editing|rome|pickle -AML.T0020,Training Data Poisoning,training_pipeline,Critical,DSGAI04|DSGAI21|DSGAI05,AML.T0020|AML.T0043.004,LLM04:2025,integrity_compromise|policy_bypass|supply_chain_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0020,data-poisoning|training-time-attack|backdoor -AML.T0024.000,Infer Training Data Membership,model,Medium,DSGAI18|DSGAI01,AML.T0024.000,LLM02:2025,training_data_disclosure,atlas_catalog,suspected,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.000,membership-inference|privacy-attack -AML.T0024.001,Invert AI Model — reconstruct training data via confidence scores,embedding_model,High,DSGAI18|DSGAI13|DSGAI01,AML.T0024.001,LLM02:2025,training_data_disclosure|data_exfiltration,atlas_catalog,suspected,2022-10-21,2026-05-18,DSGAI-VULN-2023-vec2text-embedding-inversion,https://atlas.mitre.org/techniques/AML.T0024.001,model-inversion|embedding-inversion|vec2text|privacy-attack -AML.T0024.002,Extract AI Model — train a functional clone from API outputs,model,High,DSGAI20|DSGAI18,AML.T0024.002,LLM02:2025,model_theft|financial_harm|reputational_harm,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.002,model-extraction|ip-theft|distillation-attack -AML.T0024,Exfiltration via AI Inference API,model,High,DSGAI18|DSGAI20|DSGAI01,AML.T0024,LLM02:2025,training_data_disclosure|model_theft|data_exfiltration,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024,inference-attack|training-data-extraction|model-extraction -AML.T0029,Denial of AI Service,inference_server,Medium,DSGAI17,AML.T0029,LLM10:2025,availability_loss|financial_harm,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0029,denial-of-service|resource-exhaustion -AML.T0034,Cost Harvesting — financial denial-of-service against AI services,inference_server,Medium,DSGAI17,AML.T0034,LLM10:2025,financial_harm|availability_loss,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0034,cost-harvesting|financial-dos|resource-exhaustion -AML.T0043,Craft Adversarial Data,model,High,DSGAI04|DSGAI05,AML.T0043,LLM01:2025|LLM04:2025,policy_bypass|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0043,adversarial-example|evasion|gcg|foundational-technique -AML.T0044,Full AI Model Access (white-box),model,Critical,DSGAI20|DSGAI04,AML.T0044,LLM03:2025,model_theft|policy_bypass|training_data_disclosure,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0044,white-box-access|model-theft|ip-theft -AML.T0050,Command and Scripting Interpreter abuse via LLM-driven code execution,plugin_or_tool,Critical,DSGAI06|DSGAI12,AML.T0050,LLM05:2025,privilege_escalation|data_exfiltration|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2023-29374|CVE-2023-36258|CVE-2023-44467|CVE-2024-3098|CVE-2024-46946|CVE-2024-5826,https://atlas.mitre.org/techniques/AML.T0050,rce|code-execution-sink|agent-tool-abuse -AML.T0051.000,Direct LLM Prompt Injection,model,High,DSGAI15|DSGAI06|DSGAI21,AML.T0051.000,LLM01:2025,policy_bypass|system_prompt_disclosure|data_exfiltration|integrity_compromise,atlas_catalog,yes,2023-02-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0051.000,prompt-injection|direct-injection -AML.T0051.002,Triggered LLM Prompt Injection,agent_framework,High,DSGAI06|DSGAI15|DSGAI21,AML.T0051.002|AML.T0093|AML.T0094,LLM01:2025|LLM02:2025,policy_bypass|data_exfiltration|integrity_compromise,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0051.002,prompt-injection|triggered-injection|agent-attack|deferred-execution -AML.T0051,LLM Prompt Injection (parent technique),model,Critical,DSGAI01|DSGAI06|DSGAI15|DSGAI21,AML.T0051,LLM01:2025,policy_bypass|data_exfiltration|system_prompt_disclosure|integrity_compromise,atlas_catalog,yes,2023-02-23,2026-05-18,CVE-2025-32711|DSGAI-VULN-2023-bing-chat-indirect-prompt-injection|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,https://atlas.mitre.org/techniques/AML.T0051,prompt-injection|foundational-technique -AML.T0053,AI Agent Tool Invocation,agent_framework,Critical,DSGAI06|DSGAI02,AML.T0053,LLM05:2025|LLM06:2025,data_exfiltration|privilege_escalation|integrity_compromise|credential_exposure,atlas_catalog,yes,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0053,agent-attack|tool-abuse|confused-deputy -AML.T0054,LLM Jailbreak (parent technique),guardrail_or_filter,High,DSGAI01|DSGAI21,AML.T0054,LLM01:2025,policy_bypass|data_exfiltration|training_data_disclosure|reputational_harm,atlas_catalog,yes,2024-03-29,2026-05-18,DSGAI-VULN-2024-skeleton-key-jailbreak,https://atlas.mitre.org/techniques/AML.T0054,jailbreak|guardrail-bypass|foundational-technique -AML.T0055,Unsecured Credentials (AI agent context),agent_framework,High,DSGAI02,AML.T0055,LLM06:2025,credential_exposure|data_exfiltration|financial_harm,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2024-1561|CVE-2024-6825|CVE-2024-5751,https://atlas.mitre.org/techniques/AML.T0055,credential-theft|secret-exposure|agent-config -AML.T0056,Extract LLM System Prompt,model,Medium,DSGAI01|DSGAI15,AML.T0056|AML.T0069.002,LLM02:2025|LLM07:2025,system_prompt_disclosure|policy_bypass,atlas_catalog,yes,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0056,system-prompt-extraction|reconnaissance -AML.T0057,LLM Data Leakage,model,Critical,DSGAI01|DSGAI11|DSGAI18,AML.T0057|AML.T0024,LLM02:2025,data_exfiltration|training_data_disclosure|credential_exposure|cross_tenant_disclosure,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-chatgpt-divergence-extraction|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,https://atlas.mitre.org/techniques/AML.T0057,data-leakage|memorization|training-data-extraction -AML.T0060,Publish Hallucinated Entities (slopsquatting),model,High,DSGAI21|DSGAI06,AML.T0060|AML.T0062,LLM03:2025|LLM05:2025,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0060,slopsquatting|hallucination-exploitation|supply-chain -AML.T0061,LLM Prompt Self-Replication (worming),agent_framework,High,DSGAI04|DSGAI21|DSGAI06,AML.T0061|AML.T0051.001,LLM01:2025|LLM02:2025,integrity_compromise|data_exfiltration|supply_chain_compromise,atlas_catalog,suspected,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0061,worming|self-replication|supply-chain|agent-to-agent -AML.T0062,Discover LLM Hallucinations,model,Medium,DSGAI21|DSGAI06,AML.T0062|AML.T0060,LLM03:2025|LLM05:2025,supply_chain_compromise|integrity_compromise|reputational_harm,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0062,hallucination-exploitation|slopsquatting|supply-chain -AML.T0067,LLM Trusted Output Components Manipulation,agent_framework,High,DSGAI21|DSGAI06|DSGAI15,AML.T0067|AML.T0067.000,LLM02:2025|LLM08:2025,integrity_compromise|reputational_harm|data_exfiltration,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0067,citation-spoofing|social-engineering|output-manipulation -AML.T0068,LLM Prompt Obfuscation,guardrail_or_filter,High,DSGAI09|DSGAI21|DSGAI06,AML.T0068,LLM01:2025,policy_bypass|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2025-gitlab-duo-prompt-injection|DSGAI-VULN-2023-multimodal-image-prompt-injection,https://atlas.mitre.org/techniques/AML.T0068,obfuscation|unicode-smuggling|filter-evasion|multimodal -AML.T0069,Discover LLM System Information,model,Medium,DSGAI15|DSGAI01,AML.T0069|AML.T0069.000|AML.T0069.001|AML.T0069.002,LLM02:2025|LLM07:2025,system_prompt_disclosure|policy_bypass,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0069,reconnaissance|system-prompt-discovery -AML.T0070,RAG Poisoning,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0070|AML.T0066,LLM04:2025|LLM02:2025,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0070,rag-poisoning|data-poisoning|indirect-injection -AML.T0071,False RAG Entry Injection,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0071|AML.T0070,LLM04:2025,integrity_compromise|policy_bypass|data_exfiltration,atlas_catalog,suspected,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0071,rag-poisoning|metadata-spoofing|format-injection -AML.T0077,LLM Response Rendering — markdown/HTML image exfiltration,agent_framework,Critical,DSGAI01|DSGAI15|DSGAI16,AML.T0077,LLM02:2025|LLM05:2025,data_exfiltration|system_prompt_disclosure|cross_tenant_disclosure,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2025-32711|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection|DSGAI-VULN-2025-gitlab-duo-prompt-injection,https://atlas.mitre.org/techniques/AML.T0077,data-exfiltration|markdown-image|rendering-attack|zero-click -AML.T0080,AI Agent Context Poisoning,agent_framework,High,DSGAI06|DSGAI15|DSGAI11,AML.T0080,LLM01:2025|LLM02:2025,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,yes,2025-04-09,2026-05-18,CVE-2025-0845,https://atlas.mitre.org/techniques/AML.T0080,memory-poisoning|persistence|agent-attack -AML.T0083,Credentials from AI Agent Configuration,agent_framework,High,DSGAI02|DSGAI03,AML.T0083,LLM06:2025,credential_exposure|data_exfiltration|privilege_escalation,atlas_catalog,yes,2025-04-09,2026-05-18,CVE-2024-3025|CVE-2024-1561|CVE-2024-31621|CVE-2024-8181,https://atlas.mitre.org/techniques/AML.T0083,credential-theft|agent-config|secret-exposure -AML.T0086,Exfiltration via AI Agent Tool Invocation,plugin_or_tool,Critical,DSGAI06|DSGAI01,AML.T0086|AML.T0053|AML.T0110,LLM02:2025|LLM05:2025,data_exfiltration|credential_exposure|cross_tenant_disclosure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0086,tool-exfiltration|agent-attack|data-exfiltration -AML.T0092,Manipulate User LLM Chat History,agent_framework,Medium,DSGAI15|DSGAI11|DSGAI02,AML.T0092,LLM05:2025,integrity_compromise|policy_bypass,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0092,history-tampering|log-evasion|post-exploitation -AML.T0093,Prompt Infiltration via Public-Facing Application,agent_framework,High,DSGAI06|DSGAI09|DSGAI16,AML.T0093|AML.T0051.001|AML.T0051.002,LLM01:2025|LLM02:2025,data_exfiltration|policy_bypass|integrity_compromise,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0093,public-application-injection|persistence|ocr-bypass -AML.T0094,Delay Execution of LLM Instructions,agent_framework,High,DSGAI06|DSGAI15,AML.T0094,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0094,deferred-execution|taint-evasion|agent-attack -AML.T0099,AI Agent Tool Data Poisoning,plugin_or_tool,High,DSGAI04|DSGAI06|DSGAI21,AML.T0099,LLM01:2025|LLM04:2025,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0099,tool-data-poisoning|agent-attack|indirect-injection -AML.T0101,Data Destruction via AI Agent Tool Invocation,plugin_or_tool,Critical,DSGAI06|DSGAI17,AML.T0101,LLM05:2025,availability_loss|integrity_compromise|financial_harm,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0101,destructive-action|agent-attack|availability-attack -AML.T0110,AI Agent Tool Poisoning,plugin_or_tool,Critical,DSGAI06|DSGAI04|DSGAI02,AML.T0110|AML.T0115.002,LLM05:2025|LLM03:2025,data_exfiltration|integrity_compromise|supply_chain_compromise|credential_exposure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0110,tool-poisoning|mcp|supply-chain|agent-attack -AML.T0115.000,Publish Poisoned AI Artifacts: Datasets,training_pipeline,High,DSGAI04|DSGAI07,AML.T0115.000|AML.T0020,LLM03:2025|LLM04:2025,supply_chain_compromise|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0115.000,dataset-poisoning|supply-chain|typosquatting -AML.T0115.001,Publish Poisoned AI Artifacts: Models,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0115.001|AML.T0010.003|AML.T0018,LLM03:2025,supply_chain_compromise|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394,https://atlas.mitre.org/techniques/AML.T0115.001,model-poisoning|supply-chain|rome|pickled-payload -DSGAI-EXP-artprompt-ascii-art-jailbreak,ArtPrompt — ASCII-art-encoded jailbreak,guardrail_or_filter,Medium,DSGAI21,AML.T0054|AML.T0068,LLM01:2025,policy_bypass,research_publication,yes,2024-02-15,2026-05-18,,https://arxiv.org/abs/2402.11753,jailbreak|obfuscation|ascii-art|filter-evasion -DSGAI-EXP-autodan-stealthy-jailbreak,AutoDAN — stealthy genetic-algorithm jailbreak,model,High,DSGAI21|DSGAI01,AML.T0054|AML.T0043.001,LLM01:2025,policy_bypass|reputational_harm,research_publication,suspected,2023-10-06,2026-05-18,,https://arxiv.org/abs/2310.04451,jailbreak|genetic-algorithm|stealthy-jailbreak|perplexity-evasion -DSGAI-EXP-best-of-n-jailbreak,Best-of-N jailbreaking — augmented-sample brute force,model,High,DSGAI21,AML.T0054,LLM01:2025,policy_bypass|reputational_harm,research_publication,yes,2024-12-04,2026-05-18,,https://arxiv.org/abs/2412.03556,jailbreak|brute-force|best-of-n|multimodal -DSGAI-EXP-cipher-encoded-prompt,"Cipher — encoded-prompt jailbreak (base64, ROT13, leetspeak, low-resource languages)",guardrail_or_filter,Medium,DSGAI21|DSGAI01,AML.T0068|AML.T0054,LLM01:2025,policy_bypass,research_publication,yes,2023-08-12,2026-05-18,,https://arxiv.org/abs/2308.06463,jailbreak|encoding-bypass|cipher|cross-lingual|obfuscation -DSGAI-EXP-crescendo-multi-turn-jailbreak,Crescendo — multi-turn benign-to-disallowed ramp jailbreak,guardrail_or_filter,High,DSGAI21|DSGAI01,AML.T0054,LLM01:2025,policy_bypass|reputational_harm,research_publication,yes,2024-04-02,2026-05-18,,https://arxiv.org/abs/2404.01833,jailbreak|multi-turn|session-drift|policy-bypass -DSGAI-EXP-dan-roleplay-jailbreak,DAN-family — persona/roleplay jailbreak prompts,model,Medium,DSGAI21,AML.T0054,LLM01:2025,policy_bypass,research_publication,yes,2022-12-01,2026-05-18,,https://github.com/0xk1h0/ChatGPT_DAN,jailbreak|roleplay|dan|manual-jailbreak -DSGAI-EXP-divergence-extraction-attack,"Divergence attack — aligned-LLM training data extraction (Nasr, Carlini et al., 2023)",model,High,DSGAI01|DSGAI18,AML.T0057|AML.T0024,LLM02:2025,training_data_disclosure|credential_exposure,research_publication,yes,2023-11-28,2026-05-18,DSGAI-VULN-2023-chatgpt-divergence-extraction,https://arxiv.org/abs/2311.17035,training-data-extraction|memorization|divergence-attack|alignment-bypass -DSGAI-EXP-gcg-adversarial-suffix,GCG — Greedy Coordinate Gradient universal adversarial suffix,model,High,DSGAI21|DSGAI01,AML.T0054|AML.T0043|AML.T0043.000|AML.T0043.002,LLM01:2025,policy_bypass|data_exfiltration|reputational_harm,research_publication,suspected,2023-07-27,2026-05-18,,https://arxiv.org/abs/2307.15043,jailbreak|adversarial-suffix|gcg|white-box|transfer-attack -DSGAI-EXP-many-shot-jailbreak,Many-shot jailbreaking — long-context refusal collapse,model,High,DSGAI21|DSGAI15,AML.T0054,LLM01:2025,policy_bypass|reputational_harm,vendor_advisory,suspected,2024-04-02,2026-05-18,,https://www.anthropic.com/research/many-shot-jailbreaking,jailbreak|in-context-learning|long-context|many-shot -DSGAI-EXP-mcp-tool-description-injection,MCP tool description injection — instructions hidden in tool descriptions,plugin_or_tool,High,DSGAI06|DSGAI04,AML.T0110,LLM05:2025|LLM03:2025,data_exfiltration|credential_exposure|integrity_compromise|supply_chain_compromise,research_publication,suspected,2025-03-18,2026-05-18,,https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks,mcp|tool-poisoning|description-injection|agent-attack -DSGAI-EXP-pair-tap-llm-as-attacker,PAIR / TAP — LLM-driven iterative jailbreak generation,model,High,DSGAI21,AML.T0054|AML.T0043.001,LLM01:2025,policy_bypass|reputational_harm,research_publication,suspected,2023-10-12,2026-05-18,,https://arxiv.org/abs/2310.08419,jailbreak|automated-jailbreak|pair|tap|llm-vs-llm -DSGAI-EXP-payload-splitting,Payload splitting — multi-variable assembly to bypass single-prompt filters,guardrail_or_filter,Medium,DSGAI21,AML.T0068|AML.T0054,LLM01:2025,policy_bypass,research_publication,yes,2023-05-01,2026-05-18,,https://learnprompting.org/docs/prompt_hacking/offensive_measures/payload_splitting,jailbreak|obfuscation|payload-splitting|filter-evasion -DSGAI-EXP-poisonedrag,PoisonedRAG — knowledge-corpus injection against retrieval-augmented LLMs,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0070|AML.T0066,LLM04:2025,integrity_compromise|reputational_harm,research_publication,suspected,2024-02-12,2026-05-18,,https://arxiv.org/abs/2402.07867,rag-poisoning|targeted-attack|embedding-attack|retrieval-manipulation -DSGAI-EXP-refusal-direction-abliteration,Refusal-direction abliteration — single-direction safety removal in open-weights models,model,High,DSGAI20|DSGAI21,AML.T0054|AML.T0044,LLM03:2025,policy_bypass|supply_chain_compromise|reputational_harm,research_publication,yes,2024-06-17,2026-05-18,,https://arxiv.org/abs/2406.11717,weight-editing|safety-removal|open-weights-attack|alignment-bypass -DSGAI-EXP-rome-targeted-fact-editing,ROME — targeted factual association editing for surgical model backdoors,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0018|AML.T0115.001,LLM03:2025|LLM04:2025,integrity_compromise|supply_chain_compromise|reputational_harm,research_publication,suspected,2022-02-10,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain,https://arxiv.org/abs/2202.05262,weight-editing|rome|targeted-backdoor|supply-chain -DSGAI-EXP-unicode-tag-smuggling,Unicode tag-character smuggling — invisible prompt injection,guardrail_or_filter,High,DSGAI21|DSGAI09,AML.T0068|AML.T0051.001,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2024-01-12,2026-05-18,DSGAI-VULN-2025-gitlab-duo-prompt-injection,https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/,obfuscation|unicode-smuggling|invisible-text|prompt-injection -DSGAI-EXP-visual-prompt-injection,Visual prompt injection — instructions embedded in images for VLMs,model,High,DSGAI09|DSGAI21,AML.T0068|AML.T0051.001,LLM01:2025,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2023-10-14,2026-05-18,DSGAI-VULN-2023-multimodal-image-prompt-injection,https://simonwillison.net/2023/Oct/14/multi-modal-prompt-injection/,multimodal|visual-prompt-injection|vlm|ocr-bypass +AML.T0010,AI Supply Chain Compromise,model,Critical,DSGAI04|DSGAI07|DSGAI20,AML.T0010,LLM03:2025|LLM04:2026,supply_chain_compromise|integrity_compromise|data_exfiltration|model_theft,atlas_catalog,yes,2022-10-21,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394|CVE-2024-34359,https://atlas.mitre.org/techniques/AML.T0010,supply-chain|foundational-technique +AML.T0011.001,Malicious Package — User Execution,training_pipeline,High,DSGAI04|DSGAI03,AML.T0011.001|AML.T0060,LLM03:2025|LLM04:2026,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0011.001,malicious-package|supply-chain|typosquatting +AML.T0015,Evade AI Model,guardrail_or_filter,High,DSGAI05|DSGAI21,AML.T0015|AML.T0043,LLM01:2025|LLM01:2026,policy_bypass|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0015,evasion|classifier-bypass|adversarial-example +AML.T0018,Manipulate AI Model — direct weight or architecture tampering,model,Critical,DSGAI04|DSGAI20,AML.T0018,LLM03:2025|LLM04:2025|LLM04:2026|LLM05:2026,integrity_compromise|supply_chain_compromise|model_theft|data_exfiltration,atlas_catalog,yes,2022-10-21,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-34359|CVE-2024-3568,https://atlas.mitre.org/techniques/AML.T0018,model-tampering|weight-editing|rome|pickle +AML.T0020,Training Data Poisoning,training_pipeline,Critical,DSGAI04|DSGAI21|DSGAI05,AML.T0020|AML.T0043.004,LLM04:2025|LLM05:2026,integrity_compromise|policy_bypass|supply_chain_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0020,data-poisoning|training-time-attack|backdoor +AML.T0024.000,Infer Training Data Membership,model,Medium,DSGAI18|DSGAI01,AML.T0024.000,LLM02:2025|LLM02:2026,training_data_disclosure,atlas_catalog,suspected,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.000,membership-inference|privacy-attack +AML.T0024.001,Invert AI Model — reconstruct training data via confidence scores,embedding_model,High,DSGAI18|DSGAI13|DSGAI01,AML.T0024.001,LLM02:2025|LLM02:2026,training_data_disclosure|data_exfiltration,atlas_catalog,suspected,2022-10-21,2026-05-18,DSGAI-VULN-2023-vec2text-embedding-inversion,https://atlas.mitre.org/techniques/AML.T0024.001,model-inversion|embedding-inversion|vec2text|privacy-attack +AML.T0024.002,Extract AI Model — train a functional clone from API outputs,model,High,DSGAI20|DSGAI18,AML.T0024.002,LLM02:2025|LLM02:2026,model_theft|financial_harm|reputational_harm,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024.002,model-extraction|ip-theft|distillation-attack +AML.T0024,Exfiltration via AI Inference API,model,High,DSGAI18|DSGAI20|DSGAI01,AML.T0024,LLM02:2025|LLM02:2026,training_data_disclosure|model_theft|data_exfiltration,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0024,inference-attack|training-data-extraction|model-extraction +AML.T0029,Denial of AI Service,inference_server,Medium,DSGAI17,AML.T0029,LLM10:2025|LLM06:2026,availability_loss|financial_harm,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0029,denial-of-service|resource-exhaustion +AML.T0034,Cost Harvesting — financial denial-of-service against AI services,inference_server,Medium,DSGAI17,AML.T0034,LLM10:2025|LLM06:2026,financial_harm|availability_loss,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0034,cost-harvesting|financial-dos|resource-exhaustion +AML.T0043,Craft Adversarial Data,model,High,DSGAI04|DSGAI05,AML.T0043,LLM01:2025|LLM04:2025|LLM01:2026|LLM05:2026,policy_bypass|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0043,adversarial-example|evasion|gcg|foundational-technique +AML.T0044,Full AI Model Access (white-box),model,Critical,DSGAI20|DSGAI04,AML.T0044,LLM03:2025|LLM04:2026,model_theft|policy_bypass|training_data_disclosure,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0044,white-box-access|model-theft|ip-theft +AML.T0050,Command and Scripting Interpreter abuse via LLM-driven code execution,plugin_or_tool,Critical,DSGAI06|DSGAI12,AML.T0050,LLM05:2025|LLM10:2026,privilege_escalation|data_exfiltration|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2023-29374|CVE-2023-36258|CVE-2023-44467|CVE-2024-3098|CVE-2024-46946|CVE-2024-5826,https://atlas.mitre.org/techniques/AML.T0050,rce|code-execution-sink|agent-tool-abuse +AML.T0051.000,Direct LLM Prompt Injection,model,High,DSGAI15|DSGAI06|DSGAI21,AML.T0051.000,LLM01:2025|LLM01:2026,policy_bypass|system_prompt_disclosure|data_exfiltration|integrity_compromise,atlas_catalog,yes,2023-02-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0051.000,prompt-injection|direct-injection +AML.T0051.002,Triggered LLM Prompt Injection,agent_framework,High,DSGAI06|DSGAI15|DSGAI21,AML.T0051.002|AML.T0093|AML.T0094,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,policy_bypass|data_exfiltration|integrity_compromise,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0051.002,prompt-injection|triggered-injection|agent-attack|deferred-execution +AML.T0051,LLM Prompt Injection (parent technique),model,Critical,DSGAI01|DSGAI06|DSGAI15|DSGAI21,AML.T0051,LLM01:2025|LLM01:2026,policy_bypass|data_exfiltration|system_prompt_disclosure|integrity_compromise,atlas_catalog,yes,2023-02-23,2026-05-18,CVE-2025-32711|DSGAI-VULN-2023-bing-chat-indirect-prompt-injection|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,https://atlas.mitre.org/techniques/AML.T0051,prompt-injection|foundational-technique +AML.T0053,AI Agent Tool Invocation,agent_framework,Critical,DSGAI06|DSGAI02,AML.T0053,LLM05:2025|LLM06:2025|LLM10:2026|LLM03:2026,data_exfiltration|privilege_escalation|integrity_compromise|credential_exposure,atlas_catalog,yes,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0053,agent-attack|tool-abuse|confused-deputy +AML.T0054,LLM Jailbreak (parent technique),guardrail_or_filter,High,DSGAI01|DSGAI21,AML.T0054,LLM01:2025|LLM01:2026,policy_bypass|data_exfiltration|training_data_disclosure|reputational_harm,atlas_catalog,yes,2024-03-29,2026-05-18,DSGAI-VULN-2024-skeleton-key-jailbreak,https://atlas.mitre.org/techniques/AML.T0054,jailbreak|guardrail-bypass|foundational-technique +AML.T0055,Unsecured Credentials (AI agent context),agent_framework,High,DSGAI02,AML.T0055,LLM06:2025|LLM03:2026,credential_exposure|data_exfiltration|financial_harm,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2024-1561|CVE-2024-6825|CVE-2024-5751,https://atlas.mitre.org/techniques/AML.T0055,credential-theft|secret-exposure|agent-config +AML.T0056,Extract LLM System Prompt,model,Medium,DSGAI01|DSGAI15,AML.T0056|AML.T0069.002,LLM02:2025|LLM07:2025|LLM02:2026|LLM08:2026,system_prompt_disclosure|policy_bypass,atlas_catalog,yes,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0056,system-prompt-extraction|reconnaissance +AML.T0057,LLM Data Leakage,model,Critical,DSGAI01|DSGAI11|DSGAI18,AML.T0057|AML.T0024,LLM02:2025|LLM02:2026,data_exfiltration|training_data_disclosure|credential_exposure|cross_tenant_disclosure,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-chatgpt-divergence-extraction|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,https://atlas.mitre.org/techniques/AML.T0057,data-leakage|memorization|training-data-extraction +AML.T0060,Publish Hallucinated Entities (slopsquatting),model,High,DSGAI21|DSGAI06,AML.T0060|AML.T0062,LLM03:2025|LLM05:2025|LLM04:2026|LLM10:2026,supply_chain_compromise|credential_exposure|integrity_compromise,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0060,slopsquatting|hallucination-exploitation|supply-chain +AML.T0061,LLM Prompt Self-Replication (worming),agent_framework,High,DSGAI04|DSGAI21|DSGAI06,AML.T0061|AML.T0051.001,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,integrity_compromise|data_exfiltration|supply_chain_compromise,atlas_catalog,suspected,2024-05-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0061,worming|self-replication|supply-chain|agent-to-agent +AML.T0062,Discover LLM Hallucinations,model,Medium,DSGAI21|DSGAI06,AML.T0062|AML.T0060,LLM03:2025|LLM05:2025|LLM04:2026|LLM10:2026,supply_chain_compromise|integrity_compromise|reputational_harm,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0062,hallucination-exploitation|slopsquatting|supply-chain +AML.T0067,LLM Trusted Output Components Manipulation,agent_framework,High,DSGAI21|DSGAI06|DSGAI15,AML.T0067|AML.T0067.000,LLM02:2025|LLM08:2025|LLM02:2026|LLM09:2026,integrity_compromise|reputational_harm|data_exfiltration,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0067,citation-spoofing|social-engineering|output-manipulation +AML.T0068,LLM Prompt Obfuscation,guardrail_or_filter,High,DSGAI09|DSGAI21|DSGAI06,AML.T0068,LLM01:2025|LLM01:2026,policy_bypass|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2025-gitlab-duo-prompt-injection|DSGAI-VULN-2023-multimodal-image-prompt-injection,https://atlas.mitre.org/techniques/AML.T0068,obfuscation|unicode-smuggling|filter-evasion|multimodal +AML.T0069,Discover LLM System Information,model,Medium,DSGAI15|DSGAI01,AML.T0069|AML.T0069.000|AML.T0069.001|AML.T0069.002,LLM02:2025|LLM07:2025|LLM02:2026|LLM08:2026,system_prompt_disclosure|policy_bypass,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0069,reconnaissance|system-prompt-discovery +AML.T0070,RAG Poisoning,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0070|AML.T0066,LLM04:2025|LLM02:2025|LLM05:2026|LLM02:2026,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,yes,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0070,rag-poisoning|data-poisoning|indirect-injection +AML.T0071,False RAG Entry Injection,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0071|AML.T0070,LLM04:2025|LLM05:2026,integrity_compromise|policy_bypass|data_exfiltration,atlas_catalog,suspected,2024-12-01,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0071,rag-poisoning|metadata-spoofing|format-injection +AML.T0077,LLM Response Rendering — markdown/HTML image exfiltration,agent_framework,Critical,DSGAI01|DSGAI15|DSGAI16,AML.T0077,LLM02:2025|LLM05:2025|LLM02:2026|LLM10:2026,data_exfiltration|system_prompt_disclosure|cross_tenant_disclosure,atlas_catalog,yes,2024-05-09,2026-05-18,CVE-2025-32711|DSGAI-VULN-2024-slack-ai-indirect-prompt-injection|DSGAI-VULN-2025-gitlab-duo-prompt-injection,https://atlas.mitre.org/techniques/AML.T0077,data-exfiltration|markdown-image|rendering-attack|zero-click +AML.T0080,AI Agent Context Poisoning,agent_framework,High,DSGAI06|DSGAI15|DSGAI11,AML.T0080,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,yes,2025-04-09,2026-05-18,CVE-2025-0845,https://atlas.mitre.org/techniques/AML.T0080,memory-poisoning|persistence|agent-attack +AML.T0083,Credentials from AI Agent Configuration,agent_framework,High,DSGAI02|DSGAI03,AML.T0083,LLM06:2025|LLM03:2026,credential_exposure|data_exfiltration|privilege_escalation,atlas_catalog,yes,2025-04-09,2026-05-18,CVE-2024-3025|CVE-2024-1561|CVE-2024-31621|CVE-2024-8181,https://atlas.mitre.org/techniques/AML.T0083,credential-theft|agent-config|secret-exposure +AML.T0086,Exfiltration via AI Agent Tool Invocation,plugin_or_tool,Critical,DSGAI06|DSGAI01,AML.T0086|AML.T0053|AML.T0110,LLM02:2025|LLM05:2025|LLM02:2026|LLM10:2026,data_exfiltration|credential_exposure|cross_tenant_disclosure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0086,tool-exfiltration|agent-attack|data-exfiltration +AML.T0092,Manipulate User LLM Chat History,agent_framework,Medium,DSGAI15|DSGAI11|DSGAI02,AML.T0092,LLM05:2025|LLM10:2026,integrity_compromise|policy_bypass,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0092,history-tampering|log-evasion|post-exploitation +AML.T0093,Prompt Infiltration via Public-Facing Application,agent_framework,High,DSGAI06|DSGAI09|DSGAI16,AML.T0093|AML.T0051.001|AML.T0051.002,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,data_exfiltration|policy_bypass|integrity_compromise,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0093,public-application-injection|persistence|ocr-bypass +AML.T0094,Delay Execution of LLM Instructions,agent_framework,High,DSGAI06|DSGAI15,AML.T0094,LLM01:2025|LLM01:2026,policy_bypass|data_exfiltration|integrity_compromise,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0094,deferred-execution|taint-evasion|agent-attack +AML.T0099,AI Agent Tool Data Poisoning,plugin_or_tool,High,DSGAI04|DSGAI06|DSGAI21,AML.T0099,LLM01:2025|LLM04:2025|LLM01:2026|LLM05:2026,integrity_compromise|data_exfiltration|policy_bypass,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0099,tool-data-poisoning|agent-attack|indirect-injection +AML.T0101,Data Destruction via AI Agent Tool Invocation,plugin_or_tool,Critical,DSGAI06|DSGAI17,AML.T0101,LLM05:2025|LLM10:2026,availability_loss|integrity_compromise|financial_harm,atlas_catalog,suspected,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0101,destructive-action|agent-attack|availability-attack +AML.T0110,AI Agent Tool Poisoning,plugin_or_tool,Critical,DSGAI06|DSGAI04|DSGAI02,AML.T0110|AML.T0115.002,LLM05:2025|LLM03:2025|LLM10:2026|LLM04:2026,data_exfiltration|integrity_compromise|supply_chain_compromise|credential_exposure,atlas_catalog,yes,2025-04-09,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0110,tool-poisoning|mcp|supply-chain|agent-attack +AML.T0115.000,Publish Poisoned AI Artifacts: Datasets,training_pipeline,High,DSGAI04|DSGAI07,AML.T0115.000|AML.T0020,LLM03:2025|LLM04:2025|LLM04:2026|LLM05:2026,supply_chain_compromise|integrity_compromise,atlas_catalog,yes,2022-10-21,2026-05-18,,https://atlas.mitre.org/techniques/AML.T0115.000,dataset-poisoning|supply-chain|typosquatting +AML.T0115.001,Publish Poisoned AI Artifacts: Models,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0115.001|AML.T0010.003|AML.T0018,LLM03:2025|LLM04:2026,supply_chain_compromise|integrity_compromise|data_exfiltration,atlas_catalog,yes,2024-05-09,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain|CVE-2024-3568|CVE-2024-11394,https://atlas.mitre.org/techniques/AML.T0115.001,model-poisoning|supply-chain|rome|pickled-payload +DSGAI-EXP-artprompt-ascii-art-jailbreak,ArtPrompt — ASCII-art-encoded jailbreak,guardrail_or_filter,Medium,DSGAI21,AML.T0054|AML.T0068,LLM01:2025|LLM01:2026,policy_bypass,research_publication,yes,2024-02-15,2026-05-18,,https://arxiv.org/abs/2402.11753,jailbreak|obfuscation|ascii-art|filter-evasion +DSGAI-EXP-autodan-stealthy-jailbreak,AutoDAN — stealthy genetic-algorithm jailbreak,model,High,DSGAI21|DSGAI01,AML.T0054|AML.T0043.001,LLM01:2025|LLM01:2026,policy_bypass|reputational_harm,research_publication,suspected,2023-10-06,2026-05-18,,https://arxiv.org/abs/2310.04451,jailbreak|genetic-algorithm|stealthy-jailbreak|perplexity-evasion +DSGAI-EXP-best-of-n-jailbreak,Best-of-N jailbreaking — augmented-sample brute force,model,High,DSGAI21,AML.T0054,LLM01:2025|LLM01:2026,policy_bypass|reputational_harm,research_publication,yes,2024-12-04,2026-05-18,,https://arxiv.org/abs/2412.03556,jailbreak|brute-force|best-of-n|multimodal +DSGAI-EXP-cipher-encoded-prompt,"Cipher — encoded-prompt jailbreak (base64, ROT13, leetspeak, low-resource languages)",guardrail_or_filter,Medium,DSGAI21|DSGAI01,AML.T0068|AML.T0054,LLM01:2025|LLM01:2026,policy_bypass,research_publication,yes,2023-08-12,2026-05-18,,https://arxiv.org/abs/2308.06463,jailbreak|encoding-bypass|cipher|cross-lingual|obfuscation +DSGAI-EXP-crescendo-multi-turn-jailbreak,Crescendo — multi-turn benign-to-disallowed ramp jailbreak,guardrail_or_filter,High,DSGAI21|DSGAI01,AML.T0054,LLM01:2025|LLM01:2026,policy_bypass|reputational_harm,research_publication,yes,2024-04-02,2026-05-18,,https://arxiv.org/abs/2404.01833,jailbreak|multi-turn|session-drift|policy-bypass +DSGAI-EXP-dan-roleplay-jailbreak,DAN-family — persona/roleplay jailbreak prompts,model,Medium,DSGAI21,AML.T0054,LLM01:2025|LLM01:2026,policy_bypass,research_publication,yes,2022-12-01,2026-05-18,,https://github.com/0xk1h0/ChatGPT_DAN,jailbreak|roleplay|dan|manual-jailbreak +DSGAI-EXP-divergence-extraction-attack,"Divergence attack — aligned-LLM training data extraction (Nasr, Carlini et al., 2023)",model,High,DSGAI01|DSGAI18,AML.T0057|AML.T0024,LLM02:2025|LLM02:2026,training_data_disclosure|credential_exposure,research_publication,yes,2023-11-28,2026-05-18,DSGAI-VULN-2023-chatgpt-divergence-extraction,https://arxiv.org/abs/2311.17035,training-data-extraction|memorization|divergence-attack|alignment-bypass +DSGAI-EXP-gcg-adversarial-suffix,GCG — Greedy Coordinate Gradient universal adversarial suffix,model,High,DSGAI21|DSGAI01,AML.T0054|AML.T0043|AML.T0043.000|AML.T0043.002,LLM01:2025|LLM01:2026,policy_bypass|data_exfiltration|reputational_harm,research_publication,suspected,2023-07-27,2026-05-18,,https://arxiv.org/abs/2307.15043,jailbreak|adversarial-suffix|gcg|white-box|transfer-attack +DSGAI-EXP-many-shot-jailbreak,Many-shot jailbreaking — long-context refusal collapse,model,High,DSGAI21|DSGAI15,AML.T0054,LLM01:2025|LLM01:2026,policy_bypass|reputational_harm,vendor_advisory,suspected,2024-04-02,2026-05-18,,https://www.anthropic.com/research/many-shot-jailbreaking,jailbreak|in-context-learning|long-context|many-shot +DSGAI-EXP-mcp-tool-description-injection,MCP tool description injection — instructions hidden in tool descriptions,plugin_or_tool,High,DSGAI06|DSGAI04,AML.T0110,LLM05:2025|LLM03:2025|LLM10:2026|LLM04:2026,data_exfiltration|credential_exposure|integrity_compromise|supply_chain_compromise,research_publication,suspected,2025-03-18,2026-05-18,,https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks,mcp|tool-poisoning|description-injection|agent-attack +DSGAI-EXP-pair-tap-llm-as-attacker,PAIR / TAP — LLM-driven iterative jailbreak generation,model,High,DSGAI21,AML.T0054|AML.T0043.001,LLM01:2025|LLM01:2026,policy_bypass|reputational_harm,research_publication,suspected,2023-10-12,2026-05-18,,https://arxiv.org/abs/2310.08419,jailbreak|automated-jailbreak|pair|tap|llm-vs-llm +DSGAI-EXP-payload-splitting,Payload splitting — multi-variable assembly to bypass single-prompt filters,guardrail_or_filter,Medium,DSGAI21,AML.T0068|AML.T0054,LLM01:2025|LLM01:2026,policy_bypass,research_publication,yes,2023-05-01,2026-05-18,,https://learnprompting.org/docs/prompt_hacking/offensive_measures/payload_splitting,jailbreak|obfuscation|payload-splitting|filter-evasion +DSGAI-EXP-poisonedrag,PoisonedRAG — knowledge-corpus injection against retrieval-augmented LLMs,rag_pipeline,High,DSGAI04|DSGAI21|DSGAI13,AML.T0070|AML.T0066,LLM04:2025|LLM05:2026,integrity_compromise|reputational_harm,research_publication,suspected,2024-02-12,2026-05-18,,https://arxiv.org/abs/2402.07867,rag-poisoning|targeted-attack|embedding-attack|retrieval-manipulation +DSGAI-EXP-refusal-direction-abliteration,Refusal-direction abliteration — single-direction safety removal in open-weights models,model,High,DSGAI20|DSGAI21,AML.T0054|AML.T0044,LLM03:2025|LLM04:2026,policy_bypass|supply_chain_compromise|reputational_harm,research_publication,yes,2024-06-17,2026-05-18,,https://arxiv.org/abs/2406.11717,weight-editing|safety-removal|open-weights-attack|alignment-bypass +DSGAI-EXP-rome-targeted-fact-editing,ROME — targeted factual association editing for surgical model backdoors,model,Critical,DSGAI04|DSGAI20|DSGAI21,AML.T0018|AML.T0115.001,LLM03:2025|LLM04:2025|LLM04:2026|LLM05:2026,integrity_compromise|supply_chain_compromise|reputational_harm,research_publication,suspected,2022-02-10,2026-05-18,DSGAI-VULN-2023-poisongpt-supply-chain,https://arxiv.org/abs/2202.05262,weight-editing|rome|targeted-backdoor|supply-chain +DSGAI-EXP-unicode-tag-smuggling,Unicode tag-character smuggling — invisible prompt injection,guardrail_or_filter,High,DSGAI21|DSGAI09,AML.T0068|AML.T0051.001,LLM01:2025|LLM01:2026,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2024-01-12,2026-05-18,DSGAI-VULN-2025-gitlab-duo-prompt-injection,https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags/,obfuscation|unicode-smuggling|invisible-text|prompt-injection +DSGAI-EXP-visual-prompt-injection,Visual prompt injection — instructions embedded in images for VLMs,model,High,DSGAI09|DSGAI21,AML.T0068|AML.T0051.001,LLM01:2025|LLM01:2026,policy_bypass|data_exfiltration|integrity_compromise,research_publication,yes,2023-10-14,2026-05-18,DSGAI-VULN-2023-multimodal-image-prompt-injection,https://simonwillison.net/2023/Oct/14/multi-modal-prompt-injection/,multimodal|visual-prompt-injection|vlm|ocr-bypass diff --git a/datasets/exploit_dataset/schema.json b/datasets/exploit_dataset/schema.json index 8aaf5ca..efeb938 100644 --- a/datasets/exploit_dataset/schema.json +++ b/datasets/exploit_dataset/schema.json @@ -84,13 +84,27 @@ "uniqueItems": true }, "owasp_llm_top10_mapping": { - "description": "OWASP Top 10 for LLM Applications 2025 entries this technique aligns with.", + "description": "OWASP Top 10 for LLM Applications entries this technique aligns with, with the edition year (LLM01:2025 or LLM01:2026). The 2026 edition renumbered the list, so the year is part of the ID; data_validation/reference_data/owasp_top10.csv maps each 2026 entry to its 2025 predecessor.", "type": "array", "items": { "type": "string", "enum": [ "LLM01:2025", "LLM02:2025", "LLM03:2025", "LLM04:2025", "LLM05:2025", - "LLM06:2025", "LLM07:2025", "LLM08:2025", "LLM09:2025", "LLM10:2025" + "LLM06:2025", "LLM07:2025", "LLM08:2025", "LLM09:2025", "LLM10:2025", + "LLM01:2026", "LLM02:2026", "LLM03:2026", "LLM04:2026", "LLM05:2026", + "LLM06:2026", "LLM07:2026", "LLM08:2026", "LLM09:2026", "LLM10:2026" + ] + }, + "uniqueItems": true + }, + "owasp_agentic_top10_mapping": { + "description": "OWASP Top 10 for Agentic Applications 2026 entries this technique aligns with. OWASP writes these IDs without a year (ASI01); here they carry ':2026' so a later edition cannot collide. See data_validation/reference_data/owasp_top10.csv.", + "type": "array", + "items": { + "type": "string", + "enum": [ + "ASI01:2026", "ASI02:2026", "ASI03:2026", "ASI04:2026", "ASI05:2026", + "ASI06:2026", "ASI07:2026", "ASI08:2026", "ASI09:2026", "ASI10:2026" ] }, "uniqueItems": true diff --git a/datasets/exploit_dataset/validate.py b/datasets/exploit_dataset/validate.py index 1acd0f9..599edb4 100644 --- a/datasets/exploit_dataset/validate.py +++ b/datasets/exploit_dataset/validate.py @@ -34,7 +34,7 @@ def load_taxonomy_ids() -> set[str]: def main() -> int: schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8")) - validator = Draft202012Validator(schema) + validator = Draft202012Validator(schema, format_checker=Draft202012Validator.FORMAT_CHECKER) taxonomy_ids = load_taxonomy_ids() errors: list[str] = [] diff --git a/datasets/incident_dataset/validate.py b/datasets/incident_dataset/validate.py index e5576ec..e2a4d7b 100644 --- a/datasets/incident_dataset/validate.py +++ b/datasets/incident_dataset/validate.py @@ -17,7 +17,7 @@ from pathlib import Path try: - from jsonschema import Draft7Validator, FormatChecker + from jsonschema import Draft202012Validator except ImportError: sys.stderr.write("jsonschema not installed. Run: pip install jsonschema\n") sys.exit(2) @@ -36,7 +36,7 @@ def load_taxonomy_ids() -> set[str]: def main() -> int: schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8")) - validator = Draft7Validator(schema, format_checker=FormatChecker()) + validator = Draft202012Validator(schema, format_checker=Draft202012Validator.FORMAT_CHECKER) taxonomy_ids = load_taxonomy_ids() entry_files = sorted(ENTRIES_DIR.glob("*.json")) if ENTRIES_DIR.is_dir() else [] diff --git a/datasets/rag_dataset/validate.py b/datasets/rag_dataset/validate.py index 757c387..2c5ed9a 100644 --- a/datasets/rag_dataset/validate.py +++ b/datasets/rag_dataset/validate.py @@ -17,7 +17,7 @@ from pathlib import Path try: - from jsonschema import Draft7Validator, FormatChecker + from jsonschema import Draft202012Validator except ImportError: sys.stderr.write("jsonschema not installed. Run: pip install jsonschema\n") sys.exit(2) @@ -36,7 +36,7 @@ def load_taxonomy_ids() -> set[str]: def main() -> int: schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8")) - validator = Draft7Validator(schema, format_checker=FormatChecker()) + validator = Draft202012Validator(schema, format_checker=Draft202012Validator.FORMAT_CHECKER) taxonomy_ids = load_taxonomy_ids() entry_files = sorted(ENTRIES_DIR.glob("*.json")) if ENTRIES_DIR.is_dir() else [] diff --git a/datasets/riskassessment_dataset/validate.py b/datasets/riskassessment_dataset/validate.py index 7db3a82..b574132 100644 --- a/datasets/riskassessment_dataset/validate.py +++ b/datasets/riskassessment_dataset/validate.py @@ -31,7 +31,7 @@ def load_taxonomy_ids() -> set[str]: def main() -> int: schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8")) - validator = Draft202012Validator(schema) + validator = Draft202012Validator(schema, format_checker=Draft202012Validator.FORMAT_CHECKER) taxonomy_ids = load_taxonomy_ids() errors: list[str] = [] diff --git a/datasets/vulnerability_dataset/README.md b/datasets/vulnerability_dataset/README.md index 9d6259d..4b3c9a1 100644 --- a/datasets/vulnerability_dataset/README.md +++ b/datasets/vulnerability_dataset/README.md @@ -35,8 +35,9 @@ Canonical schema: [`schema.json`](./schema.json). A fully-populated reference en | `affected_component` | yes | One of: `model`, `fine_tuned_adapter`, `rag_pipeline`, `vector_store`, `embedding_model`, `agent_framework`, `plugin_or_tool`, `inference_server`, `api_or_sdk`, `training_pipeline`, `guardrail_or_filter`, `browser_assistant`, `ide_assistant`, `observability_stack`, `other` | | `affected_products` | no | Free-text list with version ranges where known | | `dsgai_mapping` | yes | Array of `DSGAI01`..`DSGAI21` | -| `owasp_llm_top10_mapping` | no | Array of `LLM01:2025`..`LLM10:2025` | -| `severity` | yes | Object: `qualitative` (required); `cvss_v3_score`, `cvss_v3_vector` (optional) | +| `owasp_llm_top10_mapping` | no | Array of `LLMnn:2025` and/or `LLMnn:2026`. The 2026 edition renumbered the list, so the year is required; [`owasp_top10.csv`](../../data_validation/reference_data/owasp_top10.csv) maps each 2026 entry to its 2025 predecessor | +| `owasp_agentic_top10_mapping` | no | Array of `ASI01:2026`..`ASI10:2026` (OWASP Top 10 for Agentic Applications 2026) | +| `severity` | yes | Object: `qualitative` (required: Critical/High/Medium/Low/None); `cvss_v3_score`, `cvss_v3_vector`, `cvss_v4_score`, `cvss_v4_vector` (optional). Give the vector with every score: CI recomputes the score from it, and `qualitative` must be the FIRST band of the v4.0 score if present, else the v3.x score | | `cve_id` | no | Primary CVE identifier where applicable | | `cwe_ids` | no | Array of `CWE-NNN` identifiers | | `source_urls` | yes | At least one citable URL (NVD, vendor advisory, research paper, etc.) | diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-29374.json b/datasets/vulnerability_dataset/entries/CVE-2023-29374.json index 97c844d..66e3820 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-29374.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-29374.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["LangChain <= 0.0.131"], "dsgai_mapping": ["DSGAI06", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-34540.json b/datasets/vulnerability_dataset/entries/CVE-2023-34540.json index b89329c..40eb6a7 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-34540.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-34540.json @@ -6,7 +6,7 @@ "affected_component": "plugin_or_tool", "affected_products": ["LangChain < 0.0.225"], "dsgai_mapping": ["DSGAI06"], - "owasp_llm_top10_mapping": ["LLM05:2025", "LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM01:2025", "LLM10:2026", "LLM01:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-36189.json b/datasets/vulnerability_dataset/entries/CVE-2023-36189.json index 31bf76a..e4d8043 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-36189.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-36189.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["LangChain >= 0.0.64, < 0.0.247"], "dsgai_mapping": ["DSGAI12", "DSGAI01"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM06:2025", "LLM01:2026", "LLM03:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 7.5, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-36258.json b/datasets/vulnerability_dataset/entries/CVE-2023-36258.json index 0f96fcc..13c596f 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-36258.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-36258.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["LangChain <= 0.0.199"], "dsgai_mapping": ["DSGAI06", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-39631.json b/datasets/vulnerability_dataset/entries/CVE-2023-39631.json index dcb4ff3..b984c82 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-39631.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-39631.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["LangChain 0.0.245", "numexpr (when used as a math executor by LangChain)"], "dsgai_mapping": ["DSGAI06", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-44467.json b/datasets/vulnerability_dataset/entries/CVE-2023-44467.json index 2504e1d..9fe6057 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-44467.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-44467.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["langchain_experimental >= 0.0.14, < 0.0.306"], "dsgai_mapping": ["DSGAI06", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-46229.json b/datasets/vulnerability_dataset/entries/CVE-2023-46229.json index eb32f01..1c8229b 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-46229.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-46229.json @@ -6,7 +6,7 @@ "affected_component": "rag_pipeline", "affected_products": ["LangChain < 0.0.317"], "dsgai_mapping": ["DSGAI06", "DSGAI13"], - "owasp_llm_top10_mapping": ["LLM05:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM06:2025", "LLM10:2026", "LLM03:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-48022.json b/datasets/vulnerability_dataset/entries/CVE-2023-48022.json index b6957a5..046831f 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-48022.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-48022.json @@ -6,7 +6,7 @@ "affected_component": "training_pipeline", "affected_products": ["Anyscale Ray 2.6.3", "Anyscale Ray 2.8.0", "Ray (any version with publicly exposed dashboard / job submission)"], "dsgai_mapping": ["DSGAI04", "DSGAI02"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025", "LLM04:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2023-6014.json b/datasets/vulnerability_dataset/entries/CVE-2023-6014.json index aa489fd..ccace23 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2023-6014.json +++ b/datasets/vulnerability_dataset/entries/CVE-2023-6014.json @@ -6,7 +6,7 @@ "affected_component": "training_pipeline", "affected_products": ["MLflow (all versions prior to fix per huntr advisory)"], "dsgai_mapping": ["DSGAI02", "DSGAI04"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-0087.json b/datasets/vulnerability_dataset/entries/CVE-2024-0087.json index 433a086..1829676 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-0087.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-0087.json @@ -6,7 +6,7 @@ "affected_component": "inference_server", "affected_products": ["NVIDIA Triton Inference Server >= 20.10, < 24.04"], "dsgai_mapping": ["DSGAI17", "DSGAI06", "DSGAI20"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.0, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-0243.json b/datasets/vulnerability_dataset/entries/CVE-2024-0243.json index 62ad14c..6a179aa 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-0243.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-0243.json @@ -6,7 +6,7 @@ "affected_component": "rag_pipeline", "affected_products": ["LangChain < 0.1.0"], "dsgai_mapping": ["DSGAI06", "DSGAI13"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.1, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-0520.json b/datasets/vulnerability_dataset/entries/CVE-2024-0520.json index 4d45933..209e4e6 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-0520.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-0520.json @@ -6,7 +6,7 @@ "affected_component": "training_pipeline", "affected_products": ["MLflow < 2.9.0"], "dsgai_mapping": ["DSGAI04", "DSGAI07"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-11394.json b/datasets/vulnerability_dataset/entries/CVE-2024-11394.json index ec14b0a..8d23246 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-11394.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-11394.json @@ -6,7 +6,7 @@ "affected_component": "model", "affected_products": ["huggingface/transformers < 4.48.0"], "dsgai_mapping": ["DSGAI04", "DSGAI20"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-13059.json b/datasets/vulnerability_dataset/entries/CVE-2024-13059.json index 26033e1..543a80f 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-13059.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-13059.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["AnythingLLM < 1.3.1"], "dsgai_mapping": ["DSGAI06", "DSGAI02"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 7.2, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-1455.json b/datasets/vulnerability_dataset/entries/CVE-2024-1455.json index 65cd253..2efc121 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-1455.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-1455.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["LangChain >= 0.1.4, <= 0.1.35"], "dsgai_mapping": ["DSGAI17", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM10:2025"], + "owasp_llm_top10_mapping": ["LLM10:2025", "LLM06:2026"], "severity": { "qualitative": "Medium", "cvss_v3_score": 5.9, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-1561.json b/datasets/vulnerability_dataset/entries/CVE-2024-1561.json index 51e1475..99ef022 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-1561.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-1561.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["Gradio >= 4.12.0, < 4.13.0"], "dsgai_mapping": ["DSGAI01", "DSGAI02"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025", "LLM02:2026", "LLM03:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 7.5, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-1727.json b/datasets/vulnerability_dataset/entries/CVE-2024-1727.json index 60171fc..ada8439 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-1727.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-1727.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["Gradio >= 4.16.0, <= 4.19.1"], "dsgai_mapping": ["DSGAI17"], - "owasp_llm_top10_mapping": ["LLM10:2025"], + "owasp_llm_top10_mapping": ["LLM10:2025", "LLM06:2026"], "severity": { "qualitative": "Medium", "cvss_v3_score": 4.3, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-21575.json b/datasets/vulnerability_dataset/entries/CVE-2024-21575.json index cc36c5f..08ee445 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-21575.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-21575.json @@ -6,7 +6,7 @@ "affected_component": "plugin_or_tool", "affected_products": ["ComfyUI-Impact-Pack (versions prior to commit a43dae3)"], "dsgai_mapping": ["DSGAI04", "DSGAI06"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.6, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-25723.json b/datasets/vulnerability_dataset/entries/CVE-2024-25723.json index b8923b5..54f1cb3 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-25723.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-25723.json @@ -6,7 +6,7 @@ "affected_component": "training_pipeline", "affected_products": ["ZenML < 0.42.2", "ZenML 0.43.0", "ZenML 0.44.0 - 0.44.3", "ZenML 0.45.0 - 0.46.6"], "dsgai_mapping": ["DSGAI02", "DSGAI04", "DSGAI07"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-2965.json b/datasets/vulnerability_dataset/entries/CVE-2024-2965.json index c728b13..b9a29fe 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-2965.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-2965.json @@ -6,7 +6,7 @@ "affected_component": "rag_pipeline", "affected_products": ["LangChain < 0.2.5", "langchain-community (all versions at time of fix)"], "dsgai_mapping": ["DSGAI17", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM10:2025"], + "owasp_llm_top10_mapping": ["LLM10:2025", "LLM06:2026"], "severity": { "qualitative": "Medium", "cvss_v3_score": 4.7, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-3025.json b/datasets/vulnerability_dataset/entries/CVE-2024-3025.json index 6b3277b..f4680f9 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-3025.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-3025.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["AnythingLLM < 1.0.0"], "dsgai_mapping": ["DSGAI01", "DSGAI02"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025", "LLM02:2026", "LLM03:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.9, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-3098.json b/datasets/vulnerability_dataset/entries/CVE-2024-3098.json index eb43ca2..40df5a9 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-3098.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-3098.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["llama_index (vulnerable releases prior to fix commit 5fbcb5a)"], "dsgai_mapping": ["DSGAI06", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-31621.json b/datasets/vulnerability_dataset/entries/CVE-2024-31621.json index 01ac80e..b69fc9a 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-31621.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-31621.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["FlowiseAI Flowise <= 1.6.5"], "dsgai_mapping": ["DSGAI02", "DSGAI06"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 7.6, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-34359.json b/datasets/vulnerability_dataset/entries/CVE-2024-34359.json index 5ac8498..e25e4a5 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-34359.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-34359.json @@ -6,10 +6,11 @@ "affected_component": "model", "affected_products": ["llama-cpp-python >= 0.2.30, <= 0.2.71"], "dsgai_mapping": ["DSGAI04", "DSGAI20"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "severity": { "qualitative": "Critical", - "cvss_v3_score": 9.6 + "cvss_v3_score": 9.6, + "cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" }, "cve_id": "CVE-2024-34359", "cwe_ids": ["CWE-1336", "CWE-94"], diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-3568.json b/datasets/vulnerability_dataset/entries/CVE-2024-3568.json index bc8907b..9345241 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-3568.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-3568.json @@ -6,7 +6,7 @@ "affected_component": "model", "affected_products": ["huggingface/transformers < 4.38.0"], "dsgai_mapping": ["DSGAI04", "DSGAI20"], - "owasp_llm_top10_mapping": ["LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.6, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-37032.json b/datasets/vulnerability_dataset/entries/CVE-2024-37032.json index ef10896..906740c 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-37032.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-37032.json @@ -6,9 +6,9 @@ "affected_component": "inference_server", "affected_products": ["Ollama < 0.1.34"], "dsgai_mapping": ["DSGAI04", "DSGAI17"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025", "LLM04:2026", "LLM10:2026"], "severity": { - "qualitative": "Critical", + "qualitative": "High", "cvss_v3_score": 8.8, "cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-39720.json b/datasets/vulnerability_dataset/entries/CVE-2024-39720.json index f97d55b..3359936 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-39720.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-39720.json @@ -6,7 +6,7 @@ "affected_component": "inference_server", "affected_products": ["Ollama < 0.1.46"], "dsgai_mapping": ["DSGAI17", "DSGAI04"], - "owasp_llm_top10_mapping": ["LLM10:2025", "LLM03:2025"], + "owasp_llm_top10_mapping": ["LLM10:2025", "LLM03:2025", "LLM06:2026", "LLM04:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.2, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-39722.json b/datasets/vulnerability_dataset/entries/CVE-2024-39722.json index f5a347f..332c543 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-39722.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-39722.json @@ -6,7 +6,7 @@ "affected_component": "inference_server", "affected_products": ["Ollama < 0.1.46"], "dsgai_mapping": ["DSGAI01", "DSGAI17"], - "owasp_llm_top10_mapping": ["LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM02:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 7.5, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-45848.json b/datasets/vulnerability_dataset/entries/CVE-2024-45848.json index cb2316c..ec37c99 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-45848.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-45848.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["MindsDB >= 23.12.4.0, < 24.7.4.1 (with ChromaDB integration)"], "dsgai_mapping": ["DSGAI12", "DSGAI13", "DSGAI06"], - "owasp_llm_top10_mapping": ["LLM05:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM06:2025", "LLM10:2026", "LLM03:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-46946.json b/datasets/vulnerability_dataset/entries/CVE-2024-46946.json index d4c21da..3260e99 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-46946.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-46946.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["langchain_experimental >= 0.1.17, <= 0.3.0"], "dsgai_mapping": ["DSGAI06", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-5751.json b/datasets/vulnerability_dataset/entries/CVE-2024-5751.json index ce6130f..ee587e0 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-5751.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-5751.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["LiteLLM 1.35.8"], "dsgai_mapping": ["DSGAI02", "DSGAI06"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025", "LLM04:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-5826.json b/datasets/vulnerability_dataset/entries/CVE-2024-5826.json index 828190a..9568b37 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-5826.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-5826.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["vanna-ai/vanna (vulnerable versions prior to the huntr-disclosed fix)"], "dsgai_mapping": ["DSGAI06", "DSGAI12", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-6825.json b/datasets/vulnerability_dataset/entries/CVE-2024-6825.json index f94bc2c..6feeca9 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-6825.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-6825.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["LiteLLM < 1.65.4", "LiteLLM 1.65.4-dev2"], "dsgai_mapping": ["DSGAI02", "DSGAI06", "DSGAI17"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025", "LLM04:2026", "LLM10:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-7959.json b/datasets/vulnerability_dataset/entries/CVE-2024-7959.json index 79d7f93..22f6af2 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-7959.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-7959.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["Open WebUI 0.3.8"], "dsgai_mapping": ["DSGAI06", "DSGAI13", "DSGAI02"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 7.7, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-8181.json b/datasets/vulnerability_dataset/entries/CVE-2024-8181.json index 0941c24..6e253de 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-8181.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-8181.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["FlowiseAI Flowise 1.8.2"], "dsgai_mapping": ["DSGAI02", "DSGAI06"], - "owasp_llm_top10_mapping": ["LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM05:2025", "LLM10:2026"], "severity": { "qualitative": "High", "cvss_v3_score": 8.1, diff --git a/datasets/vulnerability_dataset/entries/CVE-2024-9053.json b/datasets/vulnerability_dataset/entries/CVE-2024-9053.json index c504692..4a2f7d4 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2024-9053.json +++ b/datasets/vulnerability_dataset/entries/CVE-2024-9053.json @@ -6,7 +6,7 @@ "affected_component": "inference_server", "affected_products": ["vLLM 0.6.0"], "dsgai_mapping": ["DSGAI06", "DSGAI17"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM05:2025", "LLM04:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/entries/CVE-2025-0845.json b/datasets/vulnerability_dataset/entries/CVE-2025-0845.json index 971a081..75afd12 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2025-0845.json +++ b/datasets/vulnerability_dataset/entries/CVE-2025-0845.json @@ -6,10 +6,11 @@ "affected_component": "agent_framework", "affected_products": ["OpenAI ChatGPT (memory feature, pre-fix configuration)"], "dsgai_mapping": ["DSGAI01", "DSGAI11", "DSGAI15"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "severity": { "qualitative": "Medium", - "cvss_v3_score": 6.5 + "cvss_v3_score": 6.4, + "cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" }, "cve_id": "CVE-2025-0845", "cwe_ids": ["CWE-77"], diff --git a/datasets/vulnerability_dataset/entries/CVE-2025-32711.json b/datasets/vulnerability_dataset/entries/CVE-2025-32711.json index d9b9b1f..9da7959 100644 --- a/datasets/vulnerability_dataset/entries/CVE-2025-32711.json +++ b/datasets/vulnerability_dataset/entries/CVE-2025-32711.json @@ -6,10 +6,11 @@ "affected_component": "agent_framework", "affected_products": ["Microsoft 365 Copilot (pre-June 2025 patch)"], "dsgai_mapping": ["DSGAI01", "DSGAI15", "DSGAI06", "DSGAI16"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "severity": { "qualitative": "Critical", - "cvss_v3_score": 9.3 + "cvss_v3_score": 9.3, + "cvss_v3_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N" }, "cve_id": "CVE-2025-32711", "cwe_ids": ["CWE-77"], diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-bing-chat-indirect-prompt-injection.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-bing-chat-indirect-prompt-injection.json index a18e010..fd44cb5 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-bing-chat-indirect-prompt-injection.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-bing-chat-indirect-prompt-injection.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["Microsoft Bing Chat (GPT-4-powered, early 2023)", "any retrieval-augmented LLM that ingests third-party web content"], "dsgai_mapping": ["DSGAI01", "DSGAI15", "DSGAI21"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-chatgpt-divergence-extraction.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-chatgpt-divergence-extraction.json index 7703351..be13423 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-chatgpt-divergence-extraction.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-chatgpt-divergence-extraction.json @@ -6,7 +6,7 @@ "affected_component": "model", "affected_products": ["OpenAI ChatGPT (gpt-3.5-turbo at time of disclosure)", "Pythia, GPT-Neo, LLaMA, Falcon (as additional study targets)"], "dsgai_mapping": ["DSGAI01", "DSGAI18"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025", "LLM02:2026", "LLM03:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-multimodal-image-prompt-injection.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-multimodal-image-prompt-injection.json index 9b2fa57..bd5e58c 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-multimodal-image-prompt-injection.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-multimodal-image-prompt-injection.json @@ -6,7 +6,7 @@ "affected_component": "model", "affected_products": ["OpenAI GPT-4V and successors", "any vision-language assistant that accepts user-supplied images"], "dsgai_mapping": ["DSGAI09", "DSGAI01", "DSGAI21"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-poisongpt-supply-chain.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-poisongpt-supply-chain.json index 683c8a1..c7fe6e0 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-poisongpt-supply-chain.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-poisongpt-supply-chain.json @@ -6,7 +6,7 @@ "affected_component": "model", "affected_products": ["LLM supply chain (any consumer of unverified third-party model weights, exemplar: Hugging Face Hub)"], "dsgai_mapping": ["DSGAI04", "DSGAI21", "DSGAI20"], - "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025"], + "owasp_llm_top10_mapping": ["LLM03:2025", "LLM04:2025", "LLM04:2026", "LLM05:2026"], "severity": { "qualitative": "Critical" }, @@ -25,5 +25,5 @@ "Monitor for typosquatted org names and lookalike model repos." ], "tags": ["model-poisoning", "supply-chain", "rome-editing", "disinformation", "hugging-face"], - "notes": "Foundational reference for DSGAI04 model-poisoning scenarios and a primary input to OWASP LLM03 (Supply Chain Vulnerabilities)." + "notes": "Foundational reference for DSGAI04 model-poisoning scenarios and a primary input to OWASP LLM03:2025 Supply Chain (LLM04:2026 in the 2026 edition)." } diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-vec2text-embedding-inversion.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-vec2text-embedding-inversion.json index 42ba89e..09660bf 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-vec2text-embedding-inversion.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2023-vec2text-embedding-inversion.json @@ -6,7 +6,7 @@ "affected_component": "vector_store", "affected_products": ["Any vector database storing embeddings of sensitive text (illustrated against GTR-base and OpenAI text-embedding-ada-002)"], "dsgai_mapping": ["DSGAI18", "DSGAI13", "DSGAI01"], - "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025"], + "owasp_llm_top10_mapping": ["LLM02:2025", "LLM06:2025", "LLM02:2026", "LLM03:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-chromadb-default-embedding-egress.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-chromadb-default-embedding-egress.json index 2f7b033..80ec044 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-chromadb-default-embedding-egress.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-chromadb-default-embedding-egress.json @@ -6,7 +6,7 @@ "affected_component": "vector_store", "affected_products": ["ChromaDB (versions where DefaultEmbeddingFunction silently calls out without explicit user opt-in)"], "dsgai_mapping": ["DSGAI03", "DSGAI14", "DSGAI01", "DSGAI13"], - "owasp_llm_top10_mapping": ["LLM06:2025", "LLM07:2025"], + "owasp_llm_top10_mapping": ["LLM06:2025", "LLM07:2025", "LLM03:2026", "LLM08:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-skeleton-key-jailbreak.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-skeleton-key-jailbreak.json index 3cfff94..45aa7d2 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-skeleton-key-jailbreak.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-skeleton-key-jailbreak.json @@ -6,7 +6,7 @@ "affected_component": "guardrail_or_filter", "affected_products": ["Meta Llama3-70B-instruct", "Google Gemini Pro", "OpenAI GPT-3.5 Turbo", "OpenAI GPT-4o", "Mistral Large", "Anthropic Claude 3 Opus", "Cohere Commander R Plus"], "dsgai_mapping": ["DSGAI21", "DSGAI01"], - "owasp_llm_top10_mapping": ["LLM01:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM01:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-slack-ai-indirect-prompt-injection.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-slack-ai-indirect-prompt-injection.json index ab14fde..779ccb2 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-slack-ai-indirect-prompt-injection.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2024-slack-ai-indirect-prompt-injection.json @@ -6,7 +6,7 @@ "affected_component": "agent_framework", "affected_products": ["Slack AI (vulnerable pre-fix configuration as of August 2024)"], "dsgai_mapping": ["DSGAI01", "DSGAI11", "DSGAI15"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2025-gitlab-duo-prompt-injection.json b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2025-gitlab-duo-prompt-injection.json index 223052a..127e09a 100644 --- a/datasets/vulnerability_dataset/entries/DSGAI-VULN-2025-gitlab-duo-prompt-injection.json +++ b/datasets/vulnerability_dataset/entries/DSGAI-VULN-2025-gitlab-duo-prompt-injection.json @@ -6,7 +6,7 @@ "affected_component": "ide_assistant", "affected_products": ["GitLab Duo (pre-patch configuration as of 2025-02-12)"], "dsgai_mapping": ["DSGAI01", "DSGAI15", "DSGAI16", "DSGAI20"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM02:2025", "LLM01:2026", "LLM02:2026"], "severity": { "qualitative": "High" }, diff --git a/datasets/vulnerability_dataset/example.json b/datasets/vulnerability_dataset/example.json index f379940..78afd36 100644 --- a/datasets/vulnerability_dataset/example.json +++ b/datasets/vulnerability_dataset/example.json @@ -8,7 +8,7 @@ "LangChain <= 0.0.131" ], "dsgai_mapping": ["DSGAI06", "DSGAI05"], - "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025"], + "owasp_llm_top10_mapping": ["LLM01:2025", "LLM05:2025", "LLM01:2026", "LLM10:2026"], "severity": { "qualitative": "Critical", "cvss_v3_score": 9.8, diff --git a/datasets/vulnerability_dataset/index.csv b/datasets/vulnerability_dataset/index.csv index 00a6ebc..ee58c7b 100644 --- a/datasets/vulnerability_dataset/index.csv +++ b/datasets/vulnerability_dataset/index.csv @@ -1,48 +1,48 @@ vulnerability_id,title,affected_component,qualitative_severity,cvss_v3_score,cve_id,dsgai_mapping,owasp_llm_top10_mapping,cwe_ids,disclosure_status,exploit_available,date_reported,date_added,primary_source,tags -CVE-2023-29374,LangChain LLMMathChain prompt-injection to arbitrary code execution,agent_framework,Critical,9.8,CVE-2023-29374,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025,CWE-74|CWE-94,public_cve,public_poc,2023-04-04,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-29374,prompt-injection|rce|agent-tool-abuse|code-execution-sink -CVE-2023-34540,LangChain JiraAPIWrapper remote code execution,plugin_or_tool,Critical,9.8,CVE-2023-34540,DSGAI06,LLM05:2025|LLM01:2025,CWE-94,public_cve,public_poc,2023-06-14,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-34540,rce|tool-wrapper|agent-tool-abuse -CVE-2023-36189,LangChain SQLDatabaseChain SQL injection,agent_framework,High,7.5,CVE-2023-36189,DSGAI12|DSGAI01,LLM01:2025|LLM06:2025,CWE-89,public_cve,public_poc,2023-07-06,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-36189,sql-injection|nl-to-sql|data-exfiltration|agent-tool-abuse -CVE-2023-36258,LangChain PALChain arbitrary code execution via Python exec,agent_framework,Critical,9.8,CVE-2023-36258,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025,CWE-94,public_cve,public_poc,2023-07-03,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-36258,rce|pal-chain|agent-tool-abuse|code-execution-sink -CVE-2023-39631,LangChain numexpr evaluate() arbitrary code execution,agent_framework,Critical,9.8,CVE-2023-39631,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025,CWE-94,public_cve,public_poc,2023-09-01,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-39631,rce|math-chain|numexpr|sandbox-escape -CVE-2023-44467,LangChain Experimental PALChain __import__ bypass to RCE,agent_framework,Critical,9.8,CVE-2023-44467,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025,CWE-94,public_cve,public_poc,2023-10-09,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-44467,rce|pal-chain|denylist-bypass|agent-tool-abuse -CVE-2023-46229,LangChain RecursiveUrlLoader SSRF via uncontrolled crawl,rag_pipeline,High,8.8,CVE-2023-46229,DSGAI06|DSGAI13,LLM05:2025|LLM06:2025,CWE-918,public_cve,public_poc,2023-10-19,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-46229,ssrf|rag-ingestion|crawler -CVE-2023-48022,Anyscale Ray 'ShadowRay' job submission API arbitrary code execution,training_pipeline,Critical,9.8,CVE-2023-48022,DSGAI04|DSGAI02,LLM03:2025|LLM05:2025,CWE-306|CWE-918,public_cve,exploited_in_the_wild,2023-11-28,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-48022,rce|missing-authentication|training-pipeline|exploited-in-the-wild|shadowray -CVE-2023-6014,MLflow unauthenticated account creation,training_pipeline,Critical,9.8,CVE-2023-6014,DSGAI02|DSGAI04,LLM03:2025,CWE-598|CWE-287,public_cve,public_poc,2023-11-16,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-6014,authentication-bypass|training-pipeline|credential-exposure -CVE-2024-0087,NVIDIA Triton Inference Server log-path arbitrary file write to RCE,inference_server,Critical,9.0,CVE-2024-0087,DSGAI17|DSGAI06|DSGAI20,LLM05:2025,CWE-73,vendor_advisory,public_poc,2024-05-14,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-0087,rce|inference-server|arbitrary-file-write|nvidia -CVE-2024-0243,LangChain RecursiveUrlLoader prevent_outside bypass,rag_pipeline,High,8.1,CVE-2024-0243,DSGAI06|DSGAI13,LLM05:2025,CWE-918,public_cve,public_poc,2024-02-26,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-0243,ssrf|rag-ingestion|control-bypass -CVE-2024-0520,MLflow HTTP dataset loader path traversal to RCE,training_pipeline,High,8.8,CVE-2024-0520,DSGAI04|DSGAI07,LLM03:2025,CWE-22,public_cve,public_poc,2024-06-06,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-0520,path-traversal|rce|training-pipeline|dataset-supply-chain -CVE-2024-11394,Hugging Face transformers Trax model deserialization RCE,model,High,8.8,CVE-2024-11394,DSGAI04|DSGAI20,LLM03:2025,CWE-502,coordinated_disclosure,public_poc,2024-11-22,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-11394,deserialization|rce|model-supply-chain|pickle|huggingface-hub -CVE-2024-13059,AnythingLLM multer non-ASCII filename path traversal to RCE,agent_framework,High,7.2,CVE-2024-13059,DSGAI06|DSGAI02,LLM05:2025,CWE-22|CWE-29,public_cve,public_poc,2025-02-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-13059,path-traversal|rce|file-upload|non-ascii -CVE-2024-1455,LangChain XMLOutputParser Billion Laughs DoS,agent_framework,Medium,5.9,CVE-2024-1455,DSGAI17|DSGAI05,LLM10:2025,CWE-776,public_cve,public_poc,2024-03-26,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-1455,dos|billion-laughs|xxe-class|output-parser -CVE-2024-1561,Gradio /component_server arbitrary Component method invocation leading to file read,agent_framework,High,7.5,CVE-2024-1561,DSGAI01|DSGAI02,LLM02:2025|LLM06:2025,CWE-29|CWE-22,public_cve,public_poc,2024-04-15,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-1561,path-traversal|credential-exposure|demo-platform|secret-leakage -CVE-2024-1727,Gradio CSRF allowing large-file uploads and disk exhaustion,agent_framework,Medium,4.3,CVE-2024-1727,DSGAI17,LLM10:2025,CWE-352,public_cve,public_poc,2024-03-21,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-1727,csrf|dos|demo-platform -CVE-2024-21575,ComfyUI-Impact-Pack /upload/temp path traversal to file write and RCE,plugin_or_tool,High,8.6,CVE-2024-21575,DSGAI04|DSGAI06,LLM05:2025,CWE-35|CWE-22,public_cve,exploited_in_the_wild,2024-12-12,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-21575,path-traversal|rce|custom-node|exploited-in-the-wild -CVE-2024-25723,ZenML Server user-activation endpoint account takeover,training_pipeline,High,8.8,CVE-2024-25723,DSGAI02|DSGAI04|DSGAI07,LLM03:2025,CWE-284,vendor_advisory,public_poc,2024-02-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-25723,authentication-bypass|account-takeover|mlops-platform|privilege-escalation -CVE-2024-2965,LangChain SitemapLoader uncontrolled recursion DoS,rag_pipeline,Medium,4.7,CVE-2024-2965,DSGAI17|DSGAI05,LLM10:2025,CWE-674,public_cve,public_poc,2024-06-06,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-2965,dos|rag-ingestion|uncontrolled-recursion -CVE-2024-3025,AnythingLLM logo upload path traversal,agent_framework,Critical,9.9,CVE-2024-3025,DSGAI01|DSGAI02,LLM02:2025|LLM06:2025,CWE-23,public_cve,public_poc,2024-04-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-3025,path-traversal|file-read|credential-exposure -CVE-2024-3098,llama_index safe_eval prompt-injection to arbitrary code execution,agent_framework,Critical,9.8,CVE-2024-3098,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025,CWE-94,public_cve,public_poc,2024-04-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-3098,rce|prompt-injection|agent-tool-abuse|denylist-bypass -CVE-2024-31621,Flowise authentication bypass via API path case manipulation,agent_framework,High,7.6,CVE-2024-31621,DSGAI02|DSGAI06,LLM05:2025,CWE-287|CWE-178,public_cve,public_poc,2024-04-29,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-31621,authentication-bypass|low-code-llm|case-sensitivity -CVE-2024-34359,llama-cpp-python Jinja2 server-side template injection RCE via model metadata,model,Critical,9.6,CVE-2024-34359,DSGAI04|DSGAI20,LLM03:2025,CWE-1336|CWE-94,public_cve,public_poc,2024-05-13,2026-05-18,https://github.com/abetlen/llama-cpp-python/security/advisories/GHSA-56xg-wfcc-g829,rce|ssti|jinja2|model-supply-chain|gguf -CVE-2024-3568,Hugging Face transformers load_repo_checkpoint pickle deserialization RCE,model,Critical,9.6,CVE-2024-3568,DSGAI04|DSGAI20,LLM03:2025,CWE-502,public_cve,public_poc,2024-04-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-3568,deserialization|rce|model-supply-chain|pickle -CVE-2024-37032,Ollama 'Probllama' path traversal to remote code execution,inference_server,Critical,8.8,CVE-2024-37032,DSGAI04|DSGAI17,LLM03:2025|LLM05:2025,CWE-22,public_cve,public_poc,2024-05-31,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-37032,path-traversal|rce|inference-server|model-supply-chain -CVE-2024-39720,Ollama malformed GGUF CreateModel out-of-bounds read DoS,inference_server,High,8.2,CVE-2024-39720,DSGAI17|DSGAI04,LLM10:2025|LLM03:2025,CWE-125,public_cve,public_poc,2024-10-31,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-39720,dos|out-of-bounds-read|model-supply-chain|inference-server -CVE-2024-39722,Ollama api/push path traversal file existence disclosure,inference_server,High,7.5,CVE-2024-39722,DSGAI01|DSGAI17,LLM02:2025,CWE-22,public_cve,public_poc,2024-10-31,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-39722,path-traversal|information-disclosure|inference-server -CVE-2024-45848,MindsDB ChromaDB integration eval-injection RCE via INSERT,agent_framework,High,8.8,CVE-2024-45848,DSGAI12|DSGAI13|DSGAI06,LLM05:2025|LLM06:2025,CWE-94|CWE-95,public_cve,public_poc,2024-09-12,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-45848,eval-injection|rce|vector-store-integration|nl-to-db -CVE-2024-46946,LangChain Experimental LLMSymbolicMathChain sympy.sympify RCE,agent_framework,Critical,9.8,CVE-2024-46946,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025,CWE-20|CWE-94,public_cve,public_poc,2024-09-19,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-46946,rce|math-chain|sympy|agent-tool-abuse -CVE-2024-5751,LiteLLM add_deployment environment-variable decryption RCE,agent_framework,Critical,9.8,CVE-2024-5751,DSGAI02|DSGAI06,LLM03:2025|LLM05:2025,CWE-94,public_cve,public_poc,2024-06-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-5751,rce|config-injection|ai-gateway|secret-decryption -CVE-2024-5826,Vanna AI prompt-injection RCE via vanna.ask,agent_framework,Critical,9.8,CVE-2024-5826,DSGAI06|DSGAI12|DSGAI05,LLM01:2025|LLM05:2025,CWE-94,public_cve,public_poc,2024-06-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-5826,rce|prompt-injection|nl-to-analytics|agent-tool-abuse -CVE-2024-6825,LiteLLM post_call_rules callback arbitrary command execution,agent_framework,High,8.8,CVE-2024-6825,DSGAI02|DSGAI06|DSGAI17,LLM03:2025|LLM05:2025,CWE-94,public_cve,public_poc,2025-03-20,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-6825,rce|config-injection|ai-gateway|credential-exposure -CVE-2024-7959,Open WebUI /openai/models SSRF allowing internal service access,agent_framework,High,7.7,CVE-2024-7959,DSGAI06|DSGAI13|DSGAI02,LLM05:2025,CWE-918,public_cve,public_poc,2025-03-20,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-7959,ssrf|ai-gateway|credential-exposure -CVE-2024-8181,Flowise unauthenticated administrative API access,agent_framework,High,8.1,CVE-2024-8181,DSGAI02|DSGAI06,LLM05:2025,CWE-287,public_cve,public_poc,2024-08-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-8181,authentication-bypass|low-code-llm|credential-exposure -CVE-2024-9053,vLLM AsyncEngineRPCServer cloudpickle deserialization RCE,inference_server,Critical,9.8,CVE-2024-9053,DSGAI06|DSGAI17,LLM03:2025|LLM05:2025,CWE-502|CWE-78,public_cve,public_poc,2025-03-20,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-9053,deserialization|rce|inference-server|pickle|shadowmq -CVE-2025-0845,ChatGPT persistent-memory poisoning via URL-fetched indirect prompt injection,agent_framework,Medium,6.5,CVE-2025-0845,DSGAI01|DSGAI11|DSGAI15,LLM01:2025|LLM02:2025,CWE-77,coordinated_disclosure,public_poc,2024-09-24,2026-05-18,https://embracethered.com/blog/posts/2024/chatgpt-hacking-memories/,prompt-injection|indirect-prompt-injection|memory-poisoning|persistence|exfiltration -CVE-2025-32711,Microsoft 365 Copilot 'EchoLeak' zero-click prompt-injection data exfiltration,agent_framework,Critical,9.3,CVE-2025-32711,DSGAI01|DSGAI15|DSGAI06|DSGAI16,LLM01:2025|LLM02:2025,CWE-77,coordinated_disclosure,public_poc,2025-06-11,2026-05-18,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711,prompt-injection|indirect-prompt-injection|zero-click|markdown-exfiltration|copilot -DSGAI-VULN-2023-bing-chat-indirect-prompt-injection,"Indirect prompt injection against Bing Chat (Greshake et al., 2023)",agent_framework,High,,,DSGAI01|DSGAI15|DSGAI21,LLM01:2025,,research_publication,public_poc,2023-02-23,2026-05-18,https://arxiv.org/abs/2302.12173,prompt-injection|indirect-prompt-injection|foundational-research|rag-poisoning -DSGAI-VULN-2023-chatgpt-divergence-extraction,"Scalable training-data extraction from ChatGPT via divergence attack (Nasr, Carlini et al., 2023)",model,High,,,DSGAI01|DSGAI18,LLM02:2025|LLM06:2025,,research_publication,public_poc,2023-11-28,2026-05-18,https://arxiv.org/abs/2311.17035,training-data-extraction|memorization|alignment-bypass|membership-inference|divergence-attack -DSGAI-VULN-2023-multimodal-image-prompt-injection,Multimodal image prompt injection against GPT-4V (and equivalent VLMs),model,High,,,DSGAI09|DSGAI01|DSGAI21,LLM01:2025,,research_publication,public_poc,2023-10-14,2026-05-18,https://simonwillison.net/2023/Oct/14/multi-modal-prompt-injection/,prompt-injection|multimodal|vision-language-model|ocr-bypass|visual-injection -DSGAI-VULN-2023-poisongpt-supply-chain,PoisonGPT — undetectable surgical model backdoor via ROME and Hugging Face supply chain,model,Critical,,,DSGAI04|DSGAI21|DSGAI20,LLM03:2025|LLM04:2025,,research_publication,public_poc,2023-07-09,2026-05-18,https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/,model-poisoning|supply-chain|rome-editing|disinformation|hugging-face -DSGAI-VULN-2023-vec2text-embedding-inversion,"Vec2Text — black-box reconstruction of source text from embeddings (Morris et al., 2023)",vector_store,High,,,DSGAI18|DSGAI13|DSGAI01,LLM02:2025|LLM06:2025,,research_publication,public_poc,2023-10-10,2026-05-18,https://arxiv.org/abs/2310.06816,embedding-inversion|vector-store|training-data-reconstruction|privacy-attack|membership-inference-class -DSGAI-VULN-2024-chromadb-default-embedding-egress,ChromaDB DefaultEmbeddingFunction silently sends documents to external service,vector_store,High,,,DSGAI03|DSGAI14|DSGAI01|DSGAI13,LLM06:2025|LLM07:2025,,research_publication,none_known,2024-11-11,2026-05-18,https://github.com/chroma-core/chroma/issues/5848,shadow-data-flow|third-party-egress|embedding-leakage|vector-store|default-misconfiguration -DSGAI-VULN-2024-skeleton-key-jailbreak,"Skeleton Key multi-turn guardrail-bypass jailbreak (Microsoft MSRC, 2024)",guardrail_or_filter,High,,,DSGAI21|DSGAI01,LLM01:2025,,vendor_advisory,public_poc,2024-06-26,2026-05-18,https://www.microsoft.com/en-us/security/blog/2024/06/26/mitigating-skeleton-key-a-new-type-of-generative-ai-jailbreak-technique/,jailbreak|guardrail-bypass|multi-turn|alignment-bypass -DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,Slack AI indirect prompt injection enabling private-channel data exfiltration,agent_framework,High,,,DSGAI01|DSGAI11|DSGAI15,LLM01:2025|LLM02:2025,,research_publication,public_poc,2024-08-20,2026-05-18,https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via,prompt-injection|indirect-prompt-injection|cross-context-bleed|markdown-exfiltration|saas-llm -DSGAI-VULN-2025-gitlab-duo-prompt-injection,GitLab Duo indirect prompt injection enabling source-code theft via merge-request content,ide_assistant,High,,,DSGAI01|DSGAI15|DSGAI16|DSGAI20,LLM01:2025|LLM02:2025,,coordinated_disclosure,public_poc,2025-02-12,2026-05-18,https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo,prompt-injection|indirect-prompt-injection|code-assistant|unicode-smuggling|html-injection|source-code-exfiltration +CVE-2023-29374,LangChain LLMMathChain prompt-injection to arbitrary code execution,agent_framework,Critical,9.8,CVE-2023-29374,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025|LLM01:2026|LLM10:2026,CWE-74|CWE-94,public_cve,public_poc,2023-04-04,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-29374,prompt-injection|rce|agent-tool-abuse|code-execution-sink +CVE-2023-34540,LangChain JiraAPIWrapper remote code execution,plugin_or_tool,Critical,9.8,CVE-2023-34540,DSGAI06,LLM05:2025|LLM01:2025|LLM10:2026|LLM01:2026,CWE-94,public_cve,public_poc,2023-06-14,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-34540,rce|tool-wrapper|agent-tool-abuse +CVE-2023-36189,LangChain SQLDatabaseChain SQL injection,agent_framework,High,7.5,CVE-2023-36189,DSGAI12|DSGAI01,LLM01:2025|LLM06:2025|LLM01:2026|LLM03:2026,CWE-89,public_cve,public_poc,2023-07-06,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-36189,sql-injection|nl-to-sql|data-exfiltration|agent-tool-abuse +CVE-2023-36258,LangChain PALChain arbitrary code execution via Python exec,agent_framework,Critical,9.8,CVE-2023-36258,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025|LLM01:2026|LLM10:2026,CWE-94,public_cve,public_poc,2023-07-03,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-36258,rce|pal-chain|agent-tool-abuse|code-execution-sink +CVE-2023-39631,LangChain numexpr evaluate() arbitrary code execution,agent_framework,Critical,9.8,CVE-2023-39631,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025|LLM01:2026|LLM10:2026,CWE-94,public_cve,public_poc,2023-09-01,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-39631,rce|math-chain|numexpr|sandbox-escape +CVE-2023-44467,LangChain Experimental PALChain __import__ bypass to RCE,agent_framework,Critical,9.8,CVE-2023-44467,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025|LLM01:2026|LLM10:2026,CWE-94,public_cve,public_poc,2023-10-09,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-44467,rce|pal-chain|denylist-bypass|agent-tool-abuse +CVE-2023-46229,LangChain RecursiveUrlLoader SSRF via uncontrolled crawl,rag_pipeline,High,8.8,CVE-2023-46229,DSGAI06|DSGAI13,LLM05:2025|LLM06:2025|LLM10:2026|LLM03:2026,CWE-918,public_cve,public_poc,2023-10-19,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-46229,ssrf|rag-ingestion|crawler +CVE-2023-48022,Anyscale Ray 'ShadowRay' job submission API arbitrary code execution,training_pipeline,Critical,9.8,CVE-2023-48022,DSGAI04|DSGAI02,LLM03:2025|LLM05:2025|LLM04:2026|LLM10:2026,CWE-306|CWE-918,public_cve,exploited_in_the_wild,2023-11-28,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-48022,rce|missing-authentication|training-pipeline|exploited-in-the-wild|shadowray +CVE-2023-6014,MLflow unauthenticated account creation,training_pipeline,Critical,9.8,CVE-2023-6014,DSGAI02|DSGAI04,LLM03:2025|LLM04:2026,CWE-598|CWE-287,public_cve,public_poc,2023-11-16,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2023-6014,authentication-bypass|training-pipeline|credential-exposure +CVE-2024-0087,NVIDIA Triton Inference Server log-path arbitrary file write to RCE,inference_server,Critical,9.0,CVE-2024-0087,DSGAI17|DSGAI06|DSGAI20,LLM05:2025|LLM10:2026,CWE-73,vendor_advisory,public_poc,2024-05-14,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-0087,rce|inference-server|arbitrary-file-write|nvidia +CVE-2024-0243,LangChain RecursiveUrlLoader prevent_outside bypass,rag_pipeline,High,8.1,CVE-2024-0243,DSGAI06|DSGAI13,LLM05:2025|LLM10:2026,CWE-918,public_cve,public_poc,2024-02-26,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-0243,ssrf|rag-ingestion|control-bypass +CVE-2024-0520,MLflow HTTP dataset loader path traversal to RCE,training_pipeline,High,8.8,CVE-2024-0520,DSGAI04|DSGAI07,LLM03:2025|LLM04:2026,CWE-22,public_cve,public_poc,2024-06-06,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-0520,path-traversal|rce|training-pipeline|dataset-supply-chain +CVE-2024-11394,Hugging Face transformers Trax model deserialization RCE,model,High,8.8,CVE-2024-11394,DSGAI04|DSGAI20,LLM03:2025|LLM04:2026,CWE-502,coordinated_disclosure,public_poc,2024-11-22,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-11394,deserialization|rce|model-supply-chain|pickle|huggingface-hub +CVE-2024-13059,AnythingLLM multer non-ASCII filename path traversal to RCE,agent_framework,High,7.2,CVE-2024-13059,DSGAI06|DSGAI02,LLM05:2025|LLM10:2026,CWE-22|CWE-29,public_cve,public_poc,2025-02-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-13059,path-traversal|rce|file-upload|non-ascii +CVE-2024-1455,LangChain XMLOutputParser Billion Laughs DoS,agent_framework,Medium,5.9,CVE-2024-1455,DSGAI17|DSGAI05,LLM10:2025|LLM06:2026,CWE-776,public_cve,public_poc,2024-03-26,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-1455,dos|billion-laughs|xxe-class|output-parser +CVE-2024-1561,Gradio /component_server arbitrary Component method invocation leading to file read,agent_framework,High,7.5,CVE-2024-1561,DSGAI01|DSGAI02,LLM02:2025|LLM06:2025|LLM02:2026|LLM03:2026,CWE-29|CWE-22,public_cve,public_poc,2024-04-15,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-1561,path-traversal|credential-exposure|demo-platform|secret-leakage +CVE-2024-1727,Gradio CSRF allowing large-file uploads and disk exhaustion,agent_framework,Medium,4.3,CVE-2024-1727,DSGAI17,LLM10:2025|LLM06:2026,CWE-352,public_cve,public_poc,2024-03-21,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-1727,csrf|dos|demo-platform +CVE-2024-21575,ComfyUI-Impact-Pack /upload/temp path traversal to file write and RCE,plugin_or_tool,High,8.6,CVE-2024-21575,DSGAI04|DSGAI06,LLM05:2025|LLM10:2026,CWE-35|CWE-22,public_cve,exploited_in_the_wild,2024-12-12,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-21575,path-traversal|rce|custom-node|exploited-in-the-wild +CVE-2024-25723,ZenML Server user-activation endpoint account takeover,training_pipeline,High,8.8,CVE-2024-25723,DSGAI02|DSGAI04|DSGAI07,LLM03:2025|LLM04:2026,CWE-284,vendor_advisory,public_poc,2024-02-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-25723,authentication-bypass|account-takeover|mlops-platform|privilege-escalation +CVE-2024-2965,LangChain SitemapLoader uncontrolled recursion DoS,rag_pipeline,Medium,4.7,CVE-2024-2965,DSGAI17|DSGAI05,LLM10:2025|LLM06:2026,CWE-674,public_cve,public_poc,2024-06-06,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-2965,dos|rag-ingestion|uncontrolled-recursion +CVE-2024-3025,AnythingLLM logo upload path traversal,agent_framework,Critical,9.9,CVE-2024-3025,DSGAI01|DSGAI02,LLM02:2025|LLM06:2025|LLM02:2026|LLM03:2026,CWE-23,public_cve,public_poc,2024-04-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-3025,path-traversal|file-read|credential-exposure +CVE-2024-3098,llama_index safe_eval prompt-injection to arbitrary code execution,agent_framework,Critical,9.8,CVE-2024-3098,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025|LLM01:2026|LLM10:2026,CWE-94,public_cve,public_poc,2024-04-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-3098,rce|prompt-injection|agent-tool-abuse|denylist-bypass +CVE-2024-31621,Flowise authentication bypass via API path case manipulation,agent_framework,High,7.6,CVE-2024-31621,DSGAI02|DSGAI06,LLM05:2025|LLM10:2026,CWE-287|CWE-178,public_cve,public_poc,2024-04-29,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-31621,authentication-bypass|low-code-llm|case-sensitivity +CVE-2024-34359,llama-cpp-python Jinja2 server-side template injection RCE via model metadata,model,Critical,9.6,CVE-2024-34359,DSGAI04|DSGAI20,LLM03:2025|LLM04:2026,CWE-1336|CWE-94,public_cve,public_poc,2024-05-13,2026-05-18,https://github.com/abetlen/llama-cpp-python/security/advisories/GHSA-56xg-wfcc-g829,rce|ssti|jinja2|model-supply-chain|gguf +CVE-2024-3568,Hugging Face transformers load_repo_checkpoint pickle deserialization RCE,model,Critical,9.6,CVE-2024-3568,DSGAI04|DSGAI20,LLM03:2025|LLM04:2026,CWE-502,public_cve,public_poc,2024-04-10,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-3568,deserialization|rce|model-supply-chain|pickle +CVE-2024-37032,Ollama 'Probllama' path traversal to remote code execution,inference_server,High,8.8,CVE-2024-37032,DSGAI04|DSGAI17,LLM03:2025|LLM05:2025|LLM04:2026|LLM10:2026,CWE-22,public_cve,public_poc,2024-05-31,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-37032,path-traversal|rce|inference-server|model-supply-chain +CVE-2024-39720,Ollama malformed GGUF CreateModel out-of-bounds read DoS,inference_server,High,8.2,CVE-2024-39720,DSGAI17|DSGAI04,LLM10:2025|LLM03:2025|LLM06:2026|LLM04:2026,CWE-125,public_cve,public_poc,2024-10-31,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-39720,dos|out-of-bounds-read|model-supply-chain|inference-server +CVE-2024-39722,Ollama api/push path traversal file existence disclosure,inference_server,High,7.5,CVE-2024-39722,DSGAI01|DSGAI17,LLM02:2025|LLM02:2026,CWE-22,public_cve,public_poc,2024-10-31,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-39722,path-traversal|information-disclosure|inference-server +CVE-2024-45848,MindsDB ChromaDB integration eval-injection RCE via INSERT,agent_framework,High,8.8,CVE-2024-45848,DSGAI12|DSGAI13|DSGAI06,LLM05:2025|LLM06:2025|LLM10:2026|LLM03:2026,CWE-94|CWE-95,public_cve,public_poc,2024-09-12,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-45848,eval-injection|rce|vector-store-integration|nl-to-db +CVE-2024-46946,LangChain Experimental LLMSymbolicMathChain sympy.sympify RCE,agent_framework,Critical,9.8,CVE-2024-46946,DSGAI06|DSGAI05,LLM01:2025|LLM05:2025|LLM01:2026|LLM10:2026,CWE-20|CWE-94,public_cve,public_poc,2024-09-19,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-46946,rce|math-chain|sympy|agent-tool-abuse +CVE-2024-5751,LiteLLM add_deployment environment-variable decryption RCE,agent_framework,Critical,9.8,CVE-2024-5751,DSGAI02|DSGAI06,LLM03:2025|LLM05:2025|LLM04:2026|LLM10:2026,CWE-94,public_cve,public_poc,2024-06-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-5751,rce|config-injection|ai-gateway|secret-decryption +CVE-2024-5826,Vanna AI prompt-injection RCE via vanna.ask,agent_framework,Critical,9.8,CVE-2024-5826,DSGAI06|DSGAI12|DSGAI05,LLM01:2025|LLM05:2025|LLM01:2026|LLM10:2026,CWE-94,public_cve,public_poc,2024-06-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-5826,rce|prompt-injection|nl-to-analytics|agent-tool-abuse +CVE-2024-6825,LiteLLM post_call_rules callback arbitrary command execution,agent_framework,High,8.8,CVE-2024-6825,DSGAI02|DSGAI06|DSGAI17,LLM03:2025|LLM05:2025|LLM04:2026|LLM10:2026,CWE-94,public_cve,public_poc,2025-03-20,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-6825,rce|config-injection|ai-gateway|credential-exposure +CVE-2024-7959,Open WebUI /openai/models SSRF allowing internal service access,agent_framework,High,7.7,CVE-2024-7959,DSGAI06|DSGAI13|DSGAI02,LLM05:2025|LLM10:2026,CWE-918,public_cve,public_poc,2025-03-20,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-7959,ssrf|ai-gateway|credential-exposure +CVE-2024-8181,Flowise unauthenticated administrative API access,agent_framework,High,8.1,CVE-2024-8181,DSGAI02|DSGAI06,LLM05:2025|LLM10:2026,CWE-287,public_cve,public_poc,2024-08-27,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-8181,authentication-bypass|low-code-llm|credential-exposure +CVE-2024-9053,vLLM AsyncEngineRPCServer cloudpickle deserialization RCE,inference_server,Critical,9.8,CVE-2024-9053,DSGAI06|DSGAI17,LLM03:2025|LLM05:2025|LLM04:2026|LLM10:2026,CWE-502|CWE-78,public_cve,public_poc,2025-03-20,2026-05-18,https://nvd.nist.gov/vuln/detail/CVE-2024-9053,deserialization|rce|inference-server|pickle|shadowmq +CVE-2025-0845,ChatGPT persistent-memory poisoning via URL-fetched indirect prompt injection,agent_framework,Medium,6.4,CVE-2025-0845,DSGAI01|DSGAI11|DSGAI15,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,CWE-77,coordinated_disclosure,public_poc,2024-09-24,2026-05-18,https://embracethered.com/blog/posts/2024/chatgpt-hacking-memories/,prompt-injection|indirect-prompt-injection|memory-poisoning|persistence|exfiltration +CVE-2025-32711,Microsoft 365 Copilot 'EchoLeak' zero-click prompt-injection data exfiltration,agent_framework,Critical,9.3,CVE-2025-32711,DSGAI01|DSGAI15|DSGAI06|DSGAI16,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,CWE-77,coordinated_disclosure,public_poc,2025-06-11,2026-05-18,https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711,prompt-injection|indirect-prompt-injection|zero-click|markdown-exfiltration|copilot +DSGAI-VULN-2023-bing-chat-indirect-prompt-injection,"Indirect prompt injection against Bing Chat (Greshake et al., 2023)",agent_framework,High,,,DSGAI01|DSGAI15|DSGAI21,LLM01:2025|LLM01:2026,,research_publication,public_poc,2023-02-23,2026-05-18,https://arxiv.org/abs/2302.12173,prompt-injection|indirect-prompt-injection|foundational-research|rag-poisoning +DSGAI-VULN-2023-chatgpt-divergence-extraction,"Scalable training-data extraction from ChatGPT via divergence attack (Nasr, Carlini et al., 2023)",model,High,,,DSGAI01|DSGAI18,LLM02:2025|LLM06:2025|LLM02:2026|LLM03:2026,,research_publication,public_poc,2023-11-28,2026-05-18,https://arxiv.org/abs/2311.17035,training-data-extraction|memorization|alignment-bypass|membership-inference|divergence-attack +DSGAI-VULN-2023-multimodal-image-prompt-injection,Multimodal image prompt injection against GPT-4V (and equivalent VLMs),model,High,,,DSGAI09|DSGAI01|DSGAI21,LLM01:2025|LLM01:2026,,research_publication,public_poc,2023-10-14,2026-05-18,https://simonwillison.net/2023/Oct/14/multi-modal-prompt-injection/,prompt-injection|multimodal|vision-language-model|ocr-bypass|visual-injection +DSGAI-VULN-2023-poisongpt-supply-chain,PoisonGPT — undetectable surgical model backdoor via ROME and Hugging Face supply chain,model,Critical,,,DSGAI04|DSGAI21|DSGAI20,LLM03:2025|LLM04:2025|LLM04:2026|LLM05:2026,,research_publication,public_poc,2023-07-09,2026-05-18,https://blog.mithrilsecurity.io/poisongpt-how-we-hid-a-lobotomized-llm-on-hugging-face-to-spread-fake-news/,model-poisoning|supply-chain|rome-editing|disinformation|hugging-face +DSGAI-VULN-2023-vec2text-embedding-inversion,"Vec2Text — black-box reconstruction of source text from embeddings (Morris et al., 2023)",vector_store,High,,,DSGAI18|DSGAI13|DSGAI01,LLM02:2025|LLM06:2025|LLM02:2026|LLM03:2026,,research_publication,public_poc,2023-10-10,2026-05-18,https://arxiv.org/abs/2310.06816,embedding-inversion|vector-store|training-data-reconstruction|privacy-attack|membership-inference-class +DSGAI-VULN-2024-chromadb-default-embedding-egress,ChromaDB DefaultEmbeddingFunction silently sends documents to external service,vector_store,High,,,DSGAI03|DSGAI14|DSGAI01|DSGAI13,LLM06:2025|LLM07:2025|LLM03:2026|LLM08:2026,,research_publication,none_known,2024-11-11,2026-05-18,https://github.com/chroma-core/chroma/issues/5848,shadow-data-flow|third-party-egress|embedding-leakage|vector-store|default-misconfiguration +DSGAI-VULN-2024-skeleton-key-jailbreak,"Skeleton Key multi-turn guardrail-bypass jailbreak (Microsoft MSRC, 2024)",guardrail_or_filter,High,,,DSGAI21|DSGAI01,LLM01:2025|LLM01:2026,,vendor_advisory,public_poc,2024-06-26,2026-05-18,https://www.microsoft.com/en-us/security/blog/2024/06/26/mitigating-skeleton-key-a-new-type-of-generative-ai-jailbreak-technique/,jailbreak|guardrail-bypass|multi-turn|alignment-bypass +DSGAI-VULN-2024-slack-ai-indirect-prompt-injection,Slack AI indirect prompt injection enabling private-channel data exfiltration,agent_framework,High,,,DSGAI01|DSGAI11|DSGAI15,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,,research_publication,public_poc,2024-08-20,2026-05-18,https://promptarmor.substack.com/p/data-exfiltration-from-slack-ai-via,prompt-injection|indirect-prompt-injection|cross-context-bleed|markdown-exfiltration|saas-llm +DSGAI-VULN-2025-gitlab-duo-prompt-injection,GitLab Duo indirect prompt injection enabling source-code theft via merge-request content,ide_assistant,High,,,DSGAI01|DSGAI15|DSGAI16|DSGAI20,LLM01:2025|LLM02:2025|LLM01:2026|LLM02:2026,,coordinated_disclosure,public_poc,2025-02-12,2026-05-18,https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo,prompt-injection|indirect-prompt-injection|code-assistant|unicode-smuggling|html-injection|source-code-exfiltration diff --git a/datasets/vulnerability_dataset/schema.json b/datasets/vulnerability_dataset/schema.json index 76c4423..baffaeb 100644 --- a/datasets/vulnerability_dataset/schema.json +++ b/datasets/vulnerability_dataset/schema.json @@ -80,26 +80,40 @@ "uniqueItems": true }, "owasp_llm_top10_mapping": { - "description": "OWASP Top 10 for LLM Applications 2025 entries this vulnerability aligns with.", + "description": "OWASP Top 10 for LLM Applications entries this vulnerability aligns with, with the edition year (LLM01:2025 or LLM01:2026). The 2026 edition renumbered the list, so the year is part of the ID; data_validation/reference_data/owasp_top10.csv maps each 2026 entry to its 2025 predecessor.", "type": "array", "items": { "type": "string", "enum": [ "LLM01:2025", "LLM02:2025", "LLM03:2025", "LLM04:2025", "LLM05:2025", - "LLM06:2025", "LLM07:2025", "LLM08:2025", "LLM09:2025", "LLM10:2025" + "LLM06:2025", "LLM07:2025", "LLM08:2025", "LLM09:2025", "LLM10:2025", + "LLM01:2026", "LLM02:2026", "LLM03:2026", "LLM04:2026", "LLM05:2026", + "LLM06:2026", "LLM07:2026", "LLM08:2026", "LLM09:2026", "LLM10:2026" + ] + }, + "uniqueItems": true + }, + "owasp_agentic_top10_mapping": { + "description": "OWASP Top 10 for Agentic Applications 2026 entries this vulnerability aligns with. OWASP writes these IDs without a year (ASI01); here they carry ':2026' so a later edition cannot collide. See data_validation/reference_data/owasp_top10.csv.", + "type": "array", + "items": { + "type": "string", + "enum": [ + "ASI01:2026", "ASI02:2026", "ASI03:2026", "ASI04:2026", "ASI05:2026", + "ASI06:2026", "ASI07:2026", "ASI08:2026", "ASI09:2026", "ASI10:2026" ] }, "uniqueItems": true }, "severity": { - "description": "Severity rating. CVSS preferred when available; qualitative always required.", + "description": "Severity rating. CVSS preferred when available; qualitative always required. When a CVSS score is given, qualitative is its FIRST rating band (None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0), taken from the v4.0 score if present, else the v3.x score; data_validation checks each score against its vector and the band.", "type": "object", "additionalProperties": false, "required": ["qualitative"], "properties": { "qualitative": { "type": "string", - "enum": ["Critical", "High", "Medium", "Low", "Informational"] + "enum": ["Critical", "High", "Medium", "Low", "None"] }, "cvss_v3_score": { "type": "number", @@ -109,6 +123,17 @@ "cvss_v3_vector": { "type": "string", "pattern": "^CVSS:3\\.[01]/AV:[NALP]/AC:[LH]/PR:[NLH]/UI:[NR]/S:[UC]/C:[NLH]/I:[NLH]/A:[NLH](/.*)?$" + }, + "cvss_v4_score": { + "description": "CVSS v4.0 score (CVSS-B unless the vector carries threat or environmental metrics).", + "type": "number", + "minimum": 0.0, + "maximum": 10.0 + }, + "cvss_v4_vector": { + "description": "CVSS v4.0 vector, e.g. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.", + "type": "string", + "pattern": "^CVSS:4\\.0/AV:[NALP]/AC:[LH]/AT:[NP]/PR:[NLH]/UI:[NPA]/VC:[HLN]/VI:[HLN]/VA:[HLN]/SC:[HLN]/SI:[HLN]/SA:[HLN](/.*)?$" } } }, diff --git a/datasets/vulnerability_dataset/validate.py b/datasets/vulnerability_dataset/validate.py index 1da2e51..a7d74b1 100644 --- a/datasets/vulnerability_dataset/validate.py +++ b/datasets/vulnerability_dataset/validate.py @@ -31,7 +31,7 @@ def load_taxonomy_ids() -> set[str]: def main() -> int: schema = json.loads(SCHEMA_PATH.read_text(encoding="utf-8")) - validator = Draft202012Validator(schema) + validator = Draft202012Validator(schema, format_checker=Draft202012Validator.FORMAT_CHECKER) taxonomy_ids = load_taxonomy_ids() errors: list[str] = []