@blamejs/exceptd-skills 0.21.10 → 0.21.11

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.21.11 — 2026-09-28
+
+446 zero-day lesson texts and 7 catalog fields on 341 CVEs no longer cite the curation input. Evidence and control texts that read "Packet records cisa_kev true with kev_date 2025-10-02, poc_available true" or "the packet places the defect in ..." now state each fact in a sentence and name its source where there is one: CISA's KEV entry, the vendor advisory, or a framework gap recorded for the entry. Every quotation attributed to CISA's KEV entry matches the KEV record. The catalog gap audit's `pipeline-wording` class now reports no texts, and the predeploy budget gate holds it at 0.
+
+The discovery note on CVE-2017-17562 said the KEV entry lists no vendor. The KEV entry names Embedthis as the vendor and links no vendor advisory, and the note now says so.
+
+`scripts/audit-catalog-gaps.js` now lists every extended class it covers under `totals.extended` and `extended_findings`, with a count of 0 for a class that has no findings. It used to leave such a class out, so `--class pipeline-wording` returned no count at all once the class reached 0.
+
 ## 0.21.10 — 2026-09-28
 
 626 catalog and zero-day lesson texts on 240 CVEs no longer say that CISA's KEV required action calls for a restart or reboot. CISA's required action for these CVEs says to apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product. Every one of these entries records `patch_required_reboot: true`, so each text keeps the restart and drops only the attribution: "the vendor patch typically requires a service restart or system reboot per the KEV requiredAction" now ends at "system reboot". 239 of the texts are `live_patch_notes` fields in the catalog.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-28T20:42:47.146Z",
+  "generated_at": "2026-09-28T21:45:53.908Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "8ef779db5095182e6cbbfccbcc875a58733b16da9703b359a550b06544ab539a",
+    "manifest.json": "4458e5bbea371c93b1bd8b496097a9bd5cd9c99b3ac62d99b056e53e7ced9ebc",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "839b8354bd39025286484148b862661fa79ecef835165be86e9205801f73c070",
+    "data/cve-catalog.json": "d225c9429a16992716ad62db3779cede31ed776bd9319c4f3a8d28269d09732c",
     "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "498d99a8ea35cec3ef929bb8082e2e38f0991c44004343666c477d1adf5087b6",
+    "data/zeroday-lessons.json": "ac5ffd458028b3aef7140f99e00f4cefe749c4b19101f396c98ac6409874ed1b",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",

package/data/cve-catalog.json

@@ -18951,7 +18951,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Not AI-discovered. The Metasploit module credits Daniel Hodson of elttam with vulnerability discovery and the original Python exploit; the published analysis is manual source review of cgiHandler in cgi.c. No AI tooling is credited on discovery or weaponisation.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Credited in the Metasploit module to Daniel Hodson (elttam) for vulnerability discovery and the Python exploit, with h00die and hdm as module authors; the technical write-up is published by elttam at https://www.elttam.com/blog/goahead/. The KEV entry lists no vendor, and the packet carries no vendor advisory reference for Embedthis. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-114 is used for cgiHandler building the forked CGI process's environment out of unfiltered HTTP request parameters, which lets an attacker set LD_PRELOAD and have the dynamic linker load a shared object of their choosing.",
+    "discovery_attribution_note": "Credited in the Metasploit module to Daniel Hodson (elttam) for vulnerability discovery and the Python exploit, with h00die and hdm as module authors; the technical write-up is published by elttam at https://www.elttam.com/blog/goahead/. The KEV entry links no vendor advisory. CWE assigned editorially: NVD records no weakness for this CVE, so CWE-114 is used for cgiHandler building the forked CGI process's environment out of unfiltered HTTP request parameters, which lets an attacker set LD_PRELOAD and have the dynamic linker load a shared object of their choosing.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "CISA KEV-listed on 2021-12-10 with a 2022-06-10 remediation date and the ransomware column left as Unknown, so CISA asserts confirmed exploitation but records no ransomware association. No named campaign, actor or incident appears in the sources available here — the KEV entry carries no shortDescription beyond the flaw itself and there is no vendor advisory in the reference set to attribute against. What is documented is capability and reach rather than a campaign: an ExcellentRanking Metasploit module has been public since the 2017 disclosure, and elttam's analysis counted over 735,000 hosts answering Shodan with a 'Server: GoAhead' banner, of which the vulnerable subset is those on Unix with CGI enabled and dynamically linked CGI programs. Treat exploitation as commodity and untargeted rather than attributed.",
     "attack_refs": [
@@ -51429,7 +51429,7 @@
         "Applet or JNLP fetches from hosts outside the internal application allowlist, with jar retrievals landing in the Java deployment cache",
         "A JRE lib/security/java.security whose package.access and package.definition lines do not list com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal"
       ],
-      "_ioc_source_note": "Exposure markers derive from the affected-version boundary in NVD CVE-2012-5076 (Java SE 7 Update 7 and earlier) and from the CISA KEV short description in the packet, which names com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal as the packages left unrestricted. The delivery-side behaviours match the applet delivery and the generic-Java plus native Windows/macOS/Linux targets of the Metasploit module read at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/browser/java_jre17_glassfish_averagerangestatisticimpl.rb. No exploit signature is claimed beyond what that module makes observable."
+      "_ioc_source_note": "Exposure markers derive from the affected-version boundary in NVD CVE-2012-5076 (Java SE 7 Update 7 and earlier) and from CISA's KEV short description, which names com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal as the packages left unrestricted. The delivery-side behaviors match the applet delivery and the generic-Java plus native Windows/macOS/Linux targets of the Metasploit module read at https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/browser/java_jre17_glassfish_averagerangestatisticimpl.rb. No exploit signature is claimed beyond what that module makes observable."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The fix shipped in Oracle's October 2012 Critical Patch Update. Oracle's credit statement could not be retrieved - oracle.com returned HTTP 403 to every request made for this entry - so no individual finder is asserted. The Metasploit module for the flaw lists Security Explorations' SE-2012-01 report among its references alongside the Oracle CPU. Nothing in the NVD record, the KEV entry or the public exploit attributes the discovery to automated or AI-assisted analysis.",
@@ -52080,7 +52080,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Tavis Ormandy is named as the discoverer and author of the original exploit in the Metasploit module's author list and on the Exploit-DB entry, and disclosed it publicly on the Full Disclosure list in May 2013. MS13-053's acknowledgements credit reporters for seven other vulnerabilities in the bulletin and do not list one for CVE-2013-3660, which is consistent with a public disclosure rather than a coordinated report. Neither MS13-053, Exploit-DB 25912 nor the Metasploit module claims AI-assisted discovery.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Curated from NVD CVE-2013-3660 (CWE-119, CVSS 7.8) + CISA KEV (added 2022-03-28) + Microsoft bulletin MS13-053 (KB2850851, V1.0 published 2013-07-09). Discovery and public exploit code attributed to Tavis Ormandy per Exploit-DB 25912 and the Metasploit module ppr_flatten_rec; the earlier Secunia advisory 53435 in the packet is a third-party aggregation rather than a Microsoft publication.",
+    "discovery_attribution_note": "This entry is based on NVD CVE-2013-3660 (CWE-119, CVSS 7.8), CISA KEV (added 2022-03-28), and Microsoft bulletin MS13-053 (KB2850851, V1.0 published 2013-07-09). Discovery and public exploit code are attributed to Tavis Ormandy per Exploit-DB 25912 and the Metasploit module ppr_flatten_rec; the earlier Secunia advisory 53435 is a third-party aggregation rather than a Microsoft publication.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "MS13-053 records that this vulnerability had been publicly disclosed before the bulletin, and answers the exploitation question for CVE-2013-3660 in full: 'Microsoft had not received any information to indicate that this vulnerability had been used to attack customers to achieve remote code execution when this security bulletin was originally issued. Microsoft was aware of this vulnerability being used to achieve elevation of privilege in targeted attacks. Both the remote code execution and elevation of privilege uses of this vulnerability are addressed by this update.' In-the-wild use of the escalation is therefore vendor-documented as of the bulletin's publication on 2013-07-09, and the negative Microsoft states covers remote code execution only. CISA's KEV listing of 2022-03-28, with a 2022-04-18 due date and no ransomware association recorded, is a later assertion of the same. EPSS is 0.39578 at the 98.489th percentile (2026-08-17), which is consistent with a local escalation that needs prior code execution rather than with a remotely reachable flaw.",
     "attack_refs": [
@@ -52296,7 +52296,7 @@
         "A DSL-2760U reporting firmware below 1.12 — the exposure marker, independent of any exploitation",
         "The gateway administration interface answering on a general user VLAN rather than only a management segment"
       ],
-      "_ioc_source_note": "The parameter and endpoint names are read from the NVD description of CVE-2013-5223 in the packet. The HTTP Basic authentication step, the stored-script write through todmngr.tod, and the feature-disabling behaviour used to lure an administrator back to the affected page were read from the Exploit-DB 36987 source at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/hardware/webapps/36987.pl. The firmware-version exposure marker comes from D-Link SAP10002 and the NVD CPE boundary. No exploit signature beyond what those sources show is asserted."
+      "_ioc_source_note": "The parameter and endpoint names are read from the NVD description of CVE-2013-5223. The HTTP Basic authentication step, the stored-script write through todmngr.tod, and the feature-disabling behavior used to lure an administrator back to the affected page were read from the Exploit-DB 36987 source at https://gitlab.com/exploit-database/exploitdb/-/raw/main/exploits/hardware/webapps/36987.pl. The firmware-version exposure marker comes from D-Link SAP10002 and the NVD CPE boundary. No exploit signature beyond what those sources show is asserted."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "The original DSL-2760U disclosure went to the Full Disclosure list and Packet Storm (NVD references seclists.org/fulldisclosure/2013/Nov/76 and packetstormsecurity.com/files/123976). D-Link SAP10002's Reference section credits Liad Mizrachi for CVE-2013-5223. The later exploit code coded to this CVE is credited in its own source to Mauricio Correa of XLabs Information Security. Manual web-application testing of a router configuration UI throughout; no AI involvement claimed by any party.",
@@ -52856,7 +52856,7 @@
         "A Windows host missing update 3006226 — the exposure marker, and one that a host reboot must follow before it clears",
         "Windows XP systems in the inventory, which receive no fix for this flaw at all"
       ],
-      "_ioc_source_note": "The delivery model, the affected-file scope and the absence of any workaround are quoted from Microsoft MS14-064 at https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064. The non-browser exploitation routes are the Packet Storm entries NVD tags as Exploit references on the CVE-2014-6332 record — Avant Browser, The World Browser, HTML Compiler, Microsoft Compiled HTML Help and the Winamp Bento browser. The VBScript and array-redimension mechanism is from the NVD description in the packet and the Metasploit module metadata for exploit/windows/browser/ms14_064_ole_code_execution, which uses VBScript as its attack vector on Windows XP and PowerShell on newer systems. No specific exploit byte signature is asserted."
+      "_ioc_source_note": "The delivery model, the affected-file scope and the absence of any workaround are quoted from Microsoft MS14-064 at https://learn.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-064. The non-browser exploitation routes are the Packet Storm entries NVD tags as Exploit references on the CVE-2014-6332 record: Avant Browser, The World Browser, HTML Compiler, Microsoft Compiled HTML Help and the Winamp Bento browser. The VBScript and array-redimension mechanism is from the NVD description and the Metasploit module metadata for exploit/windows/browser/ms14_064_ole_code_execution, which uses VBScript as its attack vector on Windows XP and PowerShell on newer systems. No specific exploit byte signature is asserted."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "MS14-064 records the flaw as 'privately reported' and received 'through coordinated vulnerability disclosure'. The finding is attributed to IBM X-Force: NVD references the IBM disclosure post at securityintelligence.com titled 'IBM X-Force Researcher Finds Significant Vulnerability in Microsoft Windows', and the Metasploit module's author list credits Robert Freeman alongside the exploit developers who followed. Note for the AI-attribution field specifically — X-Force is a human research organisation and nothing in these sources claims AI-assisted discovery; this was manual analysis of a long-standing OLE automation code path.",
@@ -66083,7 +66083,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Found by Jacob Baines, then at Tenable Research, while investigating a Crestron AM-100; he identified the shared AWIND codebase and enumerated the other OEM badges by hand, publishing the set as Tenable Research advisory TRA-2019-20 and later writing the Metasploit module. Manual firmware analysis of one device followed by codebase-matching across vendors — no automated or AI-assisted discovery is claimed anywhere in the disclosure.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Curated from NVD CVE-2019-3929 (CWE-78, CWE-79, CVSS 9.8) + CISA KEV (added 2022-04-15) + Crestron security advisory 'AM-100 and AM-101 Vulnerabilities' dated 2021-07-27 and Tenable Research advisory TRA-2019-20 by Jacob Baines. The operative weakness is the CWE-78 command injection; CWE-79 in the packet reflects sibling cross-site scripting findings bundled in the same advisory.",
+    "discovery_attribution_note": "The sources are NVD CVE-2019-3929 (CWE-78, CWE-79, CVSS 9.8), CISA KEV (added 2022-04-15), the Crestron security advisory 'AM-100 and AM-101 Vulnerabilities' dated 2021-07-27 and Tenable Research advisory TRA-2019-20 by Jacob Baines. The operative weakness is the CWE-78 command injection; the CWE-79 listing reflects sibling cross-site scripting findings bundled in the same advisory.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "The KEV listing of 2022-04-15 with a 2022-05-06 due date is CISA's evidence of in-the-wild use; no named vendor threat-intel report ties a specific actor or campaign to this CVE. What corroborates commodity exploitation is the EPSS reading of 0.98952 at the 99.926th percentile on 2026-08-16 — near the top of the entire corpus — which is what a one-request unauthenticated root RCE with a shipped nuclei template and a Metasploit module attracts. Crestron's own release notes for AM-100 1.7.1.7 / AM-101 2.8.0.27 state that the flaw exposed the filesystem and the web server certificate, and that Server.pem 'was compromised and thus required regeneration'.",
     "attack_refs": [
@@ -82138,7 +82138,7 @@
         "More than one unrar binary on a host — the distribution package plus an application-bundled copy — where only one has been updated",
         "A JSP or other web-servable file present under a mail platform's web root with a modification time matching an inbound message rather than a deployment"
       ],
-      "_ioc_source_note": "The IsRelativeSymLinkSafe / DosSlashToUnix validate-then-normalise ordering, the FSREDIR_WINSYMLINK record type, the ..\\..\\..\\tmp/shell example target, the Amavis auto-extraction path, the caveat that the web-root route fails on distributed installations, and the fixed versions 6.12 binary / 6.1.7 source were read from https://www.sonarsource.com/blog/zimbra-pre-auth-rce-via-unrar-0day/. The ~/.ssh/authorized_keys demonstration target is from the NVD description carried in the packet. Working exploit code and the archive-construction details: https://github.com/rbowes-r7/unrar-cve-2022-30333-poc and Metasploit modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb plus modules/exploits/linux/http/zimbra_unrar_cve_2022_30333.rb."
+      "_ioc_source_note": "The IsRelativeSymLinkSafe / DosSlashToUnix validate-then-normalize ordering, the FSREDIR_WINSYMLINK record type, the ..\\..\\..\\tmp/shell example target, the Amavis auto-extraction path, the caveat that the web-root route fails on distributed installations, and the fixed versions 6.12 binary / 6.1.7 source were read from https://www.sonarsource.com/blog/zimbra-pre-auth-rce-via-unrar-0day/. The ~/.ssh/authorized_keys demonstration target is from the NVD description. Working exploit code and the archive-construction details are available at https://github.com/rbowes-r7/unrar-cve-2022-30333-poc and in the Metasploit modules modules/exploits/linux/fileformat/unrar_cve_2022_30333.rb and modules/exploits/linux/http/zimbra_unrar_cve_2022_30333.rb."
     },
     "ai_discovered": false,
     "ai_discovery_notes": "Discovered by SonarSource's vulnerability research team, led by Simon Scannell, and reported to RarLab on 2022-05-04. SonarSource is an outside research team rather than the vendor's own, and its published analysis is manual source review of the validate-then-normalise ordering in UnRAR's symlink handling. No AI-assisted discovery is claimed.",