@blamejs/exceptd-skills 0.21.7 → 0.21.9

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.21.9 — 2026-09-27
+
+159 more zero-day lesson texts that cited the curation input instead of a source now state the fact directly. The `pipeline-wording` class in the catalog gap audit now also recognizes labels such as "Packet records ...", "Packet attack vector: ..." and "Packet NIST-800-53-SI-2 gap: ...", and phrases such as "the packet places ...", "a public exploit recorded in the packet", "Priority follows the packet rather than ..." and "the packet's boundary-protection gap". The class reports 326 texts, and the predeploy budget gate now holds it at 326. Network wording such as "a device forwarding the packet", "the length supplied in the packet", "the protocol version named in the packet", "the options listed in the packet header" or "the packet's inter-frame gap" does not match.
+
+`exceptd refresh --curate-batch` now refuses a batch for curation-input wording only when a new entry or lesson cites a catalog field name after "packet", as in "Packet fields: cisa_kev true" or "the packet's live_patch_notes ...". Other curation-input wording, such as "Packet: ..." or "the packet names ...", is listed under a new `warnings` array in the output, and the batch still applies.
+
+63 reusable-control descriptions in the zero-day lessons carried another CVE's product, CWE, fixed build or KEV listing date. Each now describes the control in general terms or the entry's own flaw. They include the Apple JavaScriptCore text on seven Adobe Flash Player, Oracle Fusion Middleware, Microsoft Silverlight and Checkbox Survey entries, the nginx 1.30.1 sentence on 17 entries for other web software, the Android 2026-06-01 patch level on eight Samsung, Android, Linux kernel, Code Aurora and Arm Mali entries, a Windows Remote Desktop Services text on CVE-2022-22047 and CVE-2026-68820, and a FortiCloud SSO text on CVE-2018-13382. Six Adobe Acrobat and Reader entries no longer name CWE-1321 or say the fix requires a restart. Two lesson texts gave a KEV listing date a few days off CISA's: CISA listed CVE-2025-14174 on 2025-12-12 and CVE-2025-24201 on 2025-03-13.
+
+The Cisco advisory on CVE-2025-32433 is now recorded under vendor Cisco rather than Erlang.
+
+The catalog gap audit's `logical-consistency` class now reports a catalog or lesson text that states a KEV listing date other than the entry's `cisa_kev_date`, and `exceptd refresh --curate-batch` refuses a batch when a new entry or lesson assigns a different listing date to its own CVE id, as in "CVE-2025-0108 was KEV-listed on 2026-02-10" or "CISA added CVE-2025-0108 to KEV on 2026-02-10", and lists any other mismatch, such as "The predecessor of CVE-2025-0108 was KEV-listed on ...", under `warnings`. The check ignores case, so "kev-listed" counts. KEV due dates do not match, and neither does a date that belongs to another CVE named earlier in the same sentence, such as "CVE-2011-0611, a sibling, was KEV-listed 2022-06-09" on an entry for a different CVE. A sentence that also names the entry's own CVE, or refers back to its own flaw as in "Unlike CVE-2020-0002, this flaw was KEV-listed ...", is still checked.
+
+## 0.21.8 — 2026-09-27
+
+1,998 zero-day lesson texts and 2 catalog fields no longer cite the curation input instead of a source, as in "Packet: ...", "Packet fields for CVE-...", "the packet's own ..." or a catalog field name such as `cisa_kev` or `live_patch_notes` quoted as evidence. Each text now states the fact directly, and names CISA's KEV entry or the vendor advisory where that is the source. The `pipeline-wording` class in the catalog gap audit falls from 2,159 texts to 159, and the predeploy budget gate now holds it at 159.
+
 ## 0.21.7 — 2026-09-27
 
 The catalog holds 1,758 CVEs after one addition from CISA KEV: CVE-2021-1905, a use-after-free in the Qualcomm Adreno GPU driver on Android and other Snapdragon devices. It has no public exploit, and the fix needs a device restart. Google's Threat Analysis Group attributes its use as a zero-day to the commercial surveillance vendor Intellexa.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-27T17:35:13.161Z",
+  "generated_at": "2026-09-28T12:21:36.155Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "1a53c846b758ff96c4214fd7d65ef8bdd9344f5c1daf6df2e0550a07611aa617",
+    "manifest.json": "a2a3289098e463fff44f46a94ffd99fcaa322be1f17ad38d9a4466eb86eb03ff",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "d4632abe8bda7993fcdefbb586e1ba7139c55e22a871b2bb167703fb9c00392c",
+    "data/cve-catalog.json": "2139b98428f241d0aa6ebc2fc5f28db0dedb0ef0d01a86499b05367fb7785493",
     "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "fc805929c375a3e4dfafaa5fdde9a54fd203ac3c44c1b02ae76e4aa9f7e82d62",
+    "data/zeroday-lessons.json": "0291b9e21e5af74b6b71aa2a60a4f61c4851768aca8bbc4a464f54530f9568dc",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",

package/data/cve-catalog.json

@@ -16825,7 +16825,7 @@
     "ai_discovery_source": "unknown",
     "discovery_attribution_note": "Curated from NVD CVE-2019-2725 (CWE-74, CVSS 9.8, affected 10.3.6.0.0 and 12.1.3.0.0) and the CISA KEV record (added 2022-01-10, due 2022-07-10, ransomware Known). Exploit availability confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates. Oracle's alert-cve-2019-2725 page returned HTTP 403 and could not be quoted, so vendor wording, patch identifiers and any acknowledgement are absent by omission rather than by judgement.",
     "ai_assisted_weaponization": false,
-    "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-07-10 due date and records the ransomware association as Known. Oracle handled the fix as a standalone Security Alert (alert-cve-2019-2725) rather than folding it into a quarterly Critical Patch Update, and the packet's own vendor-advisory reference list for this CVE also carries the July 2019 and January 2020 Critical Patch Update pages - an out-of-band alert is the vendor's own signal that the flaw was already being used when the fix shipped. The Oracle alert page returned HTTP 403 to every fetch in this pass, so no vendor wording and no credit line is quoted here. No named campaign, actor or ransomware family is confirmed from a source retrieved for this entry: the ransomware association is the KEV record's own field, not an attribution report read here.",
+    "active_exploitation_notes": "CISA added the CVE to KEV on 2022-01-10 with a 2022-07-10 due date and records the ransomware association as Known. Oracle handled the fix as a standalone Security Alert (alert-cve-2019-2725) rather than folding it into a quarterly Critical Patch Update, and Oracle's vendor advisories for this CVE also include the July 2019 and January 2020 Critical Patch Update pages. An out-of-band alert is the vendor's own signal that the flaw was already being used when the fix shipped. The Oracle alert page returned HTTP 403 to every fetch made for this entry, so no vendor wording and no credit line is quoted here. No named campaign, actor or ransomware family is confirmed from a source retrieved for this entry: the ransomware association is the KEV record's own field, not an attribution report read here.",
     "attack_refs": [
       "T1190",
       "T1059",
@@ -23338,7 +23338,7 @@
     "ai_discovered": false,
     "ai_discovery_notes": "Apple credits 'an anonymous researcher' in HT212807. No AI tooling is named, and the report predates AI-assisted vulnerability discovery becoming an operational reality. The researcher's identity is withheld by Apple, not unknown to it, which is why the source is recorded as human_researcher rather than unknown.",
     "ai_discovery_source": "human_researcher",
-    "discovery_attribution_note": "Curated from NVD CVE-2021-30858 (CWE-416, CVSS 8.8), the CISA KEV record (added 2021-11-03, due 2021-11-17) including its note about non-Apple WebKit embedders, and Apple support document HT212807 for iOS 14.8 / iPadOS 14.8 (13 September 2021), which supplies the impact wording and the 'an anonymous researcher' credit. The packet's own references array for this CVE is empty; HT212807 was retrieved for this pass. Absence of a public exploit module confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates.",
+    "discovery_attribution_note": "This entry draws on NVD CVE-2021-30858 (CWE-416, CVSS 8.8), the CISA KEV record (added 2021-11-03, due 2021-11-17) including its note about non-Apple WebKit embedders, and Apple support document HT212807 for iOS 14.8 / iPadOS 14.8 (13 September 2021), which supplies the impact wording and the 'an anonymous researcher' credit. HT212807 was retrieved for this entry. The absence of a public exploit module was confirmed against rapid7/metasploit-framework and projectdiscovery/nuclei-templates.",
     "ai_assisted_weaponization": false,
     "active_exploitation_notes": "Apple support document HT212807, covering iOS 14.8 and iPadOS 14.8 released 13 September 2021, states for this CVE: 'Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.' The credit is to 'an anonymous researcher' - Apple names no reporting organisation. CISA added the CVE to KEV on 2021-11-03 with a 2021-11-17 due date and records the ransomware association as Unknown. Apple names no campaign and no actor, and no named campaign is confirmed from a source retrieved for this entry. The one hard adjacency worth carrying: the same 14.8 update also fixed CVE-2021-30860, so an unpatched device carried two flaws Apple describes as possibly actively exploited.",
     "attack_refs": [
@@ -166887,7 +166887,7 @@
         "published_date": "2025-06-09"
       },
       {
-        "vendor": "Erlang",
+        "vendor": "Cisco",
         "advisory_id": null,
         "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy",
         "severity": "high",