[2026-07-05_06:37:01] === CVE-2026-58138 variant analysis === [2026-07-05_06:37:01] marker: PRUVA_VAR_RCE_1783233421 [2026-07-05_06:37:05] [2026-07-05_06:37:05] ########## PHASE 1: VULNERABLE Conductor 3.22.3 ########## [2026-07-05_06:37:05] started conductor-variant-vuln [2026-07-05_06:37:05] detected target: 172.20.0.1:8080 [2026-07-05_06:37:05] waiting for conductor-variant-vuln health at http://172.20.0.1:8080/health ... [2026-07-05_06:37:18] conductor-variant-vuln is healthy (HTTP 200) after ~16s [2026-07-05_06:37:18] --- variant A (vuln) --- [2026-07-05_06:37:25] variant A exit=1 [2026-07-05_06:37:25] variant A result: rce_confirmed=False task_status=COMPLETED [2026-07-05_06:37:25] --- variant B (vuln) --- [2026-07-05_06:37:28] variant B exit=1 [2026-07-05_06:37:28] variant B result: rce_confirmed=False task_status=FAILED [2026-07-05_06:37:28] --- variant C (vuln) --- [2026-07-05_06:37:30] variant C exit=1 [2026-07-05_06:37:30] variant C result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:37:30] vulnerable marker in container: 'PRUVA_VAR_RCE_1783233421' [2026-07-05_06:37:30] [2026-07-05_06:37:30] === VULNERABLE results === [2026-07-05_06:37:30] A (python): rce=[2026-07-05_06:37:18] --- variant A (vuln) --- [2026-07-05_06:37:25] variant A exit=1 [2026-07-05_06:37:25] variant A result: rce_confirmed=False task_status=COMPLETED False [2026-07-05_06:37:30] B (lambda): rce=[2026-07-05_06:37:25] --- variant B (vuln) --- [2026-07-05_06:37:28] variant B exit=1 [2026-07-05_06:37:28] variant B result: rce_confirmed=False task_status=FAILED False [2026-07-05_06:37:30] C (graaljs): rce=[2026-07-05_06:37:28] --- variant C (vuln) --- [2026-07-05_06:37:30] variant C exit=1 [2026-07-05_06:37:30] variant C result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR False [2026-07-05_06:37:30] marker file: 'PRUVA_VAR_RCE_1783233421' [2026-07-05_06:37:41] [2026-07-05_06:37:41] ########## PHASE 2: FIXED Conductor 3.30.2 ########## [2026-07-05_06:37:41] started conductor-variant-fixed [2026-07-05_06:37:41] waiting for conductor-variant-fixed health at http://172.20.0.1:8080/health ... [2026-07-05_06:37:49] conductor-variant-fixed is healthy (HTTP 200) after ~12s [2026-07-05_06:37:49] --- variant A (fixed) --- [2026-07-05_06:37:56] variant A exit=1 [2026-07-05_06:37:56] variant A result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:37:56] --- variant B (fixed) --- [2026-07-05_06:37:58] variant B exit=1 [2026-07-05_06:37:58] variant B result: rce_confirmed=False task_status=FAILED [2026-07-05_06:37:58] --- variant C (fixed) --- [2026-07-05_06:38:01] variant C exit=1 [2026-07-05_06:38:01] variant C result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:38:01] --- variant D (fixed) --- [2026-07-05_06:38:03] variant D exit=1 [2026-07-05_06:38:03] variant D result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:38:03] fixed marker in container: '' [2026-07-05_06:38:03] [2026-07-05_06:38:03] === FIXED results === [2026-07-05_06:38:03] A (python): rce=[2026-07-05_06:37:49] --- variant A (fixed) --- [2026-07-05_06:37:56] variant A exit=1 [2026-07-05_06:37:56] variant A result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR False [2026-07-05_06:38:03] B (lambda): rce=[2026-07-05_06:37:56] --- variant B (fixed) --- [2026-07-05_06:37:58] variant B exit=1 [2026-07-05_06:37:58] variant B result: rce_confirmed=False task_status=FAILED False [2026-07-05_06:38:03] C (graaljs): rce=[2026-07-05_06:37:58] --- variant C (fixed) --- [2026-07-05_06:38:01] variant C exit=1 [2026-07-05_06:38:01] variant C result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR False [2026-07-05_06:38:03] D (java.type()): rce=[2026-07-05_06:38:01] --- variant D (fixed) --- [2026-07-05_06:38:03] variant D exit=1 [2026-07-05_06:38:03] variant D result: rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR False [2026-07-05_06:38:03] marker file: '' [2026-07-05_06:38:13] [2026-07-05_06:38:13] === VERDICT === [2026-07-05_06:38:13] >>> NO BYPASS: all variants blocked on FIXED 3.30.2 [2026-07-05_06:38:13] variants reproduced on vulnerable: 0 of 3 [2026-07-05_06:40:48] === CVE-2026-58138 variant analysis === [2026-07-05_06:40:48] marker: PRUVA_VAR_RCE_1783233648 [2026-07-05_06:40:52] [2026-07-05_06:40:52] ########## PHASE 1: VULNERABLE Conductor 3.22.3 ########## [2026-07-05_06:40:53] started conductor-variant-vuln [2026-07-05_06:40:53] detected target: 172.20.0.1:8080 [2026-07-05_06:40:53] waiting for conductor-variant-vuln health at http://172.20.0.1:8080/health ... [2026-07-05_06:41:05] conductor-variant-vuln is healthy (HTTP 200) after ~16s [2026-07-05_06:41:05] --- variant A (vuln) --- [2026-07-05_06:41:13] variant A (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:41:13] --- variant B (vuln) --- [2026-07-05_06:41:15] variant B (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:41:15] --- variant C (vuln) --- [2026-07-05_06:41:17] variant C (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:41:18] vulnerable marker in container: 'PRUVA_VAR_RCE_1783233648' [2026-07-05_06:41:18] [2026-07-05_06:41:18] === VULNERABLE results === [2026-07-05_06:41:18] A (python): rce=[2026-07-05_06:41:05] --- variant A (vuln) --- [2026-07-05_06:41:13] variant A (vuln): rce_confirmed=True task_status=COMPLETED True [2026-07-05_06:41:18] B (lambda): rce=[2026-07-05_06:41:13] --- variant B (vuln) --- [2026-07-05_06:41:15] variant B (vuln): rce_confirmed=True task_status=COMPLETED True [2026-07-05_06:41:18] C (graaljs): rce=[2026-07-05_06:41:15] --- variant C (vuln) --- [2026-07-05_06:41:17] variant C (vuln): rce_confirmed=True task_status=COMPLETED True [2026-07-05_06:41:18] marker file: 'PRUVA_VAR_RCE_1783233648' [2026-07-05_06:41:28] [2026-07-05_06:41:28] ########## PHASE 2: FIXED Conductor 3.30.2 ########## [2026-07-05_06:41:28] started conductor-variant-fixed [2026-07-05_06:41:28] waiting for conductor-variant-fixed health at http://172.20.0.1:8080/health ... [2026-07-05_06:41:37] conductor-variant-fixed is healthy (HTTP 200) after ~12s [2026-07-05_06:41:37] --- variant A (fixed) --- [2026-07-05_06:41:43] variant A (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:41:43] --- variant B (fixed) --- [2026-07-05_06:41:46] variant B (fixed): rce_confirmed=False task_status=FAILED [2026-07-05_06:41:46] --- variant C (fixed) --- [2026-07-05_06:41:48] variant C (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:41:48] --- variant D (fixed) --- [2026-07-05_06:41:50] variant D (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:41:50] fixed marker in container: '' [2026-07-05_06:41:50] [2026-07-05_06:41:50] === FIXED results === [2026-07-05_06:41:50] A (python): rce=[2026-07-05_06:41:37] --- variant A (fixed) --- [2026-07-05_06:41:43] variant A (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR False [2026-07-05_06:41:50] B (lambda): rce=[2026-07-05_06:41:43] --- variant B (fixed) --- [2026-07-05_06:41:46] variant B (fixed): rce_confirmed=False task_status=FAILED False [2026-07-05_06:41:50] C (graaljs): rce=[2026-07-05_06:41:46] --- variant C (fixed) --- [2026-07-05_06:41:48] variant C (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR False [2026-07-05_06:41:50] D (java.type()): rce=[2026-07-05_06:41:48] --- variant D (fixed) --- [2026-07-05_06:41:50] variant D (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR False [2026-07-05_06:41:50] marker file: '' [2026-07-05_06:42:01] [2026-07-05_06:42:01] === VERDICT === [2026-07-05_06:42:01] >>> NO BYPASS: all variants blocked on FIXED 3.30.2 [2026-07-05_06:42:01] variants reproduced on vulnerable: 0 of 3 [2026-07-05_06:42:01] summary written to artifacts/variant_summary.json [2026-07-05_06:42:20] === CVE-2026-58138 variant analysis === [2026-07-05_06:42:20] marker: PRUVA_VAR_RCE_1783233740 [2026-07-05_06:42:24] [2026-07-05_06:42:24] ########## PHASE 1: VULNERABLE Conductor 3.22.3 ########## [2026-07-05_06:42:25] started conductor-variant-vuln [2026-07-05_06:42:25] detected target: 172.20.0.1:8080 [2026-07-05_06:42:25] waiting for conductor-variant-vuln health at http://172.20.0.1:8080/health ... [2026-07-05_06:42:37] conductor-variant-vuln is healthy (HTTP 200) after ~16s [2026-07-05_06:42:37] --- variant A (vuln) --- [2026-07-05_06:42:44] variant A (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:42:44] --- variant B (vuln) --- [2026-07-05_06:42:47] variant B (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:42:47] --- variant C (vuln) --- [2026-07-05_06:42:49] variant C (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:42:49] vulnerable marker in container: 'PRUVA_VAR_RCE_1783233740' [2026-07-05_06:42:49] [2026-07-05_06:42:49] === VULNERABLE results === [2026-07-05_06:42:49] A (python): rce=True [2026-07-05_06:42:49] B (lambda): rce=True [2026-07-05_06:42:49] C (graaljs): rce=True [2026-07-05_06:42:49] marker file: 'PRUVA_VAR_RCE_1783233740' [2026-07-05_06:43:00] [2026-07-05_06:43:00] ########## PHASE 2: FIXED Conductor 3.30.2 ########## [2026-07-05_06:43:00] started conductor-variant-fixed [2026-07-05_06:43:00] waiting for conductor-variant-fixed health at http://172.20.0.1:8080/health ... [2026-07-05_06:43:09] conductor-variant-fixed is healthy (HTTP 200) after ~12s [2026-07-05_06:43:09] --- variant A (fixed) --- [2026-07-05_06:43:15] variant A (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:43:15] --- variant B (fixed) --- [2026-07-05_06:43:18] variant B (fixed): rce_confirmed=False task_status=FAILED [2026-07-05_06:43:18] --- variant C (fixed) --- [2026-07-05_06:43:20] variant C (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:43:20] --- variant D (fixed) --- [2026-07-05_06:43:22] variant D (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:43:22] fixed marker in container: '' [2026-07-05_06:43:22] [2026-07-05_06:43:22] === FIXED results === [2026-07-05_06:43:22] A (python): rce=False [2026-07-05_06:43:22] B (lambda): rce=False [2026-07-05_06:43:22] C (graaljs): rce=False [2026-07-05_06:43:22] D (java.type()): rce=False [2026-07-05_06:43:22] marker file: '' [2026-07-05_06:43:33] [2026-07-05_06:43:33] === VERDICT === [2026-07-05_06:43:33] >>> NO BYPASS: all variants blocked on FIXED 3.30.2 [2026-07-05_06:43:33] variants reproduced on vulnerable: 3 of 3 [2026-07-05_06:43:33] summary written to artifacts/variant_summary.json [2026-07-05_06:43:52] === CVE-2026-58138 variant analysis === [2026-07-05_06:43:52] marker: PRUVA_VAR_RCE_1783233832 [2026-07-05_06:43:56] [2026-07-05_06:43:56] ########## PHASE 1: VULNERABLE Conductor 3.22.3 ########## [2026-07-05_06:43:56] started conductor-variant-vuln [2026-07-05_06:43:57] detected target: 172.20.0.1:8080 [2026-07-05_06:43:57] waiting for conductor-variant-vuln health at http://172.20.0.1:8080/health ... [2026-07-05_06:44:09] conductor-variant-vuln is healthy (HTTP 200) after ~16s [2026-07-05_06:44:09] --- variant A (vuln) --- [2026-07-05_06:44:16] variant A (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:44:16] --- variant B (vuln) --- [2026-07-05_06:44:19] variant B (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:44:19] --- variant C (vuln) --- [2026-07-05_06:44:21] variant C (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:44:21] vulnerable marker in container: 'PRUVA_VAR_RCE_1783233832' [2026-07-05_06:44:21] [2026-07-05_06:44:21] === VULNERABLE results === [2026-07-05_06:44:21] A (python): rce=True [2026-07-05_06:44:21] B (lambda): rce=True [2026-07-05_06:44:21] C (graaljs): rce=True [2026-07-05_06:44:21] marker file: 'PRUVA_VAR_RCE_1783233832' [2026-07-05_06:44:31] [2026-07-05_06:44:31] ########## PHASE 2: FIXED Conductor 3.30.2 ########## [2026-07-05_06:44:32] started conductor-variant-fixed [2026-07-05_06:44:32] waiting for conductor-variant-fixed health at http://172.20.0.1:8080/health ... [2026-07-05_06:44:40] conductor-variant-fixed is healthy (HTTP 200) after ~12s [2026-07-05_06:44:40] --- variant A (fixed) --- [2026-07-05_06:44:46] variant A (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:44:46] --- variant B (fixed) --- [2026-07-05_06:44:49] variant B (fixed): rce_confirmed=False task_status=FAILED [2026-07-05_06:44:49] --- variant C (fixed) --- [2026-07-05_06:44:51] variant C (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:44:51] --- variant D (fixed) --- [2026-07-05_06:44:53] variant D (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:44:53] fixed marker in container: '' [2026-07-05_06:44:53] [2026-07-05_06:44:53] === FIXED results === [2026-07-05_06:44:53] A (python): rce=False [2026-07-05_06:44:53] B (lambda): rce=False [2026-07-05_06:44:53] C (graaljs): rce=False [2026-07-05_06:44:53] D (java.type()): rce=False [2026-07-05_06:44:53] marker file: '' [2026-07-05_06:45:04] [2026-07-05_06:45:04] === VERDICT === [2026-07-05_06:45:04] >>> NO BYPASS: all variants blocked on FIXED 3.30.2 [2026-07-05_06:45:04] variants reproduced on vulnerable: 3 of 3 [2026-07-05_06:45:04] summary written to artifacts/variant_summary.json [2026-07-05_06:45:08] === CVE-2026-58138 variant analysis === [2026-07-05_06:45:08] marker: PRUVA_VAR_RCE_1783233908 [2026-07-05_06:45:12] [2026-07-05_06:45:12] ########## PHASE 1: VULNERABLE Conductor 3.22.3 ########## [2026-07-05_06:45:12] started conductor-variant-vuln [2026-07-05_06:45:12] detected target: 172.20.0.1:8080 [2026-07-05_06:45:12] waiting for conductor-variant-vuln health at http://172.20.0.1:8080/health ... [2026-07-05_06:45:24] conductor-variant-vuln is healthy (HTTP 200) after ~16s [2026-07-05_06:45:24] --- variant A (vuln) --- [2026-07-05_06:45:32] variant A (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:45:32] --- variant B (vuln) --- [2026-07-05_06:45:34] variant B (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:45:34] --- variant C (vuln) --- [2026-07-05_06:45:36] variant C (vuln): rce_confirmed=True task_status=COMPLETED [2026-07-05_06:45:37] vulnerable marker in container: 'PRUVA_VAR_RCE_1783233908' [2026-07-05_06:45:37] [2026-07-05_06:45:37] === VULNERABLE results === [2026-07-05_06:45:37] A (python): rce=True [2026-07-05_06:45:37] B (lambda): rce=True [2026-07-05_06:45:37] C (graaljs): rce=True [2026-07-05_06:45:37] marker file: 'PRUVA_VAR_RCE_1783233908' [2026-07-05_06:45:47] [2026-07-05_06:45:47] ########## PHASE 2: FIXED Conductor 3.30.2 ########## [2026-07-05_06:45:47] started conductor-variant-fixed [2026-07-05_06:45:47] waiting for conductor-variant-fixed health at http://172.20.0.1:8080/health ... [2026-07-05_06:45:56] conductor-variant-fixed is healthy (HTTP 200) after ~12s [2026-07-05_06:45:56] --- variant A (fixed) --- [2026-07-05_06:46:02] variant A (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:46:02] --- variant B (fixed) --- [2026-07-05_06:46:05] variant B (fixed): rce_confirmed=False task_status=FAILED [2026-07-05_06:46:05] --- variant C (fixed) --- [2026-07-05_06:46:07] variant C (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:46:07] --- variant D (fixed) --- [2026-07-05_06:46:09] variant D (fixed): rce_confirmed=False task_status=FAILED_WITH_TERMINAL_ERROR [2026-07-05_06:46:09] fixed marker in container: '' [2026-07-05_06:46:09] [2026-07-05_06:46:09] === FIXED results === [2026-07-05_06:46:09] A (python): rce=False [2026-07-05_06:46:09] B (lambda): rce=False [2026-07-05_06:46:09] C (graaljs): rce=False [2026-07-05_06:46:09] D (java.type()): rce=False [2026-07-05_06:46:09] marker file: '' [2026-07-05_06:46:20] [2026-07-05_06:46:20] === VERDICT === [2026-07-05_06:46:20] >>> NO BYPASS: all variants blocked on FIXED 3.30.2 [2026-07-05_06:46:20] variants reproduced on vulnerable: 3 of 3 [2026-07-05_06:46:20] summary written to artifacts/variant_summary.json