{
  "claim_outcome": "not_confirmed",
  "claim_block_reason": "no_bypass_found",
  "variant_result": "alternate_triggers_confirmed_no_bypass",
  "validated_surface": "api_remote",
  "evidence_scope": "production_path",
  "claimed_impact_class": "code_execution",
  "observed_impact_class": "code_execution",
  "exploitability_confidence": "high",
  "attacker_controlled_input": "Unauthenticated workflow definitions with INLINE (evaluatorType=python/graaljs/javascript) or LAMBDA tasks containing malicious script expressions that bootstrap Java reflection/Runtime.exec (JS) or Java interop import (Python).",
  "trigger_path": "POST /api/metadata/workflow (register, no auth) + POST /api/workflow/{name} (start, no auth) -> INLINE/LAMBDA task evaluates script in GraalVM Context -> reflective Runtime.exec or java.lang.Runtime import -> command stdout returned via GET /api/workflow/{id}?includeTasks=true",
  "end_to_end_target_reached": true,
  "sanitizer_used": false,
  "crash_observed": false,
  "read_write_primitive_observed": false,
  "exploit_chain_demonstrated": true,
  "blocking_mitigation": "Fix in v3.30.2 (commits 87a7d96aabbb706d6e84f812b93da5165028d18f + c691e35e768caeb802c9f06ecdd9674c80081af1): ScriptEvaluator.createNewContext() applies denyAccess for Class/ClassLoader/reflection.*/Runtime/ProcessBuilder/Process/System/Thread/ThreadGroup + allowHostClassLoading(false) + allowCreateProcess(false) + allowIO(IOAccess.NONE) + js.load=false + shared Engine. PythonEvaluator removes allowAllAccess(true). All tested variants blocked on fixed version.",
  "inferred": false,
  "variants_tested": [
    {
      "variant_id": "A",
      "description": "INLINE task with evaluatorType=python -> PythonEvaluator (separate GraalVM context builder)",
      "vuln_result": "rce_confirmed",
      "fixed_result": "blocked",
      "fixed_task_status": "FAILED_WITH_TERMINAL_ERROR"
    },
    {
      "variant_id": "B",
      "description": "LAMBDA task (deprecated) with scriptExpression -> ScriptEvaluator (different task type, same JS sink)",
      "vuln_result": "rce_confirmed",
      "fixed_result": "blocked",
      "fixed_task_status": "FAILED"
    },
    {
      "variant_id": "C",
      "description": "INLINE task with evaluatorType=graaljs -> ScriptEvaluator (alias evaluator path)",
      "vuln_result": "rce_confirmed",
      "fixed_result": "blocked",
      "fixed_task_status": "FAILED_WITH_TERMINAL_ERROR"
    },
    {
      "variant_id": "D",
      "description": "INLINE+javascript with Java.type() bypass attempt (tests allowHostClassLoading(false))",
      "vuln_result": "not_tested",
      "fixed_result": "blocked",
      "fixed_task_status": "FAILED_WITH_TERMINAL_ERROR"
    }
  ],
  "vuln_marker_present": true,
  "fixed_marker_present": false,
  "vuln_version": "3.22.3",
  "fixed_version": "3.30.2",
  "fixed_commit_sha": "2bea5078f916c0d529cd0f32a55f79425b65a5b8",
  "fix_is_complete": true,
  "recommendation": "The fix is complete. No bypass found. Recommend defense-in-depth: add explicit allowHostClassLoading(false)/allowCreateProcess(false)/allowIO(IOAccess.NONE) to PythonEvaluator for consistency, and consider HostAccess.NONE allow-list approach for the JS evaluator."
}