{
  "entrypoint_kind": "function_call",
  "entrypoint_detail": "public si.networkInterfaces(true) library API on Linux, reaching checkLinuxDCHPInterfaces() source-directive recursion in lib/network.js",
  "service_started": false,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "node",
    "systeminformation lib/network.js",
    "child_process.execSync (vulnerable only) / fs.readFileSync (fixed)",
    "/bin/sh (vulnerable only)"
  ],
  "tested_revisions": [
    {
      "role": "vulnerable",
      "version": "5.31.6",
      "ref": "v5.31.6",
      "commit_sha": "da1cbf5eb09907cf5c3431f4c9ea441b7a227617"
    },
    {
      "role": "fixed",
      "version": "5.31.7",
      "ref": "v5.31.7",
      "commit_sha": "bbfddde48672d0ee124fefdb3cb4442fd9dd4f03"
    },
    {
      "role": "latest",
      "version": "5.31.17",
      "ref": "v5.31.17",
      "commit_sha": "9e79988a7a530af2ec85518560f02b1daf1e1a83"
    }
  ],
  "candidates": [
    {
      "id": "C",
      "role": "baseline",
      "marker": "/tmp/pruva_variant_markerC",
      "versions_tested": ["v5.31.6"],
      "marker_created": true
    },
    {
      "id": "A",
      "role": "iface_name_sibling_path",
      "marker": "/tmp/pruva_variant_markerA",
      "versions_tested": ["v5.31.6", "5.31.7"],
      "marker_created": false
    },
    {
      "id": "B",
      "role": "source_bypass",
      "markers": ["/tmp/pruva_variant_markerB1", "/tmp/pruva_variant_markerB2", "/tmp/pruva_variant_markerB3"],
      "styles": ["semicolon", "command_substitution", "backtick"],
      "versions_tested": ["5.31.7", "v5.31.17"],
      "any_marker_created": false
    }
  ],
  "verdict": "no_variant_no_bypass",
  "proof_artifacts": [
    "bundle/logs/vuln_variant_reproduction.log",
    "bundle/logs/C_vuln_5_31_6_api.log",
    "bundle/logs/A_vuln_5_31_6_api.log",
    "bundle/logs/A_fixed_5_31_7_api.log",
    "bundle/logs/B_fixed_5_31_7_api.log",
    "bundle/logs/B_latest_5_31_17_api.log"
  ],
  "notes": "Baseline source injection reproduces on 5.31.6 only (marker created). iface-directive name path does not reach a shell on either version. Source-directive bypass with ;, $(), and backticks produces no marker on fixed 5.31.7 or latest v5.31.17 (readFileSync invokes no shell)."
}