{
  "entrypoint_kind": "cli_command",
  "entrypoint_detail": "datamodel-codegen CLI: --input malicious_schema.json --input-file-type jsonschema --output <generated.py>; generated module imported to execute injected code",
  "service_started": false,
  "healthcheck_passed": true,
  "target_path_reached": true,
  "runtime_stack": [
    "cpython",
    "datamodel-code-generator",
    "pydantic"
  ],
  "proof_artifacts": [
    "logs/reproduction_steps.log",
    "logs/vuln_codegen_inst1.log",
    "logs/vuln_import_inst1.log",
    "logs/vuln_codegen_inst2.log",
    "logs/vuln_import_inst2.log",
    "logs/fixed_codegen.log",
    "repro/malicious_schema_inst1.json",
    "repro/malicious_schema_inst2.json",
    "repro/generated_vuln_inst1.py",
    "repro/generated_vuln_inst2.py",
    "repro/marker_inst1",
    "repro/marker_inst2",
    "repro/malicious_schema_fixed.json",
    "repro/negative_control_observation.json"
  ],
  "vuln_instance1_marker_written": true,
  "vuln_instance2_marker_written": true,
  "fixed_rejected": true,
  "fixed_codegen_exit_code": 2,
  "notes": "Two fresh vulnerable datamodel-codegen process instances generated modules whose import executed attacker-controlled print() writing distinct markers (DMCG_RCE_INST1, DMCG_RCE_INST2). Fixed build (545a96c5) rejected the same schema (exit 2) and produced no output/marker."
}