{
  "_pruva_terminal_reconciliation": {
    "authored_artifact_closure_sha256": "da4b4f95bb3785bb156620ac7f1333eeb5e33e09ab597b25bf781d51d11a65f8",
    "authored_runtime_manifest_sha256": "97e1c4622a407548c7c95552720dcda23e646f09e88a55d51a793daec9da8dd7",
    "authored_verdict_sha256": "9ef90d5ac91e991b555a80e7274bb81b43ff5dcb4f57ef4fe806aa21579d8f10",
    "claim_matching": "evaluated",
    "schema_version": 2,
    "status": "completed"
  },
  "accepted_exploit_knowledge_record_ids": [
    "4809bf45-0234-449a-88e9-072741ed7fd4",
    "b87cc191-59ed-46cf-9340-f37ad31b22c3"
  ],
  "attacker_controlled_input": "Malicious template repository content pushed over git-HTTP: .forgejo/template glob list ('.g*/config', '.ghooks/*'), file .g${REPO_NAME}/config (git config with repo-local core.hooksPath=.ghooks and core.fsmonitor), and executable .ghooks/post-commit hook; triggered by POST /api/v1/repos/{owner}/{repo}/generate with name 'it' so ${REPO_NAME} expansion recreates .git/config",
  "claim_outcome": "confirmed",
  "claimed_impact_class": "code_execution",
  "claimed_surface": "api_remote",
  "crash_observed": false,
  "end_to_end_target_reached": true,
  "evidence_scope": "production_path",
  "exploit_chain_demonstrated": true,
  "exploitability_confidence": "high",
  "inferred": false,
  "observed_impact_class": "code_execution",
  "read_write_primitive_observed": true,
  "repro_result": "confirmed",
  "sanitizer_used": false,
  "trigger_path": "POST /api/v1/repos/admin1/evil-template/generate -> repo_service.GenerateRepository -> GenerateGitContent -> generateRepoCommit (services/repository/generate_repo_commit.go): clone template, RemoveAll(.git), checkGiteaTemplate variable expansion renames .g${REPO_NAME}/config -> .git/config, git.InitRepository adopts recreated .git, initRepoCommit runs 'git commit' which executes attacker hook via repo-local core.hooksPath",
  "validated_surface": "api_remote"
}