{"schema":"mvm.security.app-comparison-report/v1","source_run_id":"cve-2025-55182-tier1","artifact_digest":"sha256:0e43ccb85ed834ceba8c9a16bfbef25deef1efd72fbd0013ade6481f38282232","authorization_id":"cve-corpus-local-lab","identity_binding":"operator_declared_baseline_plus_receipt_bound_mvm_trial","boundary_evidence_certifying":false,"security_conclusion":"EXPLOITABLE_MVM_BENEFIT_NOT_PROVEN","headline":"Your app is exploitable; MVM protection is not yet proven","boundary_claim":false,"proof_id":"cve-2025-55182-tier1","trial_id":"cve-2025-55182-local","proof_binding_digest":"sha256:043e1ba3f25956a0f33b075178693ffbe9c10e656a5b87b422a0f9cc326f49c5","observation_digest":"sha256:8cdddc5f40eab8027fea5cd976acda99e6e40e11320cc3b962319cf45dad20be","baseline":{"label":"react-server-dom-webpack-19.0.0-without-mvm","base_url":"http://127.0.0.1:52263","artifact_digest":"sha256:0e43ccb85ed834ceba8c9a16bfbef25deef1efd72fbd0013ade6481f38282232","mvm_id":null},"mvm":{"label":"react-server-dom-webpack-19.0.0-tier1-loopback","base_url":"http://127.0.0.1:52264","artifact_digest":"sha256:0e43ccb85ed834ceba8c9a16bfbef25deef1efd72fbd0013ade6481f38282232","mvm_id":"tier1-non-certifying"},"comparisons":[{"probe_id":"bounded-flight-deserialization-canary","campaign_id":"cve-2025-55182-process-exec","finding_id":"CVE-2025-55182","title":"Flight decoder inherited-property traversal reaches a fixed canary write","risk":"active_bounded","baseline":{"status":200,"response_bytes":32,"response_digest":"sha256:ab57e21f37e37c1b2ce3b6fd9ec1bf1d30ff3a99b98cc41c80bf43d07bd29758","vulnerable_signal":true,"elapsed_ms":124,"error":null},"mvm":{"status":200,"response_bytes":32,"response_digest":"sha256:ab57e21f37e37c1b2ce3b6fd9ec1bf1d30ff3a99b98cc41c80bf43d07bd29758","vulnerable_signal":true,"elapsed_ms":130,"error":null},"delta":"UNCHANGED_VULNERABLE","boundary_outcome":"INCONCLUSIVE","boundary_evidence_refs":["mvm:proof:sha256:043e1ba3f25956a0f33b075178693ffbe9c10e656a5b87b422a0f9cc326f49c5","mvm:observation:sha256:8cdddc5f40eab8027fea5cd976acda99e6e40e11320cc3b962319cf45dad20be"]}],"limitations":["The baseline exploit was reproduced, but matching certifying PREVENTED or CONTAINED evidence is missing for one or more reproduced exploits.","Baseline artifact equality remains operator-declared; MVM outcomes apply only to the exact campaign, artifact, policy, and evidence references joined here.","Endpoint state and request timing can differ; repeat trials before attributing a delta."]}