{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:KVY3AO62BTU645ISYPAQGAJMFZ","short_pith_number":"pith:KVY3AO62","canonical_record":{"source":{"id":"2505.20186","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T16:29:21Z","cross_cats_sorted":[],"title_canon_sha256":"3b4cdbe1683cc8f6ede4958871e2be05310bac5bf55379b30436b90f0c655028","abstract_canon_sha256":"2010206ac4a6b1eb8f8419c91b20c627a2f6f7ad5ff381379c388d18467c5afb"},"schema_version":"1.0"},"canonical_sha256":"5571b03bda0ce9ee7512c3c103012c2e56ea1c3ed41457b7f3188a43fb0d389d","source":{"kind":"arxiv","id":"2505.20186","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.20186","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"arxiv_version","alias_value":"2505.20186v1","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.20186","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"pith_short_12","alias_value":"KVY3AO62BTU6","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"pith_short_16","alias_value":"KVY3AO62BTU645IS","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"pith_short_8","alias_value":"KVY3AO62","created_at":"2026-07-05T11:09:53Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:KVY3AO62BTU645ISYPAQGAJMFZ","target":"record","payload":{"canonical_record":{"source":{"id":"2505.20186","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T16:29:21Z","cross_cats_sorted":[],"title_canon_sha256":"3b4cdbe1683cc8f6ede4958871e2be05310bac5bf55379b30436b90f0c655028","abstract_canon_sha256":"2010206ac4a6b1eb8f8419c91b20c627a2f6f7ad5ff381379c388d18467c5afb"},"schema_version":"1.0"},"canonical_sha256":"5571b03bda0ce9ee7512c3c103012c2e56ea1c3ed41457b7f3188a43fb0d389d","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:09:53.846558Z","signature_b64":"aCS0JhM9Jo+biukzZGYP1NwRSQsj6NTFaLwK5qzt3830OATtQHL4FkMiwzx8+P6eRX8I4QJG18zL/oQ16CACCg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"5571b03bda0ce9ee7512c3c103012c2e56ea1c3ed41457b7f3188a43fb0d389d","last_reissued_at":"2026-07-05T11:09:53.846091Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:09:53.846091Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2505.20186","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:09:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"ZPjX+SCC0ZnPwzTKUI64xq1/3/XA+Pvff8QUk4RBhhCg7rN9wXfC+oSKpP8XARDmRZLfK986KMtUtcWY/Xo5Cw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T05:29:53.005050Z"},"content_sha256":"13c6b2a51efa28115ddd0fea05070d25f9da500e5a2fb0704dadcc50732f111f","schema_version":"1.0","event_id":"sha256:13c6b2a51efa28115ddd0fea05070d25f9da500e5a2fb0704dadcc50732f111f"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:KVY3AO62BTU645ISYPAQGAJMFZ","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Eradicating the Unseen: Detecting, Exploiting, and Remediating a Path Traversal Vulnerability across GitHub","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Hamidreza Hamidi, Jafar Akhoundali, Kristian Rietveld, Olga Gadyatskaya","submitted_at":"2025-05-26T16:29:21Z","abstract_excerpt":"Vulnerabilities in open-source software can cause cascading effects in the modern digital ecosystem. It is especially worrying if these vulnerabilities repeat across many projects, as once the adversaries find one of them, they can scale up the attack very easily. Unfortunately, since developers frequently reuse code from their own or external code resources, some nearly identical vulnerabilities exist across many open-source projects.\n  We conducted a study to examine the prevalence of a particular vulnerable code pattern that enables path traversal attacks (CWE-22) across open-source GitHub "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.20186","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.20186/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:09:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uiyjHCwZPxejN8NhvYtJTWw7deP3KoRXZ/dPGD+IacapNlccsY2oLKeYGm/YksnggvfEB8DoqhlHVK1DhGdKDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-09T05:29:53.005586Z"},"content_sha256":"9a34a9161d88d06ada06130912b46b771e68c154280da8616521a3d672f7e203","schema_version":"1.0","event_id":"sha256:9a34a9161d88d06ada06130912b46b771e68c154280da8616521a3d672f7e203"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/KVY3AO62BTU645ISYPAQGAJMFZ/bundle.json","state_url":"https://pith.science/pith/KVY3AO62BTU645ISYPAQGAJMFZ/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/KVY3AO62BTU645ISYPAQGAJMFZ/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-09T05:29:53Z","links":{"resolver":"https://pith.science/pith/KVY3AO62BTU645ISYPAQGAJMFZ","bundle":"https://pith.science/pith/KVY3AO62BTU645ISYPAQGAJMFZ/bundle.json","state":"https://pith.science/pith/KVY3AO62BTU645ISYPAQGAJMFZ/state.json","well_known_bundle":"https://pith.science/.well-known/pith/KVY3AO62BTU645ISYPAQGAJMFZ/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:KVY3AO62BTU645ISYPAQGAJMFZ","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2010206ac4a6b1eb8f8419c91b20c627a2f6f7ad5ff381379c388d18467c5afb","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T16:29:21Z","title_canon_sha256":"3b4cdbe1683cc8f6ede4958871e2be05310bac5bf55379b30436b90f0c655028"},"schema_version":"1.0","source":{"id":"2505.20186","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2505.20186","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"arxiv_version","alias_value":"2505.20186v1","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.20186","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"pith_short_12","alias_value":"KVY3AO62BTU6","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"pith_short_16","alias_value":"KVY3AO62BTU645IS","created_at":"2026-07-05T11:09:53Z"},{"alias_kind":"pith_short_8","alias_value":"KVY3AO62","created_at":"2026-07-05T11:09:53Z"}],"graph_snapshots":[{"event_id":"sha256:9a34a9161d88d06ada06130912b46b771e68c154280da8616521a3d672f7e203","target":"graph","created_at":"2026-07-05T11:09:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2505.20186/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Vulnerabilities in open-source software can cause cascading effects in the modern digital ecosystem. It is especially worrying if these vulnerabilities repeat across many projects, as once the adversaries find one of them, they can scale up the attack very easily. Unfortunately, since developers frequently reuse code from their own or external code resources, some nearly identical vulnerabilities exist across many open-source projects.\n  We conducted a study to examine the prevalence of a particular vulnerable code pattern that enables path traversal attacks (CWE-22) across open-source GitHub ","authors_text":"Hamidreza Hamidi, Jafar Akhoundali, Kristian Rietveld, Olga Gadyatskaya","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T16:29:21Z","title":"Eradicating the Unseen: Detecting, Exploiting, and Remediating a Path Traversal Vulnerability across GitHub"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.20186","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:13c6b2a51efa28115ddd0fea05070d25f9da500e5a2fb0704dadcc50732f111f","target":"record","created_at":"2026-07-05T11:09:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2010206ac4a6b1eb8f8419c91b20c627a2f6f7ad5ff381379c388d18467c5afb","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2025-05-26T16:29:21Z","title_canon_sha256":"3b4cdbe1683cc8f6ede4958871e2be05310bac5bf55379b30436b90f0c655028"},"schema_version":"1.0","source":{"id":"2505.20186","kind":"arxiv","version":1}},"canonical_sha256":"5571b03bda0ce9ee7512c3c103012c2e56ea1c3ed41457b7f3188a43fb0d389d","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"5571b03bda0ce9ee7512c3c103012c2e56ea1c3ed41457b7f3188a43fb0d389d","first_computed_at":"2026-07-05T11:09:53.846091Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:09:53.846091Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"aCS0JhM9Jo+biukzZGYP1NwRSQsj6NTFaLwK5qzt3830OATtQHL4FkMiwzx8+P6eRX8I4QJG18zL/oQ16CACCg==","signature_status":"signed_v1","signed_at":"2026-07-05T11:09:53.846558Z","signed_message":"canonical_sha256_bytes"},"source_id":"2505.20186","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:13c6b2a51efa28115ddd0fea05070d25f9da500e5a2fb0704dadcc50732f111f","sha256:9a34a9161d88d06ada06130912b46b771e68c154280da8616521a3d672f7e203"],"state_sha256":"ba57bf28cde23269058a49fb862ab687b2dbc1dc7a695186c62ee8fa4ab2e245"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"a8Sfg5jo0rifkYT6EdEeR5hEXxRX960jdgD+0JAxD8R+mvAUcy4Jzu4632xxv7/uVJ1UsMxL/9wKrT8kbKqPBg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-09T05:29:53.011544Z","bundle_sha256":"d0f229ffe835ebed323b68133df0e2ab61c166673cfce98f7919b072ed92af6a"}}