[chaksaray]

Closes #339.

Both records cited only the cfgaudit crosswalk gap and their own registry entry, which does not meet CONTRIBUTING.md's primary-source rule. Both also credited the maintainer and bawbel.io, against researcher-process.md.

• 00064: adds GHSA-ph6w-f82w-28w6 and CVE-2025-59536 (GHSA-4fgq-fpq9-mr3g), plus Check Point Research's "Caught in the Hook" report. researcher becomes "Check Point Research (Aviv Donenfeld, Oded Vanunu)", and researcher_url becomes the report.
• 00063: adds CVE-2026-33068 (GHSA-mmgp-wc2j-qcv7). researcher becomes "hackerone.com/cantina_xyz", and researcher_url is removed.
• On both: the cfgaudit reference is kept, last_updated is bumped, and one aivss.notes sentence per record states the sources and the caveat.

Not changed: scores, mappings, fingerprints, mutation_count, published.

Left for separate issues: the corpus-wide researcher pattern (57 of 87 records credit the maintainer, 58 use bawbel.io), and the owasp_asi, mitre_atlas and nist_ai_rmf keys, which are absent (not null) on both records.

Sources read, with credit lines as written

Source	Published	Credit line (verbatim)
GHSA-ph6w-f82w-28w6, "Arbitrary Code Execution Due to Insufficient Startup Warning", CWE-94, patched v1.0.87, no CVE	2025-09-02	"Thank you to https://hackerone.com/avivdon for reporting this issue!"
GHSA-4fgq-fpq9-mr3g, CVE-2025-59536, "Command execution prior to Claude Code startup trust dialog", CWE-94, patched v1.0.111	2025-10-03	"Thank you to https://hackerone.com/avivdon for reporting this issue!"
Check Point Research, "Caught in the Hook"	2026-02-25	"By Aviv Donenfeld and Oded Vanunu"
GHSA-mmgp-wc2j-qcv7, CVE-2026-33068, "Workspace Trust Dialog Bypass via Repo-Controlled Settings File", CWE-807, patched 2.1.53	2026-03-18	"Thank you to hackerone.com/cantina_xyz for reporting this issue."

The existing cfgaudit reference (#67) still resolves and is kept.

Where this differs from the plan in the original task brief

The brief was drafted from secondary coverage. Reading the primary sources changed four things:

1. Credit for 00064. The advisory credits hackerone.com/avivdon, not "Check Point Research". Check Point's own report supports crediting Check Point Research: it is by Aviv Donenfeld and Oded Vanunu, and its timeline says "Check Point Research reported" both findings. So researcher names the organization and both authors from the first-party report. I do not assert that the HackerOne handle is Aviv Donenfeld.
2. Which advisory is which. By Check Point's timeline, CVE-2025-59536 is the MCP consent bypass ("our command executed immediately upon running claude, before the user could even read the trust dialog"), not the hooks finding. The hooks finding is GHSA-ph6w-f82w-28w6. In that case the hooks ran after the user clicked "Yes, proceed", with no further prompt. That makes GHSA-ph6w the nearest match to 00064's "no confirmation step", so it is cited first. The brief's draft note ("hooks and MCP servers running before the startup trust dialog") would have been inaccurate.
3. researcher_url for 00063. hackerone.com/cantina_xyz returns 404, and I found no first-party Cantina write-up. researcher therefore uses the credit exactly as the advisory gives it, and researcher_url is omitted, as researcher-process.md allows. The handle likely belongs to Cantina (cantina.xyz), but nothing first-party says so. Your call whether to name the firm.
4. Framework keys. These are absent on both records, not null.

Verified

• validate_records.py passes (87 valid; no maintainer-name warning for either record now) and pytest 519 passed.
• check_fixtures.py, check_framework_sources.py --strict --only (both records), check_mutation_thm_trail.py --strict --only (both records) and the confidence ratchet (2 records changed, passes) all pass.
• Edits were made at the text level with the style-preserving helper. A script asserted that json.loads(after) equals the same changes applied to json.loads(before), and that the key order is unchanged. The diff is a handful of lines per record.
• dist/ was rebuilt by scripts/build-records.js and equals records/ for all 87 records. The dist diff touches only the 00063 and 00064 entries and the manifest timestamp.
• All four new URLs return 200. The em-dash count in the diff is 0.

Could not verify

• Whether hackerone.com/avivdon and hackerone.com/cantina_xyz are the people or firms the names suggest. Neither advisory says.

🤖 Generated with Claude Code