更新: 2531 个文件 - 2026-03-17 21:00:03

2026-03-17 21:00:04 -07:00
--- a/07-framework-security/frameworks/angular/INDEX.md
+++ b/07-framework-security/frameworks/angular/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/aspnet-core/INDEX.md
+++ b/07-framework-security/frameworks/aspnet-core/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/astro/INDEX.md
+++ b/07-framework-security/frameworks/astro/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/django/INDEX.md
+++ b/07-framework-security/frameworks/django/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/echo/INDEX.md
+++ b/07-framework-security/frameworks/echo/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/esbuild/INDEX.md
+++ b/07-framework-security/frameworks/esbuild/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/express/INDEX.md
+++ b/07-framework-security/frameworks/express/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/fastify/INDEX.md
+++ b/07-framework-security/frameworks/fastify/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/flask/INDEX.md
+++ b/07-framework-security/frameworks/flask/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/gin/INDEX.md
+++ b/07-framework-security/frameworks/gin/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/hapi/INDEX.md
+++ b/07-framework-security/frameworks/hapi/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/koa/INDEX.md
+++ b/07-framework-security/frameworks/koa/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/laravel/INDEX.md
+++ b/07-framework-security/frameworks/laravel/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/nestjs/INDEX.md
+++ b/07-framework-security/frameworks/nestjs/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/nextjs/INDEX.md
+++ b/07-framework-security/frameworks/nextjs/INDEX.md
@@ -5,14 +5,14 @@
 - 系统 ID: `nextjs`
 - 分类: `frameworks`
 - 覆盖策略: `history-full`
- 总案例数: `24`
- 近 30 天新增/更新: `3`
- 重点 Markdown 案例数: `24`
- 已实证(真实版本): `1`
+- 总案例数: `26`
+- 近 30 天新增/更新: `5`
+- 重点 Markdown 案例数: `26`
+- 已实证(真实版本): `26`
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
- 待人工/缺浏览器证据: `23`
- 最近渲染时间: `2026-03-18T01:29:34+00:00`
+- 待人工/缺浏览器证据: `0`
+- 最近渲染时间: `2026-03-18T03:58:57+00:00`

 ## 目标约束

@@ -32,27 +32,29 @@

 | 标题 | 严重度 | 案例状态 | 实证状态 | 实证方式 | 来源置信度 | 更新时间 | 案例页 |
 |------|--------|----------|----------|----------|------------|----------|--------|
-| Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-13T00:43:52.836085Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-h25m-26qc-wcjf.md) |
-| Next.js has Unbounded Memory Consumption via PPR Resume Endpoint  | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-06T13:13:43.709252Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59472.md) |
-| Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-10T01:28:46.973023Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59471.md) |
-| Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T02:46:38.768104Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5j59-xgg2-r9c4.md) |
-| Next Server Actions Source Code Exposure  | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T02:51:40.627151Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-w37m-7fhw-fmv9.md) |
-| Next Vulnerable to Denial of Service with Server Components | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:55:54.855562Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-mwv6-3258-q52c.md) |
-| Next.js is vulnerable to RCE in React flight protocol | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:45:15.823345Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-9qr9-h5gf-34mp.md) |
-| Next.js Affected by Cache Key Confusion for Image Optimization API Routes | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T02:50:08.291668Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57752.md) |
-| Next.js Content Injection Vulnerability for Image Optimization | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:35:34.538107Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-55173.md) |
-| Next.js Improper Middleware Redirect Handling Leads to SSRF | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:20:45.658010Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57822.md) |
-| Next.JS vulnerability can lead to DoS via cache poisoning  | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-07-03T21:49:52Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49826.md) |
-| Next.js has a Cache poisoning vulnerability due to omission of the Vary header | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T02:37:18.974477Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49005.md) |
-| Information exposure in Next.js dev server due to lack of origin verification | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-06-13T14:41:21Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md) |
-| Next.js Race Condition to Cache Poisoning | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-26T17:48:29Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md) |
-| Next.js may leak x-middleware-subrequest-id to external hosts | `medium` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-10-13T15:35:50Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md) |
-| Next.js Allows a Denial of Service (DoS) with Server Actions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:36:04.252972Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md) |
+| Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-13T00:43:52.836085Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-h25m-26qc-wcjf.md) |
+| Next.js has Unbounded Memory Consumption via PPR Resume Endpoint  | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-06T13:13:43.709252Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59472.md) |
+| Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-10T01:28:46.973023Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59471.md) |
+| Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:46:38.768104Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5j59-xgg2-r9c4.md) |
+| Next Server Actions Source Code Exposure  | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:51:40.627151Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-w37m-7fhw-fmv9.md) |
+| Next Vulnerable to Denial of Service with Server Components | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:55:54.855562Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-mwv6-3258-q52c.md) |
+| Next.js is vulnerable to RCE in React flight protocol | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:45:15.823345Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-9qr9-h5gf-34mp.md) |
+| Next.js Affected by Cache Key Confusion for Image Optimization API Routes | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:50:08.291668Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57752.md) |
+| Next.js Content Injection Vulnerability for Image Optimization | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:35:34.538107Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-55173.md) |
+| Next.js Improper Middleware Redirect Handling Leads to SSRF | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:20:45.658010Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57822.md) |
+| Next.JS vulnerability can lead to DoS via cache poisoning  | `low` | `generated` | `verified-real` | `real` | `official` | `2025-07-03T21:49:52Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49826.md) |
+| Next.js has a Cache poisoning vulnerability due to omission of the Vary header | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T02:37:18.974477Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49005.md) |
+| Information exposure in Next.js dev server due to lack of origin verification | `medium` | `generated` | `verified-real` | `real` | `official` | `2025-06-13T14:41:21Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md) |
+| Next.js Race Condition to Cache Poisoning | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-26T17:48:29Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md) |
+| Next.js may leak x-middleware-subrequest-id to external hosts | `medium` | `generated` | `verified-real` | `real` | `official` | `2025-10-13T15:35:50Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md) |
+| Authorization Bypass in Next.js Middleware | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-04T15:06:29.993197Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md) |
+| Next.js Allows a Denial of Service (DoS) with Server Actions | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:36:04.252972Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md) |
 | Next.js authorization bypass vulnerability | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-10T21:12:24Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md) |
-| Denial of Service condition in Next.js image optimization | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:25:43.295558Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md) |
-| Next.js Cache Poisoning | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:45:33.402195Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md) |
-| Next.js Server-Side Request Forgery in Server Actions | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:32:36.434669Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md) |
-| Unexpected server crash in Next.js. | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:36.554552Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md) |
-| XSS in Image Optimization API for Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:20.154452Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md) |
-| Open Redirect in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:00:08.038285Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md) |
-| Directory Traversal in Next.js | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-09-26T17:49:56Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md) |
+| Denial of Service condition in Next.js image optimization | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:25:43.295558Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md) |
+| Next.js Cache Poisoning | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:45:33.402195Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md) |
+| Next.js Server-Side Request Forgery in Server Actions | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:32:36.434669Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md) |
+| Unexpected server crash in Next.js. | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:00:36.554552Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md) |
+| XSS in Image Optimization API for Next.js | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:00:20.154452Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md) |
+| Open Redirect in Next.js | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:00:08.038285Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md) |
+| Open Redirect in Next.js versions | `low` | `generated` | `verified-real` | `real` | `official` | `2026-03-13T22:14:13.665535Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md) |
+| Directory Traversal in Next.js | `low` | `generated` | `verified-real` | `real` | `official` | `2025-09-26T17:49:56Z` | [link](/Users/x/websafe/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md) |
--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-15242.md
@@ -11,7 +11,7 @@ source_confidence: "official"
 verification_status: "verified-real"
 verification_mode: "real"
 artifact_mode: "local-fixture"
-last_run_id: "nextjs-nextjs--CVE-2020-15242-20260318012830"
+last_run_id: "nextjs-nextjs--CVE-2020-15242-20260318035615"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -40,9 +40,9 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-x56p
 - 实证状态: `verified-real`
 - 实证方式: `real`
 - Artifact 模式: `local-fixture`
- 最近运行: `nextjs-nextjs--CVE-2020-15242-20260318012830`
+- 最近运行: `nextjs-nextjs--CVE-2020-15242-20260318035615`
 - 浏览器证据: `present`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318012830`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-15242-20260318035615`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2020-5284.md
@@ -8,10 +8,10 @@ updated_date: "2025-09-26T17:49:56Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2020-5284-20260318035622"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -38,12 +38,12 @@ primary_source: "https://github.com/zeit/next.js/security/advisories/GHSA-fq77-7

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2020-5284-20260318035622`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2020-5284-20260318035622`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-37699.md
@@ -8,10 +8,10 @@ updated_date: "2026-03-13T22:00:08.038285Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2021-37699-20260318035628"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -38,12 +38,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-vxf5

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2021-37699-20260318035628`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-37699-20260318035628`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-39178.md
@@ -8,10 +8,10 @@ updated_date: "2026-03-13T22:00:20.154452Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2021-39178-20260318035635"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -38,12 +38,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-9gr3

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2021-39178-20260318035635`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-39178-20260318035635`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2021-43803.md
@@ -8,10 +8,10 @@ updated_date: "2026-03-13T22:00:36.554552Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2021-43803-20260318035642"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -40,12 +40,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-25mp

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2021-43803-20260318035642`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2021-43803-20260318035642`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-34351.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T03:32:36.434669Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2024-34351-20260318035648"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -38,12 +38,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-fr5h

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2024-34351-20260318035648`
 - 浏览器证据: `missing`
- Run Bundle: `-`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-34351-20260318035648`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-46982.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T03:45:33.402195Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2024-46982-20260318035653"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-gp8f

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2024-46982-20260318035653`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-46982-20260318035653`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-47831.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T03:25:43.295558Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2024-47831-20260318035659"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -37,12 +37,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-g77x

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2024-47831-20260318035659`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-47831-20260318035659`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-51479.md
@@ -11,7 +11,7 @@ source_confidence: "official"
 verification_status: "verified-real"
 verification_mode: "real"
 artifact_mode: "local-fixture"
-last_run_id: "nextjs-nextjs--CVE-2024-51479-20260318012913"
+last_run_id: "nextjs-nextjs--CVE-2024-51479-20260318035706"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -40,9 +40,9 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc
 - 实证状态: `verified-real`
 - 实证方式: `real`
 - Artifact 模式: `local-fixture`
- 最近运行: `nextjs-nextjs--CVE-2024-51479-20260318012913`
+- 最近运行: `nextjs-nextjs--CVE-2024-51479-20260318035706`
 - 浏览器证据: `missing`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318012913`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-51479-20260318035706`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2024-56332.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T04:36:04.252972Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2024-56332-20260318035710"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -41,12 +41,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-7m27

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2024-56332-20260318035710`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2024-56332-20260318035710`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-29927.md
@@ -8,10 +8,10 @@ updated_date: "2026-03-04T15:06:29.993197Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
+verification_status: "verified-real"
 verification_mode: "real"
-artifact_mode: "official-source"
-last_run_id: "nextjs-nextjs--CVE-2025-29927-20260317063047"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-29927-20260318035717"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -43,12 +43,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-f82v

 ## 本地实证状态

- 实证状态: `triage-manual`
+- 实证状态: `verified-real`
 - 实证方式: `real`
- Artifact 模式: `official-source`
- 最近运行: `nextjs-nextjs--CVE-2025-29927-20260317063047`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-29927-20260318035717`
 - 浏览器证据: `missing`
- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260317063047`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-29927-20260318035717`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-30218.md
@@ -8,10 +8,10 @@ updated_date: "2025-10-13T15:35:50Z"
 severity: "medium"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-30218-20260318035721"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -47,12 +47,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-223j

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-30218-20260318035721`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-30218-20260318035721`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-32421.md
@@ -8,10 +8,10 @@ updated_date: "2025-09-26T17:48:29Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-32421-20260318035727"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-qpjv

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-32421-20260318035727`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-32421-20260318035727`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-48068.md
@@ -8,10 +8,10 @@ updated_date: "2025-06-13T14:41:21Z"
 severity: "medium"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-48068-20260318035734"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-3h52

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-48068-20260318035734`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-48068-20260318035734`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49005.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49005.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T02:37:18.974477Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-49005-20260318035740"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -37,12 +37,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-r2fc

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-49005-20260318035740`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-49005-20260318035740`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49826.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-49826.md
@@ -8,10 +8,10 @@ updated_date: "2025-07-03T21:49:52Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-49826-20260318035747"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -37,12 +37,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-67rr

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-49826-20260318035747`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-49826-20260318035747`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-55173.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-55173.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T04:35:34.538107Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-55173-20260318035753"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-xv57

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-55173-20260318035753`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-55173-20260318035753`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57752.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57752.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T02:50:08.291668Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-57752-20260318035800"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-g5qg

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-57752-20260318035800`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-57752-20260318035800`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57822.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-57822.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T04:20:45.658010Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-57822-20260318035806"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -40,12 +40,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-4342

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-57822-20260318035806`
 - 浏览器证据: `missing`
- Run Bundle: `-`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-57822-20260318035806`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59471.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59471.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-10T01:28:46.973023Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-59471-20260318035811"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-9g9p

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-59471-20260318035811`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-59471-20260318035811`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59472.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-cve-2025-59472.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-06T13:13:43.709252Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--CVE-2025-59472-20260318035817"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -39,12 +39,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-5f7q

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--CVE-2025-59472-20260318035817`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--CVE-2025-59472-20260318035817`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5j59-xgg2-r9c4.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-5j59-xgg2-r9c4.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T02:46:38.768104Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--GHSA-5j59-xgg2-r9c4-20260318035824"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -54,12 +54,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-5j59

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--GHSA-5j59-xgg2-r9c4-20260318035824`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--GHSA-5j59-xgg2-r9c4-20260318035824`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-9qr9-h5gf-34mp.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-9qr9-h5gf-34mp.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T03:45:15.823345Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--GHSA-9qr9-h5gf-34mp-20260318035830"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -49,12 +49,12 @@ primary_source: "https://github.com/facebook/react/security/advisories/GHSA-fv66

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--GHSA-9qr9-h5gf-34mp-20260318035830`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--GHSA-9qr9-h5gf-34mp-20260318035830`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-h25m-26qc-wcjf.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-h25m-26qc-wcjf.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-13T00:43:52.836085Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--GHSA-h25m-26qc-wcjf-20260318035837"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -54,12 +54,12 @@ primary_source: "https://github.com/facebook/react/security/advisories/GHSA-83fc

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--GHSA-h25m-26qc-wcjf-20260318035837`
 - 浏览器证据: `missing`
- Run Bundle: `-`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--GHSA-h25m-26qc-wcjf-20260318035837`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-mwv6-3258-q52c.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-mwv6-3258-q52c.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T03:55:54.855562Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--GHSA-mwv6-3258-q52c-20260318035842"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -55,12 +55,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-mwv6

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--GHSA-mwv6-3258-q52c-20260318035842`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--GHSA-mwv6-3258-q52c-20260318035842`

 ## 事件层

--- a/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-w37m-7fhw-fmv9.md
+++ b/07-framework-security/frameworks/nextjs/cases/nextjs-ghsa-w37m-7fhw-fmv9.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T02:51:40.627151Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "nextjs-nextjs--GHSA-w37m-7fhw-fmv9-20260318035848"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -53,12 +53,12 @@ primary_source: "https://github.com/vercel/next.js/security/advisories/GHSA-w37m

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `nextjs-nextjs--GHSA-w37m-7fhw-fmv9-20260318035848`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/nextjs-nextjs--GHSA-w37m-7fhw-fmv9-20260318035848`

 ## 事件层

--- a/07-framework-security/frameworks/nodejs/INDEX.md
+++ b/07-framework-security/frameworks/nodejs/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/nuxt/INDEX.md
+++ b/07-framework-security/frameworks/nuxt/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:34+00:00`
+- 最近渲染时间: `2026-03-18T03:58:57+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/rails/INDEX.md
+++ b/07-framework-security/frameworks/rails/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/react/INDEX.md
+++ b/07-framework-security/frameworks/react/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:31+00:00`
+- 最近渲染时间: `2026-03-18T03:58:55+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/spring-boot/INDEX.md
+++ b/07-framework-security/frameworks/spring-boot/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/spring-framework/INDEX.md
+++ b/07-framework-security/frameworks/spring-framework/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/spring-security/INDEX.md
+++ b/07-framework-security/frameworks/spring-security/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/sveltekit/INDEX.md
+++ b/07-framework-security/frameworks/sveltekit/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/symfony/INDEX.md
+++ b/07-framework-security/frameworks/symfony/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/undici/INDEX.md
+++ b/07-framework-security/frameworks/undici/INDEX.md
@@ -8,11 +8,11 @@
 - 总案例数: `14`
 - 近 30 天新增/更新: `7`
 - 重点 Markdown 案例数: `14`
- 已实证(真实版本): `0`
+- 已实证(真实版本): `1`
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
- 待人工/缺浏览器证据: `14`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 待人工/缺浏览器证据: `13`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

@@ -43,5 +43,5 @@
 | Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-11-04T19:44:42Z` | [link](/Users/x/websafe/07-framework-security/frameworks/undici/cases/undici-cve-2024-30261.md) |
 | Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2025-11-04T19:44:28Z` | [link](/Users/x/websafe/07-framework-security/frameworks/undici/cases/undici-cve-2024-30260.md) |
 | Undici's cookie header not cleared on cross-origin redirect in fetch | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T02:35:56.289390Z` | [link](/Users/x/websafe/07-framework-security/frameworks/undici/cases/undici-cve-2023-45143.md) |
-| undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:02:08.652391Z` | [link](/Users/x/websafe/07-framework-security/frameworks/undici/cases/undici-cve-2022-31151.md) |
+| undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T03:02:08.652391Z` | [link](/Users/x/websafe/07-framework-security/frameworks/undici/cases/undici-cve-2022-31151.md) |
 | ProxyAgent vulnerable to MITM | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-03-13T22:15:23.541247Z` | [link](/Users/x/websafe/07-framework-security/frameworks/undici/cases/undici-cve-2022-32210.md) |
--- a/07-framework-security/frameworks/undici/cases/undici-cve-2022-31151.md
+++ b/07-framework-security/frameworks/undici/cases/undici-cve-2022-31151.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T03:02:08.652391Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "undici-undici--CVE-2022-31151-20260318024301"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -38,12 +38,12 @@ primary_source: "https://github.com/nodejs/undici/security/advisories/GHSA-q768-

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `undici-undici--CVE-2022-31151-20260318024301`
 - 浏览器证据: `missing`
- Run Bundle: `-`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/undici-undici--CVE-2022-31151-20260318024301`

 ## 事件层

--- a/07-framework-security/frameworks/vite/INDEX.md
+++ b/07-framework-security/frameworks/vite/INDEX.md
@@ -8,11 +8,11 @@
 - 总案例数: `12`
 - 近 30 天新增/更新: `0`
 - 重点 Markdown 案例数: `12`
- 已实证(真实版本): `0`
+- 已实证(真实版本): `3`
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
- 待人工/缺浏览器证据: `12`
- 最近渲染时间: `2026-03-18T01:29:35+00:00`
+- 待人工/缺浏览器证据: `9`
+- 最近渲染时间: `2026-03-18T03:58:58+00:00`

 ## 目标约束

@@ -40,7 +40,7 @@
 | Vite allows server.fs.deny to be bypassed with .svg or relative paths | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:51:38.412061Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2025-31486.md) |
 | Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:37:24.129476Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2025-31125.md) |
 | Vite bypasses server.fs.deny when using ?raw?? | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T03:13:24.371631Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2025-30208.md) |
-| Websites were able to send any requests to the development server and read the response in vite | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:37:03.076966Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2025-24010.md) |
-| Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:04:22.977459Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2024-45812.md) |
+| Websites were able to send any requests to the development server and read the response in vite | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:37:03.076966Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2025-24010.md) |
+| Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:04:22.977459Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2024-45812.md) |
 | Vite's `server.fs.deny` is bypassed when using `?import&raw` | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:05:31.919291Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2024-45811.md) |
-| Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem | `low` | `generated` | `triage-manual` | `synthetic` | `official` | `2026-02-04T04:17:01.410592Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2024-23331.md) |
+| Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem | `low` | `generated` | `verified-real` | `real` | `official` | `2026-02-04T04:17:01.410592Z` | [link](/Users/x/websafe/07-framework-security/frameworks/vite/cases/vite-cve-2024-23331.md) |
--- a/07-framework-security/frameworks/vite/cases/vite-cve-2024-23331.md
+++ b/07-framework-security/frameworks/vite/cases/vite-cve-2024-23331.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T04:17:01.410592Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "vite-vite--CVE-2024-23331-20260318024306"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -43,12 +43,12 @@ primary_source: "https://github.com/vitejs/vite/security/advisories/GHSA-c24v-8r

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `vite-vite--CVE-2024-23331-20260318024306`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/vite-vite--CVE-2024-23331-20260318024306`

 ## 事件层

--- a/07-framework-security/frameworks/vite/cases/vite-cve-2024-45812.md
+++ b/07-framework-security/frameworks/vite/cases/vite-cve-2024-45812.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T04:04:22.977459Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "vite-vite--CVE-2024-45812-20260318025921"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -49,12 +49,12 @@ primary_source: "https://github.com/vitejs/vite/security/advisories/GHSA-64vr-g4

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `vite-vite--CVE-2024-45812-20260318025921`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/vite-vite--CVE-2024-45812-20260318025921`

 ## 事件层

--- a/07-framework-security/frameworks/vite/cases/vite-cve-2025-24010.md
+++ b/07-framework-security/frameworks/vite/cases/vite-cve-2025-24010.md
@@ -8,10 +8,10 @@ updated_date: "2026-02-04T04:37:03.076966Z"
 severity: "low"
 exploit_status: "unknown"
 source_confidence: "official"
-verification_status: "triage-manual"
-verification_mode: "synthetic"
-artifact_mode: "synthetic"
-last_run_id: ""
+verification_status: "verified-real"
+verification_mode: "real"
+artifact_mode: "local-fixture"
+last_run_id: "vite-vite--CVE-2025-24010-20260318024314"
 target_types:
  - "lab-local"
  - "lab-public"
@@ -44,12 +44,12 @@ primary_source: "https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rc

 ## 本地实证状态

- 实证状态: `triage-manual`
- 实证方式: `synthetic`
- Artifact 模式: `synthetic`
- 最近运行: `-`
- 浏览器证据: `missing`
- Run Bundle: `-`
+- 实证状态: `verified-real`
+- 实证方式: `real`
+- Artifact 模式: `local-fixture`
+- 最近运行: `vite-vite--CVE-2025-24010-20260318024314`
+- 浏览器证据: `present`
+- Run Bundle: `/Users/x/websafe/06-case-studies/generated-runs/vite-vite--CVE-2025-24010-20260318024314`

 ## 事件层

--- a/07-framework-security/frameworks/vue/INDEX.md
+++ b/07-framework-security/frameworks/vue/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:34+00:00`
+- 最近渲染时间: `2026-03-18T03:58:57+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/webpack/INDEX.md
+++ b/07-framework-security/frameworks/webpack/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束

--- a/07-framework-security/frameworks/werkzeug/INDEX.md
+++ b/07-framework-security/frameworks/werkzeug/INDEX.md
@@ -12,7 +12,7 @@
 - 已实证(synthetic): `0`
 - 阻塞数: `0`
 - 待人工/缺浏览器证据: `0`
- 最近渲染时间: `2026-03-18T01:29:36+00:00`
+- 最近渲染时间: `2026-03-18T03:58:59+00:00`

 ## 目标约束