{
  "cve": "CVE-2026-108107",
  "repository": "https://github.com/hotspotbilling/phpnuxbill",
  "proposedPlan": "Acquire https://github.com/hotspotbilling/phpnuxbill at the exact affected and fixed revisions identified by the advisory. Build only inside an ephemeral, network-isolated VM. Run a minimal synthetic assertion for the behavior described by CVE-2026-108107, then repeat the identical assertion against the fixed revision. Do not claim reproduction unless the vulnerable result is observed and the evidence bundle records versions, commands, output, and teardown.",
  "isolation": "QEMU/KVM VM; no NIC; no host mounts; 256 MiB; 1 vCPU; 60 second limit",
  "assessment": "source-change preflight only; never sufficient for a reproduced-locally label; isolated preflight completed",
  "commit": null,
  "createdAt": "2026-10-17T03:03:18.523Z"
}