Add task: ecvebench-scratch-svg-renderer-001

benchmark/data/tasks/ecvebench-scratch-svg-renderer-001.json

@@ -0,0 +1,39 @@
+{
+  "task_id": "ecvebench-scratch-svg-renderer-001",
+  "ghsa_id": "GHSA-j977-g5vj-j27g",
+  "codebase": {
+    "repo": "https://github.com/scratchfoundation/scratch-svg-renderer",
+    "language": "javascript",
+    "ecosystem": "npm",
+    "commit": "5e415baeda9e94c3747721e2a0860b2234f617f4"
+  },
+  "hints": {
+    "L0": null,
+    "L1": {
+      "area": "SVG content processing and rendering pipeline"
+    },
+    "L2": {
+      "description": "A cross-site scripting vulnerability exists where user-provided SVG content is loaded and inserted into the document DOM without proper sanitization, allowing arbitrary elements to be injected."
+    },
+    "L3": {
+      "area": "SVG string loading and DOM measurement logic",
+      "description": "A cross-site scripting vulnerability exists where user-provided SVG content is parsed and appended to the document body for bounding box measurement without sanitization, allowing arbitrary elements to be injected into the DOM."
+    }
+  },
+  "ground_truth": {
+    "vulnerable": true,
+    "vuln_class": "xss",
+    "cvss": 9.7,
+    "reason": "The SVG string loading function does not sanitize input, and the DOM measurement routine appends the unsanitized SVG to the document body, enabling injection of arbitrary elements including scripts.",
+    "locations": [
+      {
+        "file": "src/svg-renderer.js",
+        "function": "_transformMeasurements"
+      },
+      {
+        "file": "src/svg-renderer.js",
+        "function": "loadString"
+      }
+    ]
+  }
+}

benchmark/internal/metadata/GHSA-j977-g5vj-j27g.json

@@ -0,0 +1,8 @@
+{
+  "ghsa_id": "GHSA-j977-g5vj-j27g",
+  "post_patch_commit": "9ebf57588aa596c4fa3bb64209e10ade395aee90",
+  "noisy_patch": false,
+  "curation_notes": "Primary location derived from the patch diff: the fix adds DOMPurify sanitization in _transformMeasurements before inserting SVG into the DOM. loadString is the entry point that parses untrusted SVG strings without sanitization. Only 1 non-test source file (src/svg-renderer.js) was changed. No sibling files in src/ perform DOM insertion of SVG content. Vulnerability class xss confirmed — matches CWE-79 and the advisory description of arbitrary element injection via unsanitized SVG.",
+  "dataset_version": "0.1.0",
+  "snapshot_date": "2026-04-26"
+}