fix: rebuild FastMCP OpenAPI SSRF vulnerability chains

[Sam-Hui-dot]

Summary

Related to #7.

This PR rebuilds the FastMCP OpenAPI SSRF/path-traversal chains associated with GHSA-VV7Q-7JX5-F767 / CVE-2026-32871.

It updates the two entries directly supported by the upstream security fix:

• entry-00391
• entry-00394

It also reviews the related resource-path entries, entry-00392 and entry-00395, and documents their remaining evidence gaps in manual_review.csv.

Changes

entry-00391

• Moves critical_operation from the _build_url declaration to the actual unencoded path-parameter substitution.
• Removes the unrelated logger node.
• Rebuilds the trace from flat_args through parameter mapping, substitution, urljoin(), and httpx.Request.
• Marks the entry as verified after exact source and fix-commit validation.

entry-00394

• Moves entry_point to the public OpenAPITool.run(arguments) boundary.
• Moves critical_operation from the generic request-send operation to the vulnerable URL substitution.
• Reconstructs the complete cross-module chain from external tool arguments to the authenticated HTTP request.

Supporting artifacts

• Adds a detailed rebuild report.
• Adds a field-level diff CSV.
• Adds manual_review.csv for related entries not directly covered by the upstream fix.
• Adds a reproducible apply and upstream-validation script.
• Adds focused regression tests.
• Synchronizes README audit statistics to 394 / 408 verified entries and 178 / 184 verified advisories.

Evidence

• Vulnerable commit: c861862aededc7294cea5634d77e6926444ca101
• Fix commit: 40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71
• Advisory: GHSA-VV7Q-7JX5-F767
• CVE: CVE-2026-32871

The fix commit is a direct child of the vulnerable commit. It replaces the unencoded str(param_value) path substitution with URL encoding, directly supporting the selected critical_operation.

Validation

• 19 annotated node occurrences matched exactly against the pinned vulnerable source.
• The vulnerable-to-fix parent relationship and patch semantics were validated.
• 7 focused unit tests passed.
• Python AST validation passed.
• JSONL and CSV parsing passed.
• git diff --check passed.

Commands used:

python3 scripts/apply_issue7_fastmcp_openapi_patch.py --check-upstream
python3 -m unittest discover -s tests -p "test_issue7_fastmcp_openapi.py" -v
git diff --check

Manual review

The upstream fix directly validates the RequestDirector path used by entry-00391 and entry-00394.

Although entry-00392 and entry-00395 contain a similar substitution in components.py, that path is not covered by the fix or its regression tests. Their current annotations are therefore retained, with the remaining evidence gap and candidate changes documented in manual_review.csv.