Add task: ecvebench-jwt-001

[devin-ai-integration]

Summary

Adds curated benchmark task ecvebench-jwt-001 for GHSA-h2fg-54x9-5qhq (CVE-2020-26521).

Advisory: Nil pointer dereference in NATS JWT library (nats-io/jwt) — a malicious Account can craft a User JWT with null import/export entries that cause panic during validation, leading to DoS of nats-server.

Details:

• Repo: nats-io/jwt
• Ecosystem: Go
• Vulnerability class: null-deref (CWE-476)
• CVSS: 7.5
• Patch: PR nats-io/jwt#107 (commit e74ae88)
• Pre-patch commit: 8527407e521556b9f0253318912cc03fd84a5bbd
• Files affected: exports.go, imports.go (Validate methods)
• Noisy patch: No (2 source files changed)

Review & Testing Checklist for Human

• Verify commit field is the pre-patch SHA (8527407...) and post_patch_commit is the patch SHA (e74ae88...)
• Confirm L1 hint does not leak file paths, function names, or vulnerability type
• Confirm L2 hint does not leak file paths or function names
• Confirm L3 hints are appropriately more specific than L1/L2 without exact file/function names
• Validate that exports.go and imports.go exist at the pre-patch commit in nats-io/jwt

Notes

• The existing task ecvebench-nats-server-001 (GHSA-hmm9-r2m2-qg9w) covers a related but distinct advisory targeting nats-io/nats-server. This task targets the upstream nats-io/jwt library directly.
• Locations derived from patch diff — the fix adds nil checks to 4 Validate methods across 2 files.

Link to Devin session: https://la-hacks-codebreaker.devinenterprise.com/sessions/5cc8a39d19fe4d34bc9c9f28aabad433
Requested by: @jotalis

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

⚙️ Control Options:

• Disable automatic comment and CI monitoring