CVE-2025-48951 version start could be >=8.0.0-BETA1

[prabhu]

I am working on a couple of projects to replicate CVEs using data-flows.

For CVE-2025-48951, the query I came up with is to look for unserialize sink calls that begin from a cookie parameter.

atom.method("unserialize").callIn.argument.df(atom.method.fullName("(?i).*cookie.*").parameter).t

Chennai is reporting the same vulnerable flow in 8.0.0-BETA1 as well, although there is just one. In BETA3, there are three such flows, one of which could have been used by the security researcher to arrive at the start version.

8.0.0-BETA3

8.0.0-BETA1

I checked 7.9.2 which didn't include the problematic unserialize sink.

Kindly review and update the CVE record if this observation turns out to be valid.