✳ Practice range / SBOM prioritization / 10 min

Defer with a date, or patch for a reason

ShopCart’s synthetic SBOM shows a transitive finding that is not a real CVE and is not on KEV. Write the deferral, the patch, or the compensating control with a review date.

YOUR CASE FILE

SYNTHETIC TABLETOP / SBOM-042
ShopCart is fiction. Maya is triaging a component, not a live incident.

Direct: shopcart-api@2.4.0
Transitive: leftpad-lite@0.9.1 (fictional package)
Finding-ID: FINDING-SYNTH-2026-0042
Teaching alias: CVE-SYNTH-2026-0042
This alias is not an NVD record and not a KEV listing.
Scanner label (simulated): 7.5 High
KEV search: no results
Exposure: offline month-end batch only; not internet-facing; no privileged container
Business: freeze starts in two days; the fix is a major version bump

Ladder: inventory → exploitation evidence → exposure → business.

Download the synthetic case ↓

SIMULATEDCycloneDX-like SBOM excerpt

Inventory only · shopcart-api pulls leftpad-lite

Document: ShopCart fiction · not a release SBOM
Component: shopcart-api 2.4.0Direct
Depends on: leftpad-lite 0.9.1Transitive
What this proves: The component was listedNot a fix

Annotation: an SBOM is inventory evidence. Owning this snippet does not patch leftpad-lite or close the finding.

SIMULATEDSimulated scanner card

FINDING-SYNTH-2026-0042

Finding-ID: FINDING-SYNTH-2026-0042
Teaching alias: CVE-SYNTH-2026-0042Not in NVD or KEV
Scanner label: 7.5 High (simulated)Not the priority
Package: leftpad-lite@0.9.1 (fiction)

Annotation: the High label is a teaching input. Do not treat CVE-SYNTH-2026-0042 as a real identifier or as proof of exploitability.

SIMULATEDSimulated KEV search

Catalog query returns nothing

Catalog: Teaching stand-in, not CISA’s site
Query: CVE-SYNTH-2026-0042
Results: No matching entriesEmpty
How to read it: Not listed. That is an input.Not “safe forever”

Annotation: CISA KEV is an input to priority for real CVE records. This search is empty because the alias is synthetic. Absence is not a permanent close.

Decision record. A deferral without a date is not a decision.
Ladder step	What you can say	Your note
Inventory	Is it in a build ShopCart ships?
Exploitation evidence	KEV or other in-the-wild evidence?
Exposure	Who can reach this code path?
Business	Freeze, data, change window?
Decision	Defer, patch, or compensate — plus owner and date

Your answers stay in this browser. This exercise uses fictional data and makes no changes to any system.

Step 1 of 3

The SBOM excerpt lists leftpad-lite under shopcart-api. What has Maya established?

CASE REFLECTION

Keep the reasoning.

first decisions matched the scenario’s best-supported answer.

Confirm the component, say what exploitation evidence you do and do not have, name the exposure, then let the calendar force a dated decision. High on a synthetic card is not a reason to break the freeze or to forget the row.

One defensible record for FINDING-SYNTH-2026-0042. Patch or compensate could win on a different exposure.
Step	Recorded fact	Effect on the call
Inventory	SBOM lists leftpad-lite under shopcart-api	Confirmed present. The file is not the mitigation.
Exploitation evidence	Alias not on KEV; no other in-the-wild evidence in hand	Do not invent a real CVE. Do not close the row forever.
Exposure	Offline batch only; not internet-facing; no privileged container	Low reach. Say so explicitly.
Business	Freeze in two days; fix is a major bump	Emergency change is not justified by the High label alone.
Decision	Defer the bump until the first business day after the freeze. Devon owns it. Deny egress from the job except the known batch destination. Watch real OSV and NVD feeds for the real component, not this alias.	Date, owner, and compensating control travel with the deferral.

Another case ↗