# FIXTURE_ONLY test table: want_rc|args|expected substring (shared by the bash and Pester tests)
0|--xo-server 5.213.1|PATCHED: input (edition not given, XO not given, xo-server 5.213.1): at or above the fixed latest build 5.213.1.
0|--xo-server 5.211.2 --edition xoa|PATCHED: input (edition xoa, XO not given, xo-server 5.211.2): at or above the fixed stable build 5.211.2.
0|--xo-server 5.211.9|at or above the fixed stable build 5.211.2
0|--xo-server 5.213.7 --edition sources|at or above the fixed latest build 5.213.1
0|--xo-server v5.213.1 --host xo-lab|PATCHED: xo-lab (edition not given, XO not given, xo-server 5.213.1)
0|--xo-server 05.0213.01|PATCHED: input (edition not given, XO not given, xo-server 05.0213.01)
0|--xo-server 5.213.1 --xo-version 6.10.0 --edition Appliance|RESULT: PATCHED (1 checked: 1 PATCHED, 0 VULNERABLE, 0 UNKNOWN, 0 NEEDS MORE INFO)
0|--csv tests/fixtures/inv_patched.csv|RESULT: PATCHED (3 checked: 3 PATCHED, 0 VULNERABLE, 0 UNKNOWN, 0 NEEDS MORE INFO)
0|--xo-server 5.213.1 --scan tests/fixtures/proxy_clean.log|SCAN: no IOC match in 1 file(s). Absence is not proof
1|--xo-server 5.211.1|VULNERABLE: input (edition not given, XO not given, xo-server 5.211.1): below the fixed xo-server builds 5.211.2 (stable) and 5.213.1 (latest).
1|--xo-server 5.210.4|below the fixed xo-server builds
1|--xo-server 4.80.0|below the fixed xo-server builds
1|--xo-server 5.212.0|5.212.x was released on 23 Oct 2026, before the fix
1|--xo-server 5.213.0 --edition xoa|XOA with xo-server 5.213.0 is the build Xen Orchestra 6.10.0 shipped before the fix.
1|--xo-server 5.213.0 --edition XOA --xo-version 6.10.0|VULNERABLE: input (edition xoa, XO 6.10.0, xo-server 5.213.0)
1|--xo-version 6.9.0|VULNERABLE: input (edition not given, XO 6.9.0, xo-server not given): before Xen Orchestra 6.9.1 (stable) and 6.10.0 (latest).
1|--xo-version 6.8.2|before Xen Orchestra 6.9.1
1|--xo-version 5.113.0|before Xen Orchestra 6.9.1
1|--csv tests/fixtures/inv_mixed.csv|RESULT: VULNERABLE (6 checked: 1 PATCHED, 3 VULNERABLE, 1 UNKNOWN, 1 NEEDS MORE INFO)
1|--csv tests/fixtures/inv_crlf.csv|RESULT: VULNERABLE (3 checked: 2 PATCHED, 1 VULNERABLE, 0 UNKNOWN, 0 NEEDS MORE INFO)
1|--csv tests/fixtures/inv_crlf.csv|PATCHED: host not given (edition xoa, XO not given, xo-server 5.211.2)
1|--csv tests/fixtures/inv_crlf.csv|PATCHED: xo-fx-51 (edition xoa, XO 6.10.0, xo-server 5.213.1)
2|--xo-server banana|UNKNOWN: input (edition not given, XO not given, xo-server banana): xo-server version not recognised.
2|--xo-server 5.213|xo-server version not recognised
2|--xo-server 5.213.1.300|xo-server version not recognised
2|--xo-version 6.10|Xen Orchestra version not recognised
2|--xo-server 5.213.1 --edition cloud|UNKNOWN: input (edition "cloud", XO not given, xo-server 5.213.1): edition not recognised (use xoa or sources).
2|--csv tests/fixtures/inv_unknown.csv|RESULT: UNKNOWN (4 checked: 1 PATCHED, 0 VULNERABLE, 3 UNKNOWN, 0 NEEDS MORE INFO)
2|--scan tests/fixtures/proxy_clean.log|NOTE tests/fixtures/proxy_clean.log:3: [ours: token listing API path, also used legitimately]
2|--scan tests/fixtures/host_clean.txt|SCAN: no IOC match in 1 file(s).
2|--scan tests/fixtures/proxy_clean.log --scan tests/fixtures/host_clean.txt|SCAN: no IOC match in 2 file(s).
3|--xo-server 5.213.0 --edition sources|NEEDS MORE INFO: input (edition sources, XO not given, xo-server 5.213.0): a sources install still reports 5.213.0 after the fix was merged. Check that git history contains commit 50166fe3
3|--xo-server 5.213.0|NEEDS MORE INFO: input (edition not given, XO not given, xo-server 5.213.0)
3|--xo-version 6.10.0|Vates updated 6.9.1 and 6.10.0 in place on 10 Nov 2026, and both first shipped with vulnerable xo-server (5.211.1 and 5.213.0).
3|--xo-version 6.9.1 --edition xoa|NEEDS MORE INFO: input (edition xoa, XO 6.9.1, xo-server not given)
3|--xo-version 6.11.0|not a version Vates named.
3|--xo-version 6.9.2|not a version Vates named.
3|--xo-server 5.214.0|newer than the fixed builds Vates named.
3|--xo-server 6.0.0|newer than the fixed builds Vates named.
3|--csv tests/fixtures/inv_needinfo.csv|RESULT: NEEDS MORE INFO (5 checked: 1 PATCHED, 0 VULNERABLE, 0 UNKNOWN, 4 NEEDS MORE INFO)
4|--scan tests/fixtures/proxy_hit_vates.log|IOC tests/fixtures/proxy_hit_vates.log:3: [Vates IOC: empty-object authenticationToken cookie]
4|--scan tests/fixtures/proxy_hit_variant.log|IOC tests/fixtures/proxy_hit_variant.log:2: [ours: encoded or spaced variant of the empty-object cookie]
4|--scan tests/fixtures/tcpdump_hit.txt|IOC tests/fixtures/tcpdump_hit.txt:5: [Vates IOC: empty-object authenticationToken cookie] Cookie: authenticationToken=j:{}
4|--scan tests/fixtures/proxy_crlf.log|IOC tests/fixtures/proxy_crlf.log:2: [Vates IOC: empty-object authenticationToken cookie]
4|--scan tests/fixtures/host_hits.txt|IOC tests/fixtures/host_hits.txt:2: [Vates IOC: VM named pivot2]
4|--scan tests/fixtures/host_hits.txt|IOC tests/fixtures/host_hits.txt:3: [Vates IOC: VM platform hvm_serial: file]
4|--scan tests/fixtures/host_hits.txt|IOC tests/fixtures/host_hits.txt:5: [Vates IOC: /etc/cron.d/zz-ustar cron file]
4|--scan tests/fixtures/host_hits.txt|IOC tests/fixtures/host_hits.txt:6: [Vates IOC: /.ustar5 or /.ustar6 file]
4|--scan tests/fixtures/host_hits.txt|NOTE tests/fixtures/host_hits.txt:7: [ours: /etc/ld.so.preload present, listed by the Vates check command but not named as an IOC]
4|--scan tests/fixtures/host_hits.txt|IOC tests/fixtures/host_hits.txt:8: [Vates IOC: -serial file: in xensource.log]
4|--scan tests/fixtures/host_other_ustar.txt|IOC tests/fixtures/host_other_ustar.txt:2: [ours: other /.ustar file, same naming as the Vates IOCs]
4|--scan tests/fixtures/net_onion.txt|IOC tests/fixtures/net_onion.txt:2: [Vates IOC: C2 onion host]
4|--xo-server 5.213.1 --scan tests/fixtures/host_hits.txt|IOC MATCH: treat Xen Orchestra and every managed pool as compromised.
4|--csv tests/fixtures/inv_patched.csv --scan tests/fixtures/host_clean.txt --scan tests/fixtures/tcpdump_hit.txt|Our advice: also revoke every XO authentication token
5|--csv tests/fixtures/inv_bad_header.csv|ERROR: CSV header must be: host,edition,xo_version,xo_server_version
5|--csv tests/fixtures/inv_header_only.csv|ERROR: CSV has no rows: tests/fixtures/inv_header_only.csv
5|--csv tests/fixtures/no_such_file.csv|ERROR: cannot read: tests/fixtures/no_such_file.csv
5|--scan tests/fixtures/no_such_file.log|ERROR: cannot read: tests/fixtures/no_such_file.log
5|--scan tests/fixtures|ERROR: cannot read: tests/fixtures
5|--csv tests/fixtures/inv_patched.csv --xo-server 5.213.1|ERROR: use only one of --csv or --xo-server/--xo-version
5|--bogus 1|Usage:
5|--xo-server|Usage:
5|--host onlyhost|Usage:
