CodeVerifier certifies command-execution, file-access and exfiltration code as VERIFIED/ADMIT (incomplete fix of GHSA-6rxr-gq43-694g)

Impact

CodeVerifier.verify_code (used by POST /verify/code, verify_python_deep, and batch code items) returns VERIFIED + is_valid:true + ADMIT for code that runs commands, reads or writes files, or sends data out. The verdict is is_safe = critical_count == 0, and several dangerous sinks are classified WARNING or are absent from the pattern tables.

GHSA-6rxr-gq43-694g (7.2.3) made the common Python process-execution forms (os.system, subprocess.*, aliased imports) CRITICAL. This advisory covers the forms that are still admitted on 7.2.3:

• Process execution through other routes: importlib.import_module("os").system(...), ctypes.CDLL(...), posix/nt module calls, sys.modules["os"].system, os.fork, runpy. The 7.2.3 AST alias check resolves import aliases only, not runtime module acquisition.
• File access (open(...).read()/.write(), pathlib, shutil) — WARNING or no finding.
• Network exfiltration (socket, urllib, http.client, requests/httpx) — WARNING or no finding.
• Other scanned languages: JavaScript child_process exec/spawn, Java reflective exec, Go syscall/exec variants are WARNING-only or unlisted, so they return VERIFIED/ADMIT.

Affected

All releases through 7.2.3; reproduced at the verdict level on main @ a4d6714. Harmless placeholder commands (id/true) were used; nothing was executed.

Details

• src/qwed_new/core/code_verifier.py: the verdict (is_safe = critical_count == 0), the process-execution prefix list and warning list (around 111-131), the AST process-execution check that resolves import aliases only (around 583-629), and the JavaScript/Java/Go tables (around 149-226).
• admission_decision (diagnostics.py:1114-1136) maps VERIFIED to ADMIT.

Fix

Treat process execution reached through importlib/ctypes/posix/nt/sys.modules/runpy as CRITICAL (resolve runtime module acquisition, not only import aliases). Decide and document a single policy for file and network sinks (classify as CRITICAL if they must not be admitted, rather than WARNING). Extend the process-execution classification to the JavaScript, Java and Go scanners. This is tracked as an incomplete fix of GHSA-6rxr-gq43-694g.

Source

OpenVuln external audit (2026-10), finding on CodeVerifier verdict computation. Reported privately.