---
title: "CodeVerifier certifies command-execution, file-access and exfiltration code as VERIFIED/ADMIT (incomplete fix of GHSA-6rxr-gq43-694g)"
description: "GHSA-4phf-6h72-9xfg: CodeVerifier certifies command-execution, file-access and exfiltration code as VERIFIED/ADMIT (incomplete fix of GHSA-6rxr-gq43-694g). Affected and fixed versions of qwed."
url: https://qwedai.com/security/advisories/ghsa-4phf-6h72-9xfg
---

GHSA-4phf-6h72-9xfg

# CodeVerifier certifies command-execution, file-access and exfiltration code as VERIFIED/ADMIT (incomplete fix of GHSA-6rxr-gq43-694g)

high Published 16 October 2026

### Impact

`CodeVerifier.verify_code` (used by `POST /verify/code`, `verify_python_deep`, and batch `code` items) returns `VERIFIED` + `is_valid:true` + `ADMIT` for code that runs commands, reads or writes files, or sends data out. The verdict is `is_safe = critical_count == 0`, and several dangerous sinks are classified WARNING or are absent from the pattern tables.

GHSA-6rxr-gq43-694g (7.2.3) made the common Python process-execution forms (`os.system`, `subprocess.*`, aliased imports) CRITICAL. This advisory covers the forms that are **still admitted** on 7.2.3:

-   **Process execution through other routes:** `importlib.import_module("os").system(...)`, `ctypes.CDLL(...)`, `posix`/`nt` module calls, `sys.modules["os"].system`, `os.fork`, `runpy`. The 7.2.3 AST alias check resolves import aliases only, not runtime module acquisition.
-   **File access** (`open(...).read()/.write()`, `pathlib`, `shutil`) — WARNING or no finding.
-   **Network exfiltration** (`socket`, `urllib`, `http.client`, `requests`/`httpx`) — WARNING or no finding.
-   **Other scanned languages:** JavaScript `child_process` exec/spawn, Java reflective `exec`, Go `syscall`/`exec` variants are WARNING-only or unlisted, so they return VERIFIED/ADMIT.

### Affected

All releases through 7.2.3; reproduced at the verdict level on `main` @ a4d6714. Harmless placeholder commands (`id`/`true`) were used; nothing was executed.

### Details

-   `src/qwed_new/core/code_verifier.py`: the verdict (`is_safe = critical_count == 0`), the process-execution prefix list and warning list (around 111-131), the AST process-execution check that resolves import aliases only (around 583-629), and the JavaScript/Java/Go tables (around 149-226).
-   `admission_decision` (`diagnostics.py:1114-1136`) maps VERIFIED to ADMIT.

### Fix

Treat process execution reached through `importlib`/`ctypes`/`posix`/`nt`/`sys.modules`/`runpy` as CRITICAL (resolve runtime module acquisition, not only import aliases). Decide and document a single policy for file and network sinks (classify as CRITICAL if they must not be admitted, rather than WARNING). Extend the process-execution classification to the JavaScript, Java and Go scanners. This is tracked as an incomplete fix of GHSA-6rxr-gq43-694g.

### Source

OpenVuln external audit (2026-10), finding on CodeVerifier verdict computation. Reported privately.

Affected and fixed

Package

qwed

Affected

<= 7.2.3

Fixed in

7.3.0

Severity

high

Weakness

CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-184 Incomplete List of Disallowed Inputs

[View on GitHub](https://github.com/QWED-AI/qwed-verification/security/advisories/GHSA-4phf-6h72-9xfg)

[All advisories](https://qwedai.com/security/advisories)