---
title: "Code verifier returns VERIFIED and admits code that runs shell commands"
description: "GHSA-6rxr-gq43-694g: Code verifier returns VERIFIED and admits code that runs shell commands. Affected and fixed versions of qwed."
url: https://qwedai.com/security/advisories/ghsa-6rxr-gq43-694g
---

GHSA-6rxr-gq43-694g

# Code verifier returns VERIFIED and admits code that runs shell commands

high · 7.5 Published 13 October 2026

### Impact

`CodeVerifier.verify_code()`, `CodeVerifier.verify_python_deep()` and the `/verify/code` API route treat shell and subprocess calls as warnings rather than blocking findings. Python code that calls `os.system`, `os.popen`, `subprocess.call` or `subprocess.Popen` is returned with:

-   status `VERIFIED`;
-   `developer_fields.is_valid = True`;
-   a `proof_ref`;
-   admission `ADMIT`.

Most callers act on `VERIFIED` or `ADMIT`. An application that runs model-generated code only after QWED admits it can therefore be led to run arbitrary shell commands chosen by the model or by whoever controls the model's input.

The warning-level classification is in `src/qwed_new/core/code_verifier.py` (`PYTHON_WARNING`).

### Proof of concept

```python
from qwed_new.core.code_verifier import CodeVerifier
from qwed_new.core.diagnostics import admission_decision

r = CodeVerifier().verify_code('import os\nos.system("rm -rf /tmp/qwed-poc")')
print(r.status.value, admission_decision(r).value, r.developer_fields["is_valid"])
# VERIFIED ADMIT True
```

### Patches

Fixed in 7.2.3. The following now produce a blocking finding: shell and process-execution calls, including `os.system`, `os.popen`, the `os.exec*` and `os.spawn*` families, and `subprocess.*`, whether called directly or through an alias. Code that contains them is never admitted.

### Workarounds

Until you upgrade, do not run code on the basis of a `VERIFIED` / `ADMIT` result alone. Also reject any result whose `developer_fields.issues` contains a `WARNING`. Run generated code only inside an isolated sandbox.

Affected and fixed

Package

qwed

Affected

<= 7.2.2

Fixed in

7.2.3

Severity

high · 7.5

Weakness

CWE-184 Incomplete List of Disallowed Inputs

CWE-693 Protection Mechanism Failure

Credits

[@rahuldass19](https://github.com/rahuldass19)

[View on GitHub](https://github.com/QWED-AI/qwed-verification/security/advisories/GHSA-6rxr-gq43-694g)

[All advisories](https://qwedai.com/security/advisories)