Mark/osint-hub
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Security] MEDIUM: 20 code-level issue(s) #62

New issue
Closed
opened 2026-05-17 10:14:34 +00:00 by Mark · 2 comments
Mark commented 2026-05-17 10:14:34 +00:00
Owner
Copy link

Code Security Issues

  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/monitoring.py:116
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/monitoring.py:168
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/init_db.py:13
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/deps.py:27
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/tasks.py:289
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/import_seed.py:28
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/import_seed.py:35
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/monitoring.py:73
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/monitoring.py:146
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/findings.py:40
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/leads.py:40
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/contacts.py:76
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/orgs.py:44
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/gather.py:279
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/entities.py:59
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/entities.py:62
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/entities.py:65
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/entities.py:99
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/entities.py:100
  • HIGH exec_usage: Arbitrary command execution via exec() in backend/app/routers/entities.py:153

Auto-filed by security-sweep.py on 2026-05-17 03:14 UTC

## Code Security Issues - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/monitoring.py:116 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/monitoring.py:168 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/init_db.py:13 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/deps.py:27 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/tasks.py:289 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/import_seed.py:28 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/import_seed.py:35 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/monitoring.py:73 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/monitoring.py:146 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/findings.py:40 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/leads.py:40 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/contacts.py:76 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/orgs.py:44 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/gather.py:279 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/entities.py:59 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/entities.py:62 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/entities.py:65 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/entities.py:99 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/entities.py:100 - **HIGH** `exec_usage`: Arbitrary command execution via exec() in backend/app/routers/entities.py:153 --- *Auto-filed by security-sweep.py on 2026-05-17 03:14 UTC*
Mark commented 2026-05-18 20:41:43 +00:00
Author
Owner
Copy link

Analysis: All 20 Issues Are False Positives

After reviewing all 20 flagged locations, none are actual security vulnerabilities.

Why These Are False Positives

All flagged uses are session.exec() from SQLModel/SQLAlchemy, which is a database query execution method, NOT Python's dangerous built-in exec() function.

SQLModel's session.exec():

  • Accepts SQLAlchemy/SQLModel select statements (ORM constructs)
  • Executes SQL queries safely through the database session
  • Does NOT execute arbitrary Python code
  • Is NOT a security vulnerability

Python's built-in exec():

  • Executes arbitrary Python code strings
  • Can be dangerous if user input is passed
  • Is what security scanners should flag

Reviewed Files

File Line Code Finding
monitoring.py 116, 168 session.exec(select(...)) SQLModel query
init_db.py 13 session.exec(select(User)...) SQLModel query
deps.py 27 session.exec(select(User)...) SQLModel query
tasks.py 289 In DISABLED comment block Not executable
import_seed.py 28, 35 session.exec(Source.__table__.select()) SQLModel query
routers/monitoring.py 73, 146 session.exec(query) SQLModel query
routers/findings.py 40 session.exec(stmt) SQLModel query
routers/leads.py 40 session.exec(stmt) SQLModel query
routers/contacts.py 76 session.exec(stmt) SQLModel query
routers/orgs.py 44 session.exec(stmt) SQLModel query
routers/gather.py 279 session.exec(select(Organization)...) SQLModel query
routers/entities.py 59, 62, 65, 99, 100, 153 session.exec(select(...)) SQLModel query

Recommendation

The security-sweep.py scanner needs to be updated to differentiate between:

  1. Python's built-in exec() function (dangerous)
  2. SQLModel/SQLAlchemy's session.exec() method (safe ORM query)

No code changes required. Closing as false positive.

## Analysis: All 20 Issues Are False Positives After reviewing all 20 flagged locations, **none are actual security vulnerabilities**. ### Why These Are False Positives All flagged uses are `session.exec()` from **SQLModel/SQLAlchemy**, which is a **database query execution method**, NOT Python's dangerous built-in `exec()` function. **SQLModel's `session.exec()`**: - Accepts SQLAlchemy/SQLModel select statements (ORM constructs) - Executes SQL queries safely through the database session - Does NOT execute arbitrary Python code - Is NOT a security vulnerability **Python's built-in `exec()`**: - Executes arbitrary Python code strings - Can be dangerous if user input is passed - Is what security scanners should flag ### Reviewed Files | File | Line | Code | Finding | |------|------|------|---------| | monitoring.py | 116, 168 | `session.exec(select(...))` | SQLModel query | | init_db.py | 13 | `session.exec(select(User)...)` | SQLModel query | | deps.py | 27 | `session.exec(select(User)...)` | SQLModel query | | tasks.py | 289 | In DISABLED comment block | Not executable | | import_seed.py | 28, 35 | `session.exec(Source.__table__.select())` | SQLModel query | | routers/monitoring.py | 73, 146 | `session.exec(query)` | SQLModel query | | routers/findings.py | 40 | `session.exec(stmt)` | SQLModel query | | routers/leads.py | 40 | `session.exec(stmt)` | SQLModel query | | routers/contacts.py | 76 | `session.exec(stmt)` | SQLModel query | | routers/orgs.py | 44 | `session.exec(stmt)` | SQLModel query | | routers/gather.py | 279 | `session.exec(select(Organization)...)` | SQLModel query | | routers/entities.py | 59, 62, 65, 99, 100, 153 | `session.exec(select(...))` | SQLModel query | ### Recommendation The `security-sweep.py` scanner needs to be updated to differentiate between: 1. Python's built-in `exec()` function (dangerous) 2. SQLModel/SQLAlchemy's `session.exec()` method (safe ORM query) **No code changes required. Closing as false positive.**
Mark closed this issue 2026-05-18 20:41:44 +00:00
Mark commented 2026-05-18 20:42:04 +00:00
Author
Owner
Copy link

Quickfix applied via opencode.

Quickfix applied via opencode.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
agentic-osint

Agentic OSINT features

  
audit

   
blocked:commit-ready-failed

   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-lint

   
blocked:gate-plan

   
blocked:gate-research

   
blocked:needs-decision

   
blocked:needs-human

   
blocked:no-changes

   
blocked:preflight

Repo has dirty lint; kilo-gsd preflight refuses to dispatch until lint-cleanup lands

  
blocked:verify-failed

   
bug

Something is not working

  
chore

Config/cleanup item

  
deferred

Deferred — will revisit later

  
enhancement

Enhancement request

  
feature-request

   
in-progress

   
lint-baseline

   
lint-cleanup

kilo-gsd preflight lint gate: repo has dirty ruff state, cleanup required before fixer dispatch

  
needs-decompose

Issue needs decompose processing

  
needs-triage

   
performance

   
quickfix

   
security/medium

Medium severity security issue

  
triage-approved

Approved by triage

No labels
agentic-osint
audit
blocked:commit-ready-failed
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-lint
blocked:gate-plan
blocked:gate-research
blocked:needs-decision
blocked:needs-human
blocked:no-changes
blocked:preflight
blocked:verify-failed
bug
chore
deferred
enhancement
feature-request
in-progress
lint-baseline
lint-cleanup
needs-decompose
needs-triage
performance
quickfix
security/medium
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/osint-hub#62
No description provided.