This document covers two distinct security topics:
- Security findings generated by this toolkit (CPython stdlib bugs) → see
WORKING_WITH_MAINTAINERS.md - Security vulnerabilities in this toolkit itself → see below
The toolkit handles untrusted input (crafted archives in corpus fixtures, subprocess calls in the reproducer engine) and generates scripts that are then executed. A vulnerability in the toolkit code itself is possible and should be reported privately.
Report vulnerabilities in this toolkit via GitHub's private vulnerability reporting:
Security tab → "Report a vulnerability"
Do not open a public issue for vulnerabilities in the toolkit code itself.
- Code execution via crafted finding JSON — if the reproducer engine can be tricked into executing attacker-controlled code by a maliciously crafted finding JSON file
- Path traversal in reproducer output — if a reproducer template writes files outside
./reproductions/<finding-id>/ - Command injection in script arguments — if any script's argument handling allows shell metacharacters to reach a subprocess call
- Unsafe temporary file handling — race conditions or symlink attacks in the
tempfileusage within the reproducer engine
- The corpus positive fixtures demonstrating CPython bugs — they are intentionally crafted to demonstrate boundary violations and are expected to produce dangerous output when run against unpatched CPython. They are not bugs in this toolkit.
- High API cost from a full
/scanrun — the cost and time estimates in the README are accurate; using the toolkit as intended is not an abuse scenario. - False positives from the scan scripts — a wrong finding is a quality issue, not a security vulnerability. File a regular issue.
| Toolkit version | Supported |
|---|---|
| 0.2.x (current) | ✅ Yes |
| 0.1.x | ❌ No — upgrade to 0.2.x |
If you used this toolkit to find a potential security vulnerability in CPython's standard library, do not report it here. Follow the process in WORKING_WITH_MAINTAINERS.md:
- Pre-triage with a trusted CPython developer
- File with
security@python.org - Do not discuss publicly until the PSRT authorizes disclosure
Opening a GitHub issue or PR in this repository to disclose a CPython finding is a disclosure anti-pattern. The right venue is security@python.org.