Zennoxa Shield
Rules / Python
SHIELD-PY-004

Dangerous exec() usage

criticalPythonCWE-95CVSS 9

What it detects

exec() runs arbitrary Python code and is a major attack vector.

How to fix

Remove exec(). Refactor to use static code paths instead of dynamic code execution.

Vulnerable — Shield flags thisreports.py
def run_report(template_code, context):
    """Render a user-supplied report template."""
    exec(template_code, {"context": context})

if __name__ == "__main__":
    with open("report_template.py") as fh:
        run_report(fh.read(), {"quarter": "Q3"})
Fixed — scans cleanreports.py
def run_report(name, context):
    """Dispatch to a known report renderer via a static lookup."""
    reports = {
        "quarterly": render_quarterly,
        "annual": render_annual,
    }
    return reports[name](context)

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-004, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-PY-004: Dangerous exec() usage — Zennoxa Shield