From fba8dc14d6f50fc8aab45d25f9cc70519dca1cab Mon Sep 17 00:00:00 2001 From: Sarah Lacard Date: Fri, 1 May 2026 12:18:18 -0600 Subject: [PATCH 1/2] fix(detector): extend THREAD_INJECTION for _thread module KernelGuard-Red-Submission: thread-module-1 --- kernelguard.py | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/kernelguard.py b/kernelguard.py index f086847..95c929a 100644 --- a/kernelguard.py +++ b/kernelguard.py @@ -2785,6 +2785,33 @@ def detect_dynamic_execution(code: str | SubmissionFacts) -> list[dict]: "severity": "high", "evidence": "importlib.reload() (module state reset/manipulation)", }) + elif func_name == "operator.call" and func_name not in seen: + if node.args and isinstance(node.args[0], ast.Name): + called_name = node.args[0].id + if called_name in ("exec", "eval", "compile"): + seen.add(func_name) + matches.append({ + "pattern": "DYNAMIC_EXECUTION", + "severity": "high", + "evidence": f"operator.call({called_name}, ...) — dynamic execution via operator module", + }) + elif func_name == "functools.partial" and func_name not in seen: + if node.args and isinstance(node.args[0], ast.Name): + called_name = node.args[0].id + if called_name in ("exec", "eval", "compile", "__import__"): + seen.add(func_name) + matches.append({ + "pattern": "DYNAMIC_EXECUTION", + "severity": "high", + "evidence": f"functools.partial({called_name}, ...) — deferred dynamic execution", + }) + elif func_name in ("builtins.exec", "builtins.eval", "builtins.compile") and func_name not in seen: + seen.add(func_name) + matches.append({ + "pattern": "DYNAMIC_EXECUTION", + "severity": "high", + "evidence": f"{func_name}() — dynamic execution via builtins module", + }) return matches From 1555a1023e33d559d8eb7498585e22bcff504f5e Mon Sep 17 00:00:00 2001 From: Sarah Lacard Date: Fri, 1 May 2026 22:21:21 -0600 Subject: [PATCH 2/2] chore: trigger blue-pr-sync re-evaluation