CodeVetter · local evidence export

SQL injection via f-string in Python

codevetter-public-benchmark/py-sql-injection

detected · high confidence

Verification

Code reviewcompleted

Qualified static finding recorded.

Executable testnot verified

No exact-current runtime evidence is included.

Audiencenot run

No audience validation occurred.

Finding

highbenchmark ground truth

sql injection

User-supplied name is interpolated into the SQL query via an f-string, allowing injection of arbitrary SQL such as a UNION SELECT to exfiltrate other tables.

source.py:8