GHSA-g536-hq2j-5mpf: 
Python vulnerability analysis and mitigation

Maintainer assessment (2026-10-23)

Affected release: openai4s 0.3.1 (pip / GitHub v0.3.1). The artifact-version display of dataset.file_verification was introduced after v0.3.0. Unreleased source snapshots before the fix may also have been affected; the package version range below names only the confirmed published release. Impact: A historical or imported artifact source declaration without a local Host-owned verification receipt could be displayed as “Size and source checksum matched.” This misrepresents provenance assurance. The reporter's reproduction used synthetic local bytes. It does not establish observed affected users, code execution, credential exposure, modification of the underlying dataset bytes, or incorrect scientific results. Resolution: The fix was merged to main in e509c8080f25420b36c3b2b730da9490f8eb978c. The display now requires a local Host-owned receipt bound to the exact artifact version and bytes; historical declarations without one remain recorded-only, and imported receipts do not become local attestations. Regression coverage includes historical rows after reopening, genuine native imports, receipt mismatch/failure, and portable-session quarantine. No patched package release exists yet, so 0.3.1 remains affected. The original report below describes the evidence available when it was filed; its statement that portable-session round trips had not been reproduced was accurate at that time.

Context and tested scope

Private follow-up to the dataset source review in #194, submitted under .github/SECURITY.md. Tested at main b7240802dc0ff9c967dc3797e948ec5de03b0257 using Python 3.10 on Windows, a disposable local SQLite database and synthetic bytes. No provider, network download, production database or real dataset was used. The new-write fix in 6696856602fe6acb3baabaac501cd2102c8ed7eb strips dataset.file_verification from cell-supplied sources. This report concerns pre-existing version sources, which bypass that write-time filter on read.

Reproduction

Seed the version-source shape that HostDataService.save_artifact accepted before 66968566: a locally written 34-byte file with its actual local SHA-256, plus a source.dataset declaring PaRoutes n1-targets.txt (465689 bytes, md5:5adae99357cdad829073b197c7813152) and file_verification="size_and_source_checksum_verified". Persist it through Store.save_artifact, close and reopen Store, then use the same public_source(version["source"], artifact_sha256=version["checksum"]) projection as GET /artifacts/{id}/versions. Observed:

{"native_import_executed": false, "declared_bytes": 465689, "actual_bytes": 34, "source_survived_reopen": true, "projected_check": "size_and_source_checksum_verified"}

frontend/src/islands/viewer.ts renders that value as "Size and source checksum matched". There is no Host-owned receipt in this fixture and its claimed size is demonstrably wrong. This reproduction models historical accepted data; it does not claim that current host.save_artifact can write the reserved field. Relevant paths:

• openai4s/host/data.py:_cell_declared_source (new-write protection)
• openai4s/server/retrieval_source.py:_public_dataset/public_source (read projection)
• openai4s/server/gateway.py: GET Artifact versions serializer
• frontend/src/islands/viewer.ts:renderRetrievalSource

Impact and limits

A recorded declaration can still look like a Host-verified dataset input after upgrade/reopen. This is a provenance authenticity concern, not evidence of a sandbox escape, credential disclosure, scientific accuracy failure or observed affected users. Portable-session round trips have not yet been reproduced. The synthetic reproduction was run once and failed the explicit assertion that an unattested historical source must not reach the matched-check branch.

Proposed direction for review

Keep historical source JSON immutable. Persist verification authority outside caller-supplied source metadata at the successful native-import capture boundary, bind it to the exact version/source/file checksum, and project an explicit "unattested/recorded source only" state when that authority is absent. Do not infer authority from a source.kind/provider string, the filename, or a matching local SHA alone. Imported/quarantined receipts must not become local attestations by copying their JSON. Regression scope: historical script records after reopen, current object/JSON cell sources, genuine native import capture, source/checksum/version mismatch, immutable earlier versions, capture failure, and portable-session quarantine. Please triage whether this needs a security advisory or an ordinary provenance follow-up, and confirm the compatibility treatment of earlier genuine imports that lack the new authority record. I can prepare the scoped fix through the approved private collaboration path.