GHSA-jm75-qwf5-vg52: 
Python vulnerability analysis and mitigation

Problem

Code read at bf7eb2c (v1.12.7). Found in an external security review (Oct 2026) and reproduced.

1. envelope.sanitize (envelope.py:250) checks data and connection only. Its docstring says errors/warnings "are message strings that the caller is responsible for keeping clean", and emit then prints the whole envelope.
2. redact() (envelope.py:471) handles only user:pass@ in URLs. Reproduced: redact("uv reported: token=abc Bearer xyz postgres://u:p@h") returns token=abc Bearer xyz postgres://u:***@h. The exception paths that call it (cli.py:673,685,965, explore/commands.py:1290,1595) therefore pass through any key=value or Bearer secret in an exception message.
3. The skill wrapper puts installer output into the envelope. skills/*/scripts/run.py:319-326 (identical in all three skills) captures uv stderr on a failed --warm and copies its last three lines into errors, along with spec[1], which can contain a local file:// path.

Impact

Anything a driver, dbt, uv or index URL prints in an error (tokens in URLs, password= fragments, Bearer headers) can end up in the JSON that the agent reads and often echoes to the user or to logs.

Proposal

1. In emit (or sanitize), run redact() over every entry of errors and warnings, so callers no longer have to.
2. Widen redact() beyond URL credentials: (api[_-]?key|token|secret|password|passwd|pwd)\s*[:=]\s*\S+, Bearer\s+\S+, Authorization:\s*\S+.*, and query-string forms ([?&](token|key|sig|password)=[^&\s]+).
3. run.py warm-up failure: print a fixed message ("warm-up could not install the connector extra; re-run with uv directly to see why"), with no stderr and no spec[1]. The wrapper is stdlib-only, so it must not import redact. Apply the same change to all three copies (test_the_three_wrappers_stay_byte_identical).

Acceptance

• emit(error("uv reported: token=abc Bearer xyz")) prints neither abc nor xyz.
• A fake uv whose stderr is token=abc does not put abc in the --warm envelope.
• The three run.py files stay byte-identical.

Update 2026-10-21: second external review, re-checked at 6f94352 (main)

Still present on main. redact() (envelope.py:536-540) also mishandles the URL form it does cover:

redact("snowflake://bob:p@ss@acct/db")             # -> 'snowflake://bob:***@ss@acct/db'  (the tail leaks)
redact("clickhouse://default:pw/with/slash@h:8443")  # -> unchanged  (not redacted at all)

The password pattern [^@/\s]+ stops at the first @ and refuses /. Match the userinfo up to the last @ before the host, and allow / in the password. Further acceptance:

• neither p@ss nor ss appears in redact("snowflake://bob:p@ss@acct/db")
• pw/with/slash does not appear in redact("clickhouse://default:pw/with/slash@h:8443") For the record: main has 21 bare error_for(exc) call sites. The ones spot-checked catch dex-authored exception types, though explore/commands.py:3038 also catches a bare ValueError. Reported by Sthenos Security, found with Reachable. Fixed in exmergo-dex-core 1.16.1.