I ran my scanner against 5 real CVEs. It missed 4. Then I reverted my own fix.
Why this post is different from the last one The last write-up in this series announced four tools. This one is about what happened when I stopped writing tests for my own tools and started checking one of them against reality — and about the fix I built, tested, shipped, and then took back out, because it was wrong in a way that only showed up once I looked past the headline number. The setup:…
The article details a testing process for a static scanner called "inlet" that evaluates Python codebases for SQL injection vulnerabilities. The author subjected five real CVEs to the scanner and found that it missed four of them. The missed vulnerabilities were CVE-2022-28346 (Django), CVE-2023-49736 (Apache Superset), CVE-2020-11010 (Tortoise ORM), and CVE-2025-30473 (Airflow's common-sql provider).
One of the missed CVEs, CVE-2023-30556, was partially detected but classified as "uncertain" instead of "concatenated" due to a name-resolution gap in the scanner's code. The author then reverted the fix they had implemented for this partial detection, as it ended up silently excluding 94 real database call sites from other packages, including Django's SchemaEditor.execute(), SQLAlchemy's Engine/Session internals, a dataset helper, and SQLModel's super().execute().
The author concluded that trading visible noise for confident silence is a worse failure mode than the original issue and decided to revert the change and keep the original behavior intact.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
