{
  "id": 7001888,
  "title": "I ran my scanner against 5 real CVEs. It missed 4. Then I reverted my own fix.",
  "url": "https://urgent.news/2026/09/12/i-ran-my-scanner-against-5-real-cves-it-missed-4-then-i-reverted-my",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-12T21:51:23.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/balbaks/i-ran-my-scanner-against-5-real-cves-it-missed-4-then-i-reverted-my-own-fix-4dhk"
  },
  "original_language": "en",
  "account": "The article details a testing process for a static scanner called \"inlet\" that evaluates Python codebases for SQL injection vulnerabilities. The author subjected five real CVEs to the scanner and found that it missed four of them. The missed vulnerabilities were CVE-2022-28346 (Django), CVE-2023-49736 (Apache Superset), CVE-2020-11010 (Tortoise ORM), and CVE-2025-30473 (Airflow's common-sql provider). One of the missed CVEs, CVE-2023-30556, was partially detected but classified as \"uncertain\" instead of \"concatenated\" due to a name-resolution gap in the scanner's code. The author then reverted the fix they had implemented for this partial detection, as it ended up silently excluding 94 real database call sites from other packages, including Django's SchemaEditor.execute(), SQLAlchemy's Engine/Session internals, a dataset helper, and SQLModel's super().execute(). The author concluded that trading visible noise for confident silence is a worse failure mode than the original issue and decided to revert the change and keep the original behavior intact.",
  "summary": "Why this post is different from the last one The last write-up in this series announced four tools. This one is about what happened when I stopped writing tests for my own tools and started checking one of them against reality — and about the fix I built, tested, shipped, and then took back out, because it was wrong in a way that only showed up once I looked past the headline number. The setup:…",
  "key_points": [
    "Scanner failed to detect 4 out of 5 real CVEs in Python codebases",
    "One CVE (CVE-2023-30556) partially detected but classified as uncertain",
    "Author reverted fix, removing silent exclusion of 94 real database call sites"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}