hitoshura25/cvefixes huggingface dataset:
CVE-2017-0899 (Ruby, published 2017-08-31T20:29Z)
Description: value: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/text.rb
test/rubygems/test_gem_commands_query_command.rb
test/rubygems/test_gem_text.rb
Commit message: Use a pattern that works on 1.8.7


Vulnerable code:
    text.gsub(/[\u0000-\u0008\u000b-\u000c\u000e-\u001F\u007f]/, ".".freeze)
        s.authors = ["Abraham Lincoln \u0001", "\u0002 Hirohito"]
        s.homepage = "http://a.example.com/\u0003"
    assert_equal "text with weird .. stuff", format_text("text with weird \u001b\u0002 stuff", 40)

Fixed code:
    text.gsub(/[\000-\b\v-\f\016-\037\177]/, ".".freeze)
        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
        s.homepage = "http://a.example.com/\x03"
    assert_equal "text with weird .. stuff .", format_text("text with weird \x1b\x02 stuff \x7f", 40)
CVE-2017-0900 (Ruby, published 2017-08-31T20:29Z)
Description: value: RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/commands/query_command.rb
lib/rubygems/text.rb
test/rubygems/test_gem_commands_query_command.rb
test/rubygems/test_gem_text.rb
Commit message: Truncate summaries to 100,000 characters in the query command

This avoids a DOS vector where incredibly large summary strings would hang rubygems due to taking forever in Gem::Text.clean_text


Vulnerable code:
    entry << "\n\n" << format_text(spec.summary, 68, 4)

Fixed code:
    summary = truncate_text(spec.summary, "the summary for #{spec.full_name}")
    entry << "\n\n" << format_text(summary, 68, 4)
  def truncate_text(text, description, max_length = 100_000)
    raise ArgumentError, "max_length must be positive" unless max_length > 0
    return text if text.size <= max_length
    "Truncating #{description} to #{max_length.to_s.reverse.gsub(/...(?=.)/,'\&,').reverse} characters:\n" + text[0, max_length]
  end

pl (1)
    Platform: i386-linux
    Author: A User
    Homepage: http://example.com

    this is a summary
    EOF

    assert_equal expected, @ui.output
    assert_equal '', @ui.error
  end

  def test_execute_details_truncates_summary
    spec_fetcher do |fetcher|
      fetcher.spec 'a', 2 do |s|
        s.summary = 'This is a lot of text. ' * 10_000
        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
        s.homepage = "http://a.example.com/\x03"
      end

      fetcher.legacy_platform
    end

    @cmd.handle_options %w[-r -d]

    use_ui @ui do
      @cmd.execute
    end

    expected = <<-EOF

*** REMOTE GEMS ***

a (2)
    Authors: Abraham Lincoln ., . Hirohito
    Homepage: http://a.example.com/.

    Truncating the summary for a-2 to 100,000 characters:
#{"    This is a lot of text. This is a lot of text. This is a lot of text.\n" * 1449}    This is a lot of te


  def test_truncate_text
    assert_equal "abc", truncate_text("abc", "desc")
    assert_equal "Truncating desc to 2 characters:\nab", truncate_text("abc", "desc", 2)
    s = "ab" * 500_001
    assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)
  end
CVE-2017-0901 (Ruby, published 2017-08-31T20:29Z)
Description: value: RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/installer.rb
test/rubygems/test_gem_installer.rb
Commit message: Validate specification names when installing

This prevents a malicious user from crafting a gem that could write to an arbitrary directory, outside of the gems directory, by using metacharacters such as `..`


Vulnerable code:

Fixed code:
  def verify_spec_name
    return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
    raise Gem::InstallError, "#{spec} has an invalid name"
  end

    verify_spec_name

  def test_pre_install_checks_malicious_name
    spec = util_spec '../malicious', '1'
    def spec.full_name # so the spec is buildable
      "malicious-1"
    end
    def spec.validate; end

    util_build_gem spec

    gem = File.join(@gemhome, 'cache', spec.file_name)

    use_ui @ui do
      @installer = Gem::Installer.at gem
      e = assert_raises Gem::InstallError do
        @installer.pre_install_checks
      end
      assert_equal '#<Gem::Specification name=../malicious version=1> has an invalid name', e.message
    end
  end
CVE-2017-0903 (Ruby, published 2017-10-11T18:29Z)
Description: value: RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/rubygems/rubygems
Files changed:
Manifest.txt
lib/rubygems.rb
lib/rubygems/config_file.rb
lib/rubygems/package.rb
lib/rubygems/package/old.rb
lib/rubygems/safe_yaml.rb
lib/rubygems/specification.rb
Commit message: Whitelist classes and symbols that are in Gem spec YAML

This patch adds a method for loading YAML specs from a gem and
whitelists classes and symbols that are allowed in the spec.  Then it
changes calls to YAML.load to call the whitelisted "safe" loader
instead.

[CVE-2017-0903]


Vulnerable code:
        gem 'psych', '>= 1.2.1'
      content = YAML.load(File.read(filename))
        YAML.load gz_io.read
    YAML.load header
    spec = YAML.load input

Fixed code:
lib/rubygems/safe_yaml.rb
        gem 'psych', '>= 2.0.0'
    require 'rubygems/safe_yaml'
      content = Gem::SafeYAML.load(File.read(filename))
        Gem::SafeYAML.safe_load gz_io.read
    Gem::SafeYAML.safe_load header
module Gem

  ###
  # This module is used for safely loading YAML specs from a gem.  The
  # `safe_load` method defined on this module is specifically designed for
  # loading Gem specifications.  For loading other YAML safely, please see
  # Psych.safe_load

  module SafeYAML
    WHITELISTED_CLASSES = %w(
      Symbol
      Time
      Date
      Gem::Dependency
      Gem::Platform
      Gem::Requirement
      Gem::Specification
      Gem::Version
      Gem::Version::Requirement
      YAML::Syck::DefaultKey
      Syck::DefaultKey
    )

    WHITELISTED_SYMBOLS = %w(
      development
      runtime
    )

    if ::YAML.respond_to? :safe_load
      def self.safe_load input
        ::YAML.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true)
      end

      def self.load input
        ::YAML.safe_load(input, [::Symbol])
      end
    else
      warn "YAML safe loading is not available. Please upgrade psych to a version that supports safe loading (>= 2.0)."
      def self.safe_load input, *args
        ::YAML.load input
      end

      def self.load input
        ::YAML.load input
      end
    end
  end
end
    spec = Gem::SafeYAML.safe_load input
CVE-2018-1000073 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/package.rb
Commit message: Non-working patch for deducing symlinked base-dirs


Vulnerable code:

Fixed code:
    destination = File.realpath destination if
      File.respond_to? :realpath
CVE-2018-1000074 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/commands/owner_command.rb
test/rubygems/test_gem_commands_owner_command.rb
Commit message: Fix possible Unsafe Object Deserialization Vulnerability in gem owner


Vulnerable code:
      owners = YAML.load resp.body

Fixed code:
      owners = Gem::SafeYAML.load resp.body
class Foo
end

  def test_show_owners_dont_load_objects
    skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass)

    response = <<EOF
---
- email: !ruby/object:Foo {}
  id: 1
  handle: user1
- email: user2@example.com
- id: 3
  handle: user3
- id: 4
EOF

    @fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']

    assert_raises Psych::DisallowedClass do
      use_ui @ui do
        @cmd.show_owners("freewill")
      end
    end

  end
CVE-2018-1000075 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/package/tar_header.rb
test/rubygems/test_gem_package_tar_header.rb
Commit message: Strictly interpret octal fields in tar headers

Any octal field that contains characters other that 0-7 will cause acn
exception to be raised.

This prevents a negative size from being set, which could cause an
infinite loop.


Vulnerable code:
        :mode     => fields.shift.oct,
        :uid      => fields.shift.oct,
        :gid      => fields.shift.oct,
        :size     => fields.shift.oct,
        :mtime    => fields.shift.oct,
        :checksum => fields.shift.oct,
        :version  => fields.shift.oct,
        :devmajor => fields.shift.oct,
        :devminor => fields.shift.oct,

Fixed code:
        :mode     => strict_oct(fields.shift),
        :uid      => strict_oct(fields.shift),
        :gid      => strict_oct(fields.shift),
        :size     => strict_oct(fields.shift),
        :mtime    => strict_oct(fields.shift),
        :checksum => strict_oct(fields.shift),
        :version  => strict_oct(fields.shift),
        :devmajor => strict_oct(fields.shift),
        :devminor => strict_oct(fields.shift),
  def self.strict_oct(str)
    return str.oct if str =~ /\A[0-7]*\z/
    raise ArgumentError, "#{str.inspect} is not an octal string"
  end

  def test_from_bad_octal
    test_cases = [
      "00000006,44\000", # bogus character
      "00000006789\000", # non-octal digit
      "+0000001234\000", # positive sign
      "-0000001000\000", # negative sign
      "0x000123abc\000", # radix prefix
    ]

    test_cases.each do |val|
      header_s = @tar_header.to_s
      # overwrite the size field
      header_s[124, 12] = val
      io = TempIO.new header_s
      assert_raises ArgumentError do
        new_header = Gem::Package::TarHeader.from io
      end
    end
  end
CVE-2018-1000076 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/package.rb
lib/rubygems/package/tar_writer.rb
test/rubygems/test_gem_package.rb
Commit message: Raise a security error when there are duplicate files in a package

This is a rudimentary fix for an issue where RubyGems would allow a
mis-signed gem to be installed, as the tarball would contain multiple
gem signatures.

Nothing should give us a tarball with multiple entries, so we'll just
disallow that.


Vulnerable code:
        gem.add_file_simple 'data.tar.gz', 0444, bogus_data.length do |io|

Fixed code:

    if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any?
      raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})"
    end
    raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest

  def test_verify_duplicate_file
    FileUtils.mkdir_p 'lib'
    FileUtils.touch 'lib/code.rb'

    build = Gem::Package.new @gem
    build.spec = @spec
    build.setup_signer
    open @gem, 'wb' do |gem_io|
      Gem::Package::TarWriter.new gem_io do |gem|
        build.add_metadata gem
        build.add_contents gem

        gem.add_file_simple 'a.sig', 0444, 0
        gem.add_file_simple 'a.sig', 0444, 0
      end
    end

    package = Gem::Package.new @gem

    e = assert_raises Gem::Security::Exception do
      package.verify
    end

    assert_equal 'duplicate files in the package: ("a.sig")', e.message
  end

        fake_signer = Class.new do
          def digest_name; 'SHA512'; end
          def digest_algorithm; Digest(:SHA512); end
          def key; 'key'; end
          def sign(*); 'fake_sig'; end
        end
        gem.add_file_signed 'data2.tar.gz', 0444, fake_signer.new do |io|
CVE-2018-1000077 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/specification.rb
test/rubygems/test_gem_specification.rb
Commit message: Enforce URL validation on spec homepage attribute


Vulnerable code:
    if homepage and not homepage.empty? and
       homepage !~ /\A[a-z][a-z\d+.-]*:/i then
      raise Gem::InvalidSpecificationException,
            "\"#{homepage}\" is not a URI"

Fixed code:
require 'uri'
    # Make sure a homepage is valid HTTP/HTTPS URI
    if homepage and not homepage.empty?
      begin
        homepage_uri = URI.parse(homepage)
        unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
          raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a URI"
        end
      rescue URI::InvalidURIError
        raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a URI"
      end

      @a1.homepage = 'ftp://rubygems.org'

      e = assert_raises Gem::InvalidSpecificationException do
        @a1.validate
      end

      assert_equal '"ftp://rubygems.org" is not a URI', e.message

      @a1.homepage = 'http://rubygems.org'

      assert_equal true, @a1.validate
CVE-2018-1000078 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/server.rb
Commit message: Fix 289313


Vulnerable code:
        "homepage"            => spec.homepage,

Fixed code:
        "homepage"            => (URI.parse(spec.homepage).is_a?(URI::HTTP) || URI.parse(spec.homepage).is_a?(URI::HTTPS)) ? spec.homepage : ".",
CVE-2018-1000079 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/package.rb
Commit message: Add bug fix for #270068


Vulnerable code:
      destination.start_with? destination_dir

Fixed code:
      destination.start_with? destination_dir + '/'
CVE-2018-1000079 (Ruby, published 2018-03-13T15:29Z)
Description: value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/rubygems/rubygems
Files changed:
lib/rubygems/package.rb
test/rubygems/test_gem_package.rb
Commit message: Implement a safe mkdir for package that verifies were inside the destination dir for all new directories ccreated


Vulnerable code:
        FileUtils.mkdir_p mkdir, mkdir_options
    destination_dir = File.realpath destination_dir if
      File.respond_to? :realpath
    destination = File.realpath destination if
      File.respond_to? :realpath
   assert_equal("installing into parent path ../outside.txt of " +

Fixed code:
        mkdir_p_safe mkdir, mkdir_options, destination_dir, entry.full_name
    destination_dir = realpath destination_dir
  def mkdir_p_safe mkdir, mkdir_options, destination_dir, file_name
    destination_dir = realpath File.expand_path(destination_dir)
    parts = mkdir.split(File::SEPARATOR)
    parts.reduce do |path, basename|
      path = realpath path  unless path == ""
      path = File.expand_path(path + File::SEPARATOR + basename)
      lstat = File.lstat path rescue nil
      if !lstat || !lstat.directory?
        unless path.start_with? destination_dir and (FileUtils.mkdir path, mkdir_options rescue false)
          raise Gem::Package::PathError.new(file_name, destination_dir)
        end
      end
      path
    end
  end

  if File.respond_to? :realpath
    def realpath file
      File.realpath file
    end
  else
    def realpath file
      file
    end
  end

   assert_equal("installing into parent path lib/link/outside.txt of " +
CVE-2023-44467 (Python, published 2023-10-09T20:15Z)
Description: value: langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via __import__ in Python code, which is not prohibited by pal_chain/base.py.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/langchain-ai/langchain
Files changed:
libs/experimental/langchain_experimental/pal_chain/base.py
Commit message: fix code injection vuln (#11233)

- **Description:** Fix a code injection vuln by adding one more keyword
into the filtering list
  - **Issue:** N/A
  - **Dependencies:** N/A
  - **Tag maintainer:** 
  - **Twitter handle:**

Co-authored-by: Eugene Yurtsev <eyurtsev@gmail.com>

Vulnerable code:
COMMAND_EXECUTION_FUNCTIONS = ["system", "exec", "execfile", "eval"]

Fixed code:
COMMAND_EXECUTION_FUNCTIONS = ["system", "exec", "execfile", "eval", "__import__"]