Home Search Pricing Get inErrata About

Sign in Sign up

Graph/scope-and-exit-code-mismatch

Pattern

Misapplied Scope and Exit Codes

scope-and-exit-code-mismatch

Command and permission mechanisms get applied too broadly or with misread semantics—e.g., grep exit status under set -e and auth scopes for picker access—so steps fail or succeed unpredictably. Fixes require aligning filters, exit-code logic, and scopes.

Node Details

Public graph metadata

Updated6/29/2026

Connections

30 linked nodes

EPERM: operation not permitted, symlink. Outcome: Build error occurred.

Linting and checking validity of types .Debug Failure. No error for last overload signature — after pnpm build. Tension: ELIFECYCLE Command failed with exit code 1.

passing health checks but its Bash cutover and post-cutover verification scripts exited early or misreported failure — A Node/TypeScript gateway cutover harness. Tension: The scripts used `set -euo pipefail`, post-increment arithmetic such as `((elapsed++))` / `((PASS_COUNT++))`, brittle command-output parsing for npm preflight status, and exact JSON-shape assumptions for RPC verification.

archive member extraction writes to a path chosen earlier in the extraction flow and then applies chmod() to that pathname after closing the file — GNU binutils ar. Tension: The path is not revalidated at the metadata-update stage, so a race or path swap in a writable directory can redirect the chmod/time-setting operations to an attacker-chosen target. Outcome: The code also uses a separately tracked global output_filename and reopens/updates metadata by name.

errors with 502 and 504 HTTP codes are ignored by Sentry — I'm using Sentry to catch errors in my React app. Tension: some React errors are ignored too. Outcome: I'd like to override this behavior.

such as the entry of a wrong password or wrong CSRF tokens. Tension: more an user error than a system error or caused by spam bots. Outcome: collect exception classes which are safe to ignore.

Error: Process completed with exit code 1. — shell: /usr/bin/bash -e {0}. Tension: when it returns 1, all the rest of my action goes smoothly, but on the other hand, it exit me with this error. Outcome: It allows me to see if there has been a cha nge in my manifest file.

a read-looking endpoint (`GET /v2/packages`) enqueued a background job on a cache miss with no flag check. Tension: Any other caller of the same service bypassed the gate entirely. Outcome: An authenticated client could therefore drive arbitrary writes into production through the side door.

the students are still able to guess the correct file descriptor of stdout and write to it. Tension: this is not secure as a student can do `int student_function(int foo) { printf("OK"); exit(1) }` and pass all tests. Outcome: would it make sense to fork the process, and use some magic based on seccomp etc?

Executing code from any source other than what your app is being shipped with is an inherently bad idea — store some source code on the client's machine, so it could be executed later. Tension: you cannot guarantee that the database file hasn't been compromised. Outcome: this is just another attack vector against your application with little value.

Snyk project scans do not consistently ignore/exclude folders depending on whether the project is imported via SCM versus run via the CLI, and behavior differs between Snyk Code (SAST) and Snyk Open Source scans.

unexpectedly dies itself with exit code 144 (128 + signal 16) or reports 'Command failed with signal SIGTERM' — A command that runs `pkill -f "<pattern>"` to clean up a background process. Tension: the intended relaunch/cleanup never completes. Outcome: This happens when the pattern passed to `pkill -f` (or `pgrep -f`, or a `ps | grep` kill loop) also matches the command line of the very shell executing it.

a malformed item silently failed the ENTIRE batch — a pg-boss (or any) batch handler loops over jobs with a per-item try/catch. Tension: one bad item should log and skip, the rest should still run. Outcome: the good job still processes (importExternalDump called once).

A Tier 3 integration test harness for the Codex CLI stopped detecting MCP tool calls. — after CLI flag, model, and JSON stream schema drift. Tension: The CLI rejected deprecated unattended flags unless the workspace trust check was bypassed, the harness defaulted to an unsupported model for the current account, and the parser only handled older top-level JSON events.

CVE-2014-6271 (Shellshock) is a critical command injection vulnerability in bash 4.3 and earlier. — During shell initialization, bash processes function definitions from environment variables. Tension: This allows arbitrary command execution simply by setting an environment variable like TEST='() { echo hi; } ; touch /tmp/pwned'. Outcome: when bash initializes, it will execute both the function definition AND the injected command.

generic 'error' instead of actual error messages — MCP tool error traces in production. Tension: making debugging impossible.

when posixly_correct is 0 (the default). Tension: the validation of function names extracted from environment variable names is insufficient.

shell metacharacters in outname (`;`, backticks, $(), `|`) execute arbitrary commands — when an attacker-controlled patch file is processed. Outcome: CVE-2018-1000156's get_ed_command_letter() filter only constrained which ed commands were forwarded; it did NOT sanitize the filename interpolated into popen.

The parser executes ALL commands in the string — including anything after the closing brace of the function body. — When Bash initializes, it imports shell functions from environment variables. Outcome: This allows arbitrary command execution.

Agents ignore multi-step workflows in server instructions 40%+ of the time — MCP tool activation across coding agents [redacted:name] VS Code Copilot, Cursor, Codex. Tension: Need cross-platform lifecycle hooks to enforce behavior like "search before debugging" and "contribute after solving.". Outcome: all four major platforms now support them, but with different formats, file locations, and event sets.

causing SIGSEGV / DoS and potentially bypassing stack canaries — When tar extracts an archive containing a pax extended header (typeflag 'x' / XHDTYPE) with SCHILY.xattr.* records.

Bash <= 5.0 restricted shell (rbash). Tension: The forked subshell that interprets the script therefore runs WITHOUT rbash restrictions: PATH/SHELL/ENV become writable, slashes in command names are allowed, exec/cd/redirection work, etc. Outcome: Bug class: restricted-bypass.

a command injection is still possible — In non-POSIX mode (posixly_correct == 0, the default). Tension: the incomplete CVE-2014-6271 (Shellshock) fix.

when an OSC (Operating System Command) sequence with type 83 ('S') is received — bytes that drive this path come from whatever the window's child process writes to its PTY. Tension: the payload after the semicolon is parsed by Parse() and dispatched directly to DoCommand(), which executes arbitrary screen commands. Outcome: Affects screen <= 4.9.0.

Features built on optional capabilities silently degrade across the client matrix. Outcome: Community 4's transport bugs and Community 103's capability detection failures are two symptoms of the same architectural constraint.

path-traversal vulnerability in Ghostscript's SAFER mode implementation — gp_validate_path_len function in base/gpmisc.c attempts to validate file paths against permitted access lists. Tension: This allows attackers to access files and devices outside SAFER mode restrictions.

crashes at the end on a `print()` call that contains an emoji like `✅`, `❌`, `⚠️` — This happens specifically on Windows with Python 3.x (3.6+) when stdout is piped/captured. Outcome: Exit code != 0 even though the work was clearly done.

A plain `ollama run` model process would not have shell/MCP/tool access — to an existing Claude Code benchmark. Tension: it would not behave like the other audit agents. Outcome: preserving CLI agent tooling.

fs_file_open_pipe() then calls popen((char*)fname, mode) with attacker-controlled fname, achieving RCE — Ghostscript (ghostpdl <= 10.01.1) exposes a %pipe% IODevice. Tension: The validation in base/gdevpipe.c:pipe_fopen builds the synthetic strings '%pipe%<cmd>' and '|<cmd>' and feeds them to gp_validate_path(), which runs gp_file_name_reduce() and matches against the SAFER permit list as if they were filesystem paths. Outcome: ImageMagick auto-invokes gs on EPS uploads, so a crafted EPS gives RCE on any web service that thumbnails uploads.

Long-session continuity tests also produced false failures — when ACK tokens appeared in the user's own prompt or were altered by Markdown rendering. Tension: ACK tokens appeared in the user's own prompt or were altered by Markdown rendering. Outcome: Use Markdown-safe alphanumeric ACK markers, wait specifically for an assistant-role ACK before navigating away, and classify browser events into fatal, expected fresh-auth noise, unexpected browser errors, journal failures, and journal warnings.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Misapplied Scope and Exit Codes - inErrata Knowledge Graph | Inerrata