An improper neutralization of special elements used in an os command

#!/usr/bin/env python3
# check_cve_2025_53870.py
# Inventory-based verifier for CVE-2025-53870
# Input CSV columns: product,version[,asset]
# Output per row: VULNERABLE / PATCHED / UNKNOWN
# Exit codes:
#   0 = all checked rows PATCHED
#   1 = one or more VULNERABLE rows found
#   2 = no vulnerable rows, but one or more UNKNOWN rows
#   3 = usage / file / parse error

import csv
import re
import sys
from pathlib import Path


def parse_version(v):
    if v is None:
        return None
    v = v.strip()
    m = re.match(r'^(\d+)\.(\d+)(?:\.(\d+))?', v)
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3) or 0)
    return (major, minor, patch)


def normalize_product(p):
    if p is None:
        return None
    p = p.strip().lower().replace('_', '-').replace(' ', '')
    if p in ('fortiap', 'fap'):
        return 'fortiap'
    if p in ('fortiap-w2', 'fortiapw2', 'fap-w2', 'fapw2'):
        return 'fortiap-w2'
    return None


def cmp_ver(a, b):
    return (a > b) - (a < b)


def assess(product, version):
    vp = parse_version(version)
    pr = normalize_product(product)
    if pr is None or vp is None:
        return ('UNKNOWN', 'unrecognized product or version format')

    major, minor, patch = vp

    if pr == 'fortiap':
        if (major, minor) == (7, 6):
            if cmp_ver(vp, (7, 6, 0)) >= 0 and cmp_ver(vp, (7, 6, 3)) < 0:
                return ('VULNERABLE', 'FortiAP 7.6.0 through 7.6.2 affected; fixed in 7.6.3+')
            if cmp_ver(vp, (7, 6, 3)) >= 0:
                return ('PATCHED', 'FortiAP 7.6.3+ not affected by this advisory')
        if (major, minor) == (7, 4):
            if cmp_ver(vp, (7, 4, 0)) >= 0 and cmp_ver(vp, (7, 4, 6)) < 0:
                return ('VULNERABLE', 'FortiAP 7.4.0 through 7.4.5 affected; fixed in 7.4.6+')
            if cmp_ver(vp, (7, 4, 6)) >= 0:
                return ('PATCHED', 'FortiAP 7.4.6+ not affected by this advisory')
        if (major, minor) == (7, 2):
            return ('VULNERABLE', 'All FortiAP 7.2.x versions affected; migrate to a fixed release')
        if (major, minor) == (7, 0):
            return ('VULNERABLE', 'All FortiAP 7.0.x versions affected; migrate to a fixed release')
        if (major, minor) == (6, 4):
            return ('VULNERABLE', 'All FortiAP 6.4.x versions affected; migrate to a fixed release')
        return ('UNKNOWN', 'Version branch not listed in the advisory')

    if pr == 'fortiap-w2':
        if (major, minor) == (7, 4):
            if cmp_ver(vp, (7, 4, 0)) >= 0 and cmp_ver(vp, (7, 4, 5)) < 0:
                return ('VULNERABLE', 'FortiAP-W2 7.4.0 through 7.4.4 affected; fixed in 7.4.5+')
            if cmp_ver(vp, (7, 4, 5)) >= 0:
                return ('PATCHED', 'FortiAP-W2 7.4.5+ not affected by this advisory')
        if (major, minor) == (7, 2):
            if cmp_ver(vp, (7, 2, 0)) >= 0 and cmp_ver(vp, (7, 2, 6)) < 0:
                return ('VULNERABLE', 'FortiAP-W2 7.2.0 through 7.2.5 affected; fixed in 7.2.6+')
            if cmp_ver(vp, (7, 2, 6)) >= 0:
                return ('PATCHED', 'FortiAP-W2 7.2.6+ not affected by this advisory')
        if (major, minor) == (7, 0):
            return ('VULNERABLE', 'All FortiAP-W2 7.0.x versions affected; migrate to a fixed release')
        return ('UNKNOWN', 'Version branch not listed in the advisory')

    return ('UNKNOWN', 'Unhandled product family')


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2025_53870.py <inventory.csv>')
        sys.exit(3)

    path = Path(sys.argv[1])
    if not path.is_file():
        print(f'UNKNOWN - file not found: {path}')
        sys.exit(3)

    vulnerable = 0
    unknown = 0
    checked = 0

    try:
        with path.open(newline='', encoding='utf-8-sig') as fh:
            reader = csv.DictReader(fh)
            required = {'product', 'version'}
            if not required.issubset(set(reader.fieldnames or [])):
                print('UNKNOWN - CSV must contain at least: product,version[,asset]')
                sys.exit(3)

            for row in reader:
                product = row.get('product', '')
                version = row.get('version', '')
                asset = row.get('asset', '').strip() or '(no-asset-id)'
                status, reason = assess(product, version)
                checked += 1
                if status == 'VULNERABLE':
                    vulnerable += 1
                elif status == 'UNKNOWN':
                    unknown += 1
                print(f'{status},{asset},{product},{version},{reason}')
    except Exception as exc:
        print(f'UNKNOWN - failed to read CSV: {exc}')
        sys.exit(3)

    if checked == 0:
        print('UNKNOWN - no rows processed')
        sys.exit(2)

    if vulnerable > 0:
        print(f'VULNERABLE - {vulnerable} of {checked} rows affected')
        sys.exit(1)
    if unknown > 0:
        print(f'UNKNOWN - 0 vulnerable rows found, but {unknown} of {checked} rows need manual review')
        sys.exit(2)

    print(f'PATCHED - all {checked} checked rows are on non-affected versions for this advisory')
    sys.exit(0)


if __name__ == '__main__':
    main()