Patched code sample

import subprocess
import sys

# A secure execution timeout in seconds
EXECUTION_TIMEOUT = 5

def fixed_notebook_execution_handler(code_to_execute: str):
    """
    Replaces the vulnerable direct `exec()` call with execution
    inside an isolated subprocess.
    
    This is a representative fix for the described arbitrary code execution
    vulnerability. A production-grade sandbox would add further layers of security,
    such as containerization (e.g., Docker), user/group privilege reduction,
    and kernel-level security filters (e.g., seccomp).
    """
    if not isinstance(code_to_execute, str) or not code_to_execute:
        return {"status": "error", "output": "Invalid or empty code provided."}

    try:
        # FIXED: The unsafe exec(code_to_execute) is replaced by this block.
        # The code is run in a separate process with a strict timeout,
        # preventing it from accessing the parent process's memory or
        # running indefinitely. Output is captured from stdout/stderr.
        process = subprocess.run(
            [sys.executable, "-c", code_to_execute],
            capture_output=True,
            text=True,
            timeout=EXECUTION_TIMEOUT,
            check=False  # Do not raise an exception for non-zero exit codes
        )

        if process.returncode == 0:
            return {"status": "success", "output": process.stdout}
        else:
            return {"status": "error", "output": process.stderr}

    except subprocess.TimeoutExpired:
        return {
            "status": "error",
            "output": f"Execution timed out after {EXECUTION_TIMEOUT} seconds."
        }
    except Exception as e:
        # Catch any other unexpected errors during subprocess setup.
        return {"status": "error", "output": f"An unexpected error occurred: {str(e)}"}