Vulnerable code sample

import os

# This represents the malicious payload read from stdin by the vulnerable script.
# It contains a ''' sequence to close the string literal prematurely, followed
# by code to be executed.
malicious_stdin_payload = """'
import os
os.system('echo "VULNERABILITY TRIGGERED: Arbitrary code was executed"')
# The rest of the original string is now a comment.
'''"""

# This simulates the vulnerable script's logic, which dynamically creates
# another Python script as a string using the input from stdin.
vulnerable_generated_script_string = f"""
def display_status(info_data):
    # This function is intended to display some status info.
    print("--- Quota Status ---")
    print(info_data)
    print("--------------------")

# The user-controlled payload from stdin is directly and unsafely interpolated
# into a triple-quoted string literal.
user_info = '''{malicious_stdin_payload}'''

display_status(user_info)
"""

# In the actual vulnerability, the shell script would pipe this generated
# string to a Python interpreter for execution.
# We use exec() here to simulate that final execution step.
exec(vulnerable_generated_script_string)