Vulnerable code sample

import io
import re
import pandas as pd

# This CVE is fictional. The code is a synthetic example based on the description.

def load_csv_from_agent(csv_data: str, customReadCSV: str):
    """
    Processes a CSV using a customReadCSV parameter which is executed as code.
    A weak validator attempts to blocklist dangerous keywords.
    """
    # Validator uses a static regex blocklist
    if re.search(r"import|os|sys|__", customReadCSV):
        raise ValueError("Potentially malicious code detected in customReadCSV.")

    # The customReadCSV parameter is intended to be a string representation
    # of a dictionary of options for pandas.read_csv.
    # e.g., "{'sep': ';', 'header': None}"
    try:
        # VULNERABLE: The customReadCSV string is executed as Python code, which can be bypassed.
        options = eval(customReadCSV, {"__builtins__": {}}, {})
        
        if not isinstance(options, dict):
            raise TypeError("customReadCSV must evaluate to a dictionary.")

        return pd.read_csv(io.StringIO(csv_data), **options)

    except Exception as e:
        # Error handling for invalid code execution
        raise RuntimeError(f"Failed to execute custom CSV logic: {e}")