Patched code sample

import ast

def fixed_vector_in(data_from_server: str):
    """
    Represents the fixed version of the vulnerable function.

    The original vulnerability (CVE-2026-8838) was due to the use of `eval()`
    on data received from a server. A malicious actor could provide a
    string containing arbitrary code, which `eval()` would execute.

    This fix replaces the dangerous `eval()` with `ast.literal_eval()`,
    which safely parses only Python literals (e.g., strings, numbers, lists,
    dicts) and raises an exception for any other code, preventing execution.
    """
    # The original vulnerable code would have been:
    # return eval(data_from_server)

    # The fixed code safely evaluates the string:
    return ast.literal_eval(data_from_server)

# --- Demonstration of how the fix works ---

# 1. Example of a legitimate server response (a list of values).
#    This is processed correctly and safely by the fixed function.
legitimate_data = "['value1', 123, 'value2']"
parsed_legitimate_data = fixed_vector_in(legitimate_data)
# The variable `parsed_legitimate_data` now holds the list: ['value1', 123, 'value2']


# 2. Example of a malicious server response.
#    The `eval()` function would have executed this code.
malicious_payload = "__import__('os').system('echo Malicious code executed!')"

try:
    # The fixed function `fixed_vector_in` is called.
    # Instead of executing the code, `ast.literal_eval` detects that the
    # string is not a literal and raises a ValueError.
    fixed_vector_in(malicious_payload)
except ValueError:
    # This exception correctly prevents the arbitrary code from running.
    # The vulnerability is successfully mitigated.
    pass