Terminal-Bench 2.1terminalPythonJSON Lines
Fix CRLF injection in Bottle headers
Identify and repair the Bottle header-validation flaw that permits CRLF injection, report its CWE, and preserve the repository's test behavior.
fix-code-vulnerability
Normalized profile
What this task asks for
Identify and repair the Bottle header-validation flaw that permits CRLF injection, report its CWE, and preserve the repository's test behavior. Report /app/bottle.py with CWE-93. Reject carriage-return and line-feed input. Raise the expected specific error type for invalid input. Make the full pytest suite pass.
Intent
- security remediation
- bug repair
- test and validation
Work surfaces
- HTTP header handling
- input validation
Technology
- Bottle
- WSGI
- HTTP headers
- CWE
Expected artifacts
- patched /app/bottle.py
- /app/report.jsonl
What makes it difficult
- security-sensitive or adversarial behavior
- strict behavioral compatibility or exact-output validation
- cross-language or cross-format integration
Published evidence
Model × harness outcomes
Counts are tied to these exact configurations. Harnesses are not treated as equivalent across benchmarks.
- Models
- 13
- Configurations
- 20
- Trials
- 100
Showing 20 of 20 configurations
| Model | Harness | Effort | Result | Passes |
|---|---|---|---|---|
| claude-fable-5anthropic · 2026-06-07 | claude-code2.1.167 | xhigh | All passed | 5/5 |
| claude-fable-5anthropic · 2026-06-05 | terminus-22.0.0 | high | All passed | 5/5 |
| claude-opus-4-7anthropic · 2026-05-01 | claude-code2.1.123 | max | All passed | 5/5 |
| claude-opus-4-7anthropic · 2026-05-01 | terminus-22.0.0 | max | All passed | 5/5 |
| claude-opus-4-8anthropic · 2026-07-09 | claude-code2.1.205 | high | All passed | 5/5 |
| claude-sonnet-5anthropic · 2026-07-09 | claude-code2.1.205 | high | All passed | 5/5 |
| gemini-3-pro-previewgemini · 2026-05-01 | gemini-cli0.40.0 | high | All passed | 5/5 |
| gemini-3-pro-previewgemini · 2026-05-01 | terminus-22.0.0 | high | All passed | 5/5 |
| gemini-3.1-pro-previewgemini · 2026-05-05 | gemini-cli0.40.0 | high | All passed | 5/5 |
| gemini-3.1-pro-previewgemini · 2026-05-05 | terminus-22.0.0 | high | Mixed1 disqualified | 4/5 |
| glm-5.1zai · 2026-05-01 | claude-code2.1.123 | max | All passed | 5/5 |
| gpt-5.5openai · 2026-05-01 | codex0.125.0 | xhigh | All passed | 5/5 |
| gpt-5.5openai · 2026-05-01 | terminus-22.0.0 | xhigh | All passed | 5/5 |
| gpt-5.6-lunaopenai · 2026-07-10 | codex0.144.0 | max | All passed | 5/5 |
| gpt-5.6-lunaopenai · 2026-07-11 | codex0.144.1 | max | Mixed3 disqualified | 2/5 |
| gpt-5.6-solopenai · 2026-07-10 | codex0.144.0 | max | All passed | 5/5 |
| gpt-5.6-terraopenai · 2026-07-10 | codex0.144.0 | max | All passed | 5/5 |
| gpt-5.6-terraopenai · 2026-07-11 | codex0.144.1 | max | Mixed1 disqualified | 4/5 |
| grok-4.5cursor · 2026-07-09 | cursor-cli2026.07.08-0c04a8a | default | All passed | 5/5 |
| muse-spark-1.1openai · 2026-07-09 | mini-swe-agent2.4.5 | xhigh | All passed | 5/5 |