[Responsible Disclosure] Uninitialized variable crashes blackout detection on Redis failure — HIGH (CWE-457)

[dom-omg]

Repo: github.com/hq-opensource/building-intelligence
Channel: GitHub Issue — label: security / vulnerability
Subject: [Responsible Disclosure] Uninitialized variable crashes blackout detection on Redis failure — building-intelligence

---

Hello,

My name is Dominik Blain, Co-Founder at QreativeLab (Gatineau, QC). I conduct formal verification analysis of open-source software using AST analysis, Z3 SMT solver, and runtime verification.

I identified a control-flow defect in hq-opensource/building-intelligence where a Redis connection failure causes a NameError that crashes the GRAP blackout detection component. Blackout events go unprocessed silently.

I am disclosing under a 90-day responsible disclosure window. No public technical details before the window expires or a fix is confirmed.

---

Finding HQ-003 — HIGH

File: data-engine/src/data_engine/grap/detect_blackout.py, line 67
CWE: CWE-457 — Use of Uninitialized Variable
Type: Control-flow Issue (CI)

Vulnerable code:

try:
    grap_info = redis_client.safe_read_from_redis(
        GRAP_KEY, GrapInfo, logger
    )
except Exception as e:
    logger.error("Grap info not found in redis: %s", e)
    # <- no return, no initialization of grap_info

if grap_info is None:        # line 67: NameError if exception raised above
    logger.warning(...)
    return

Root cause:
grap_info is only assigned inside the try block. If safe_read_from_redis() raises any exception (network timeout, Redis restart, serialization error), the except handler logs the error and falls through without returning or initializing grap_info. The subsequent if grap_info is None raises NameError: name 'grap_info' is not defined.

Confirmed via AST analysis:

Function: detect_blackout (line 45)
Line 67: 'grap_info' referenced after try/except block
         Assignment only inside try body -- UNBOUND on exception path

Impact:
During any Redis failure:

1. detect_blackout() crashes with NameError
2. The GRAP blackout detector does not activate
3. Blackout events are silently missed -- no fallback, no alert
4. The outer exception handler suppresses the crash -- no visible error to operators

Fix:

grap_info = None   # initialize before try block
try:
    grap_info = redis_client.safe_read_from_redis(GRAP_KEY, GrapInfo, logger)
except Exception as e:
    logger.error("Grap info not found in redis: %s", e)
    return

if grap_info is None:
    ...

---

Timeline

• 2026-04-02 -- Initial disclosure sent
• 2026-07-01 -- 90-day window expires (public disclosure if no response)

Happy to provide the full AST verification script or additional context.

---

Dominik Blain
Co-Founder, QreativeLab
Gatineau, QC
security@qreativelab.io
https://cobalt-live.vercel.app