[GH-ISSUE #4498] [Bug] Cutter provider provenance reports the Rizin backend version #1785

New issue

Closed

opened 2026-10-16 21:10:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:10:14 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 16, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4498

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Official Linux Cutter reports cutter 2.5.0-HEAD-a6f6ad7 through --version, but REA discovery's cutter_version and command Evidence's provider.version contain the embedded Rizin 0.9.1 version, commit, and 17 backend module-version lines.

Reproduction

Start the official Cutter 2.5.0 Qt5 AppImage under Xvfb with the shipped REA Python plugin and a controlled ELF in a private XDG profile.
Run rea list-cutter-sessions --json, then rea cutter-command <session> <generation> ij --json-output --json.
Repeat with stdio MCP list_cutter_sessions / cutter_command; compare the version fields with the AppImage's --version output.

Observed in one completed clean-main workflow and independently in the #3946 working-tree workflow. Both adapters read the ELF correctly; source bytes were unchanged and owned process cleanup was verified.

Expected behavior

The Cutter host version should identify Cutter. Backend version information should not masquerade as the host version in provider provenance. An unavailable host version should remain unknown.

Impact and scope

Misattributed provider provenance in CLI/MCP and repeated unnecessary multiline version text. Other Cutter versions and operating systems were not run. This report makes no token-billing or analysis-speed claim.

REA version

Clean source 180ba03bfddd5916251e81e97a500b1ede7a9eea.

Runtime and platform

Linux x86_64; Node 24.18.0/npm 11.16.0; official Cutter 2.5.0-HEAD-a6f6ad7 Qt5, embedded Rizin 0.9.1. The separate Qt6 plugin-loading problem is upstream rizinorg/cutter#3659.

Target and artifact context

Controlled ELF64, SHA-256 8f89b96d1dd56e1cd649dd5ed81b656de5429f9264bcc92e42ab2dd863d88b31.

Interface

Python bridge, observed through CLI and MCP.

Earliest failure stage

Capture or observation

Relevant output or evidence

Native executable: cutter 2.5.0-HEAD-a6f6ad7.

Both session cutter_version and command provider.version begin with the actual value below (remaining backend module lines omitted):

0.9.1 @ linux-x86-64
commit: c3a90e9226d977f58f4e9c75f78fa6b07afe13c7
0.9.1 rz_arch
0.9.1 rz_lib

Analysis or suspected cause

Source-derived: the _RequestDispatcher constructor assigns cutter.core().getVersionInformation() to cutter_version. That method returns backend information. Cutter v2.5.0's application sets its Qt application version from CUTTER_VERSION_FULL, providing a distinct owning source for the host version.

Additional context

Discovered during #4227; separate from #3946's cancellation fix. Last known good version: NOT_ENOUGH_INFO.

Originally created by @N0zoM1z0 on GitHub (Oct 16, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4498 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior Official Linux Cutter reports `cutter 2.5.0-HEAD-a6f6ad7` through `--version`, but REA discovery's `cutter_version` and command Evidence's `provider.version` contain the embedded Rizin `0.9.1` version, commit, and 17 backend module-version lines. ### Reproduction 1. Start the official Cutter 2.5.0 Qt5 AppImage under Xvfb with the shipped REA Python plugin and a controlled ELF in a private XDG profile. 2. Run `rea list-cutter-sessions --json`, then `rea cutter-command <session> <generation> ij --json-output --json`. 3. Repeat with stdio MCP `list_cutter_sessions` / `cutter_command`; compare the version fields with the AppImage's `--version` output. Observed in one completed clean-main workflow and independently in the #3946 working-tree workflow. Both adapters read the ELF correctly; source bytes were unchanged and owned process cleanup was verified. ### Expected behavior The Cutter host version should identify Cutter. Backend version information should not masquerade as the host version in provider provenance. An unavailable host version should remain unknown. ### Impact and scope Misattributed provider provenance in CLI/MCP and repeated unnecessary multiline version text. Other Cutter versions and operating systems were not run. This report makes no token-billing or analysis-speed claim. ### REA version Clean source `180ba03bfddd5916251e81e97a500b1ede7a9eea`. ### Runtime and platform Linux x86_64; Node 24.18.0/npm 11.16.0; official Cutter `2.5.0-HEAD-a6f6ad7` Qt5, embedded Rizin 0.9.1. The separate Qt6 plugin-loading problem is upstream rizinorg/cutter#3659. ### Target and artifact context Controlled ELF64, SHA-256 `8f89b96d1dd56e1cd649dd5ed81b656de5429f9264bcc92e42ab2dd863d88b31`. ### Interface Python bridge, observed through CLI and MCP. ### Earliest failure stage Capture or observation ### Relevant output or evidence Native executable: `cutter 2.5.0-HEAD-a6f6ad7`. Both session `cutter_version` and command `provider.version` begin with the actual value below (remaining backend module lines omitted): ```text 0.9.1 @ linux-x86-64 commit: c3a90e9226d977f58f4e9c75f78fa6b07afe13c7 0.9.1 rz_arch 0.9.1 rz_lib ``` ### Analysis or suspected cause Source-derived: the [`_RequestDispatcher` constructor](https://github.com/morluto/rea/blob/180ba03bfddd5916251e81e97a500b1ede7a9eea/bridge/cutter/rea_bridge.py) assigns `cutter.core().getVersionInformation()` to `cutter_version`. That method returns backend information. [Cutter v2.5.0's application](https://github.com/rizinorg/cutter/blob/v2.5.0/src/CutterApplication.cpp) sets its Qt application version from `CUTTER_VERSION_FULL`, providing a distinct owning source for the host version. ### Additional context Discovered during #4227; separate from #3946's cancellation fix. Last known good version: `NOT_ENOUGH_INFO`.

bsakaguchi

2026-10-16 21:10:14 +00:00