False Positive at PL1 with the word "builtin"

Hi, i discovered that when trying to test real world requests like

POST /api/v1/admin/settings/theme HTTP/1.1
Host: sandbox.coreruleset.org
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
x-crs-version: latest
x-format-output: txt-matched-rules-extended
Priority: u=0, i
Te: trailers
Connection: keep-alive
Content-Length: 130
Content-Type: application/json

{
  "active_theme": "neon-sunset",
  "extends": "builtin-dark-template",
  "custom_css": ".body { background: #000; }"
}

it says

HTTP/1.1 403 Forbidden
Date: Tue, 08 Sep 2026 07:12:00 GMT
Content-Type: text/plain; charset=iso-8859-1
Connection: keep-alive
X-Unique-ID: ap-1QB-_yXiF8X8LC8IaygAAAME
x-backend: apache-latest
Content-Length: 663

This payload has been tested against the OWASP CRS 
web application firewall. The test was executed using the apache engine and CRS version latest.

The payload is being detected by triggering the following rules:

932260 PL1 Remote Command Execution: Direct Unix Command Execution
949110 PL? Inbound Anomaly Score Exceeded (Total Score: 5)
980170 PL? Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, threshold=5) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=4) - (SQLI=0, XSS=0, RFI=0, LFI=0, RCE=5, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=5)


CRS therefore detects this payload starting with paranoia level 1.

the false positive with the word builtin, it is not blocked properly if it is a malicious command injection it must be at least require a space, a - and builtin-dark-template is not a valid command to be malicious especially at PL1, that not at PL2, that part of our fp test to improve security and usability of the rules

Start by reproducing the supplied request and inspect rule 932260, which reports the PL1 Remote Command Execution match. Check the existing false-positive test coverage for this rule and add a case for “builtin-dark-template”; done means the benign request is not blocked at PL1 while direct Unix command detection remains covered.