Scan report

django / django

View on GitHub (opens in a new tab)
Python
88234 stars
Scanned 30 Jul 2026, 17:08

Vulnerability Critical

Could an attacker exploit mistakes in this code?

425 risk score

Strong warning signs. Do not run or install this without a careful review.

High: 0
Medium: 166
Low: 96

Sources: Bandit, Semgrep, pip-audit

Malicious pattern Low

Does this code look like it is trying to cause harm?

5 risk score

Minor issues. Worth a glance, unlikely to be urgent.

High: 8
Medium: 1
Low: 12

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

283 total findings

Likely real: 134
Uncertain: 59
Likely noise: 90

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

This repository has two distinct security issues that require immediate attention from developers. The most critical finding is a high-risk vulnerability score of 425, which indicates the code contains dangerous patterns like downloading and executing remote files or reconstructing strings to execute them, suggesting an attacker could exploit these flaws. While the overall malicious-pattern risk is low at 5, there are several medium-severity issues that look more like ordinary insecure coding practices than signs of intentional harm, such as using untrusted XML parsers, relying on weak hashes like MD5 and SHA1, and allowing file schemes in URLs. These specific problems, including potential SQL injection risks and unpinned dependencies, should be fixed before the code is used in production to prevent data breaches or system compromise.

Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.

Detections by engine

Bandit 262

Python security linter · Vulnerability
YARA 12

Malware signature rules · Malicious pattern
Dependency checker 9

CVEs, typosquats and risky installs · Supply chain

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Large result: showing the top 221 of 283 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 245

Likely real
Yes, 98% confidence

Using xml.dom.pulldom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.pulldom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
```
244         self.handle_forward_references = options.pop("handle_forward_references", False)
245         self.event_stream = pulldom.parse(self.stream, self._make_parser())
246         self.db = using
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 525

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
524     """
525     return [mark_safe(obj) for obj in value]
526
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 62

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
61     """
62     return SafeString(html.escape(str(text)))
63
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 738

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
737 
738     return mark_safe(list_formatter(value))
739
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 621

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
620         return value
621     return mark_safe(data)
622
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 68

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
69
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_filters.py line 79

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
78 
79     return mark_safe(rendered_object_list + remaining_objects_message)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 29

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
28     if number is None or number == "":
29         return mark_safe(number)
30     if use_l10n is None:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 256

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
255                     context.pop()
256         return mark_safe("".join(nodelist))
257
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/loader_tags.py line 82

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
81         ):
82             return mark_safe(self.render(self.context))
83         return ""
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/templatetags/i18n.py line 96

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
95         value = value.replace("%%", "%")
96         value = mark_safe(value) if is_safe else value
97         if self.asvar:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/templatetags/i18n.py line 201

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
200         if self.asvar:
201             context[self.asvar] = SafeString(result)
202             return ""
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 90

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
89     """Hex encode characters for use in JavaScript strings."""
90     return mark_safe(str(value).translate(_js_escapes))
91
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 113

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
112         template = '<script id="{}" type="application/json">{}</script>'
113         args = (element_id, mark_safe(json_str))
114     else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 116

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
115         template = '<script type="application/json">{}</script>'
116         args = (mark_safe(json_str),)
117     return format_html(template, *args)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 145

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
144     kwargs_safe = {k: conditional_escape(v) for (k, v) in kwargs.items()}
145     return mark_safe(format_string.format(*args_safe, **kwargs_safe))
146
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/utils/html.py line 162
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

161     """
162     return mark_safe(
163         conditional_escape(sep).join(
164             (
165                 format_html(format_string, **args)
166                 if isinstance(args, Mapping)
167                 else format_html(format_string, *args)
168             )
169             for args in args_generator
170         )
171     )
172

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 400

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
399                 )
400                 return SafeString(f"{lead}{middle}{trail}")
401             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 403

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
402                 if safe_input:
403                     return mark_safe(word)
404                 elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 407

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
406         elif safe_input:
407             return mark_safe(word)
408         elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 532

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
531     klass_str = klass.__str__
532     klass.__str__ = lambda self: mark_safe(klass_str(self))
533     klass.__html__ = lambda self: str(self)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 432

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
431         except AttributeError:
432             return mark_safe(self.admin_site.empty_value_display)
433
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 37

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
36     if isinstance(number, int) and not use_grouping and not decimal_pos:
37         return mark_safe(number)
38     # sign
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 392

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
391     if isinstance(message, SafeData):
392         return mark_safe(result)
393
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 404

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
403     elif isinstance(message, SafeData):
404         result = mark_safe(result)
405     return result
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/admin/helpers.py line 161
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

160     def errors(self):
161         return mark_safe(
162             "\n".join(
163                 self.form[f].errors.as_ul()
164                 for f in self.fields
165                 if f not in self.readonly_fields
166             ).strip("\n")
167         )
168

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 430

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
429         try:
430             return mark_safe(self.empty_value_display)
431         except AttributeError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 193

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
192         return self.field.label_tag(
193             contents=mark_safe(contents),
194             attrs=attrs,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 200

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
199     def errors(self):
200         return mark_safe(self.field.errors.as_ul())
201
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 515

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
514     """Mark the value as a string that should not be auto-escaped."""
515     return mark_safe(value)
516
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/admin/templatetags/admin_list.py line 106
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

105                 yield {
106                     "text": SafeString(
107                         f'<input type="checkbox" id="action-toggle" '
108                         f'aria-label="{aria_label}">'
109                     ),
110                     "class_attrib": SafeString(' class="action-checkbox-column"'),

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 265

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
264                     row_classes.append("nowrap")
265         row_class = SafeString(' class="%s"' % " ".join(row_classes))
266         # If list_display_links not defined, add the link tag to the first
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 316

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
315                 bf = form[field_name]
316                 result_repr = mark_safe(str(bf.errors) + str(bf))
317             yield format_html("<td{}>{}</td>", row_class, result_repr)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 347

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
346             if form[cl.model._meta.pk.name].is_hidden:
347                 yield mark_safe(form[cl.model._meta.pk.name])
348
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 67

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
66     # content in the first place).
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/humanize/templatetags/humanize.py line 69

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
68     # Mark value safe so i18n does not break with <sup> or <sub> see #19988
69     return mark_safe(value)
70
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/messages/storage/cookie.py line 38

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
37                 if obj[1]:
38                     obj[3] = mark_safe(obj[3])
39                 return Message(*obj[2:])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/utils.py line 55

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
54         context = context or self.get_context()
55         return mark_safe(renderer.render(template, context))
56
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/forms/widgets.py line 186
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

185     def render(self, *, attrs=None):
186         return mark_safe(
187             "\n".join(
188                 chain.from_iterable(
189                     getattr(self, "render_" + name)(attrs=attrs) for name in MEDIA_TYPES
190                 )
191             )
192         )
193

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/widgets.py line 381

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
380             renderer = get_default_renderer()
381         return mark_safe(renderer.render(template_name, context))
382
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 825

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
824                 if not lookup:
825                     arg_vals.append(mark_safe(arg))
826                 else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 835

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
834             if getattr(func, "is_safe", False) and isinstance(obj, SafeData):
835                 obj = mark_safe(new_obj)
836             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 952

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
951             msgid = value.replace("%", "%%")
952             msgid = mark_safe(msgid) if is_safe else msgid
953             if self.message_context:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 923

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
922             try:
923                 self.literal = mark_safe(unescape_string_literal(var))
924             except ValueError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 61

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
60         if self.setting:
61             return mark_safe(output)
62         else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 508

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
507         value = escape(value)
508     return mark_safe(value.replace("\n", "<br>"))
509
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 494

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
493     autoescape = autoescape and not isinstance(value, SafeData)
494     return mark_safe(linebreaks(value, autoescape))
495
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 448

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
447     if safe and arg != ";":
448         return mark_safe(value)
449     return value
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 398

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
397     """
398     return mark_safe(
399         _urlize(value, trim_url_limit=int(limit), nofollow=True, autoescape=autoescape)
400     )
401
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 386

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
385     """Convert URLs in plain text into clickable links."""
386     return mark_safe(_urlize(value, nofollow=True, autoescape=autoescape))
387
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 244

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
243             lines[i] = ("%0" + width + "d. %s") % (i + 1, escape(line))
244     return mark_safe("\n".join(lines))
245
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 213

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
212     number = "".join(reversed(digits))
213     return mark_safe(
214         formats.number_format(
215             number,
216             abs(p),
217             use_l10n=use_l10n,
218             force_grouping=force_grouping,
219         )
220     )
221
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/template/defaultfilters.py line 185
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

184     if not m and p <= 0:
185         return mark_safe(
186             formats.number_format(
187                 "%d" % (int(d)),
188                 0,
189                 use_l10n=use_l10n,
190                 force_grouping=force_grouping,
191             )
192         )
193

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 49

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
48         if isinstance(first, SafeData) and getattr(unwrap(func), "is_safe", False):
49             result = mark_safe(result)
50         return result
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 1108

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
1107     def render(self, context):
1108         return SafeString("".join([node.render_annotated(context) for node in self]))
1109
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 515

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
514     """Mark the value as a string that should not be auto-escaped."""
515     return mark_safe(value)
516
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 525

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
524     """
525     return [mark_safe(obj) for obj in value]
526
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 621

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
620         return value
621     return mark_safe(data)
622
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 738

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
737 
738     return mark_safe(list_formatter(value))
739
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 61

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
60         if self.setting:
61             return mark_safe(output)
62         else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 256

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
255                     context.pop()
256         return mark_safe("".join(nodelist))
257
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/loader_tags.py line 82

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
81         ):
82             return mark_safe(self.render(self.context))
83         return ""
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/templatetags/i18n.py line 96

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
95         value = value.replace("%%", "%")
96         value = mark_safe(value) if is_safe else value
97         if self.asvar:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 90

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
89     """Hex encode characters for use in JavaScript strings."""
90     return mark_safe(str(value).translate(_js_escapes))
91
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 113

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
112         template = '<script id="{}" type="application/json">{}</script>'
113         args = (element_id, mark_safe(json_str))
114     else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 116

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
115         template = '<script type="application/json">{}</script>'
116         args = (mark_safe(json_str),)
117     return format_html(template, *args)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 145

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
144     kwargs_safe = {k: conditional_escape(v) for (k, v) in kwargs.items()}
145     return mark_safe(format_string.format(*args_safe, **kwargs_safe))
146
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/utils/html.py line 162
Likely real: Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.

161     """
162     return mark_safe(
163         conditional_escape(sep).join(
164             (
165                 format_html(format_string, **args)
166                 if isinstance(args, Mapping)
167                 else format_html(format_string, *args)
168             )
169             for args in args_generator
170         )
171     )
172

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 403

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
402                 if safe_input:
403                     return mark_safe(word)
404                 elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 407

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
406         elif safe_input:
407             return mark_safe(word)
408         elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 532

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
531     klass_str = klass.__str__
532     klass.__str__ = lambda self: mark_safe(klass_str(self))
533     klass.__html__ = lambda self: str(self)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 29

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
28     if number is None or number == "":
29         return mark_safe(number)
30     if use_l10n is None:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 37

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
36     if isinstance(number, int) and not use_grouping and not decimal_pos:
37         return mark_safe(number)
38     # sign
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 392

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
391     if isinstance(message, SafeData):
392         return mark_safe(result)
393
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 404

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
403     elif isinstance(message, SafeData):
404         result = mark_safe(result)
405     return result
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_filters.py line 79

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
78 
79     return mark_safe(rendered_object_list + remaining_objects_message)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 494

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
493     autoescape = autoescape and not isinstance(value, SafeData)
494     return mark_safe(linebreaks(value, autoescape))
495
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 161

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
160     def errors(self):
161         return mark_safe(
162             "\n".join(
163                 self.form[f].errors.as_ul()
164                 for f in self.fields
165                 if f not in self.readonly_fields
166             ).strip("\n")
167         )
168
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 193

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
192         return self.field.label_tag(
193             contents=mark_safe(contents),
194             attrs=attrs,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 200

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
199     def errors(self):
200         return mark_safe(self.field.errors.as_ul())
201
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 430

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
429         try:
430             return mark_safe(self.empty_value_display)
431         except AttributeError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 432

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
431         except AttributeError:
432             return mark_safe(self.admin_site.empty_value_display)
433
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_filters.py line 33

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
32         if max_items <= 0:
33             return mark_safe("")
34
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 316

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
315                 bf = form[field_name]
316                 result_repr = mark_safe(str(bf.errors) + str(bf))
317             yield format_html("<td{}>{}</td>", row_class, result_repr)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 347

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
346             if form[cl.model._meta.pk.name].is_hidden:
347                 yield mark_safe(form[cl.model._meta.pk.name])
348
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 67

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
66     # content in the first place).
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 68

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
69
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/humanize/templatetags/humanize.py line 69

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
68     # Mark value safe so i18n does not break with <sup> or <sub> see #19988
69     return mark_safe(value)
70
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/messages/storage/cookie.py line 38

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
37                 if obj[1]:
38                     obj[3] = mark_safe(obj[3])
39                 return Message(*obj[2:])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/utils.py line 55

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
54         context = context or self.get_context()
55         return mark_safe(renderer.render(template, context))
56
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/widgets.py line 186

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
185     def render(self, *, attrs=None):
186         return mark_safe(
187             "\n".join(
188                 chain.from_iterable(
189                     getattr(self, "render_" + name)(attrs=attrs) for name in MEDIA_TYPES
190                 )
191             )
192         )
193
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/widgets.py line 381

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
380             renderer = get_default_renderer()
381         return mark_safe(renderer.render(template_name, context))
382
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 825

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
824                 if not lookup:
825                     arg_vals.append(mark_safe(arg))
826                 else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 835

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
834             if getattr(func, "is_safe", False) and isinstance(obj, SafeData):
835                 obj = mark_safe(new_obj)
836             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 923

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
922             try:
923                 self.literal = mark_safe(unescape_string_literal(var))
924             except ValueError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 952

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
951             msgid = value.replace("%", "%%")
952             msgid = mark_safe(msgid) if is_safe else msgid
953             if self.message_context:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 49

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
48         if isinstance(first, SafeData) and getattr(unwrap(func), "is_safe", False):
49             result = mark_safe(result)
50         return result
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 185

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
184     if not m and p <= 0:
185         return mark_safe(
186             formats.number_format(
187                 "%d" % (int(d)),
188                 0,
189                 use_l10n=use_l10n,
190                 force_grouping=force_grouping,
191             )
192         )
193
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 213

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
212     number = "".join(reversed(digits))
213     return mark_safe(
214         formats.number_format(
215             number,
216             abs(p),
217             use_l10n=use_l10n,
218             force_grouping=force_grouping,
219         )
220     )
221
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 244

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
243             lines[i] = ("%0" + width + "d. %s") % (i + 1, escape(line))
244     return mark_safe("\n".join(lines))
245
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 386

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
385     """Convert URLs in plain text into clickable links."""
386     return mark_safe(_urlize(value, nofollow=True, autoescape=autoescape))
387
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 398

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
397     """
398     return mark_safe(
399         _urlize(value, trim_url_limit=int(limit), nofollow=True, autoescape=autoescape)
400     )
401
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 448

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
447     if safe and arg != ";":
448         return mark_safe(value)
449     return value
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 508

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
507         value = escape(value)
508     return mark_safe(value.replace("\n", "<br>"))
509
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/query.py line 2610

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
2609                         extra_names.append(f)
2610                         selected[f] = RawSQL(*extra)
2611                     elif f in self.annotation_select:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2028

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
2027             sql, params = innerq.get_compiler(connection=self.connection).as_sql()
2028             innerq = RawSQL("SELECT * FROM (%s) subquery" % sql, params)
2029         outerq.add_filter("pk__in", innerq)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 463

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
462                     yield (
463                         OrderBy(RawSQL(*self.query.extra[col]), descending=descending),
464                         False,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 456

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
455                         OrderBy(
456                             Ref(col, RawSQL(*self.query.extra[col])),
457                             descending=descending,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 445

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
444                     OrderBy(
445                         RawSQL("%s.%s" % (self.quote_name(table), col), []),
446                         descending=descending,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 275

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
274                 *(
275                     (alias, RawSQL(*args))
276                     for alias, args in self.query.extra_select.items()
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/models/fields/related_descriptors.py line 1229
Likely real: Yes, 98% confidence

Use of extra potential SQL attack vector.

1228             qn = connection.ops.quote_name
1229             queryset = queryset.extra(
1230                 select={
1231                     "_prefetch_related_val_%s"
1232                     % f.attname: "%s.%s"
1233                     % (qn(join_table), qn(f.column))
1234                     for f in fk.local_related_fields
1235                 }
1236             )
1237             # Restore subsequent cloning operations.

Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Yes, 54% confidence

Unpinned dependency: 'tzdata' has no version lock — supply chain risk
```
tzdata; sys_platform == 'win32'
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/loaders/cached.py line 96

Likely real
Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False
```
95     def generate_hash(self, values):
96         return hashlib.sha1("|".join(values).encode()).hexdigest()
97
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/hashers.py line 665

Likely real
Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False
```
664         self._check_encode_args(password, salt)
665         hash = hashlib.md5(force_bytes(salt) + force_bytes(password)).hexdigest()
666         return "%s$%s$%s" % (self.algorithm, force_str(salt), hash)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/pr_quality/check_pr.py line 189

Likely real
Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
```
188     try:
189         with urllib.request.urlopen(url, timeout=URLOPEN_TIMEOUT_SECONDS) as response:
190             return json.loads(response.read())
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/pr_quality/check_pr.py line 105

Likely real
Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
```
104     req = urllib.request.Request(url, data=body, headers=headers, method=method)
105     with urllib.request.urlopen(req, timeout=URLOPEN_TIMEOUT_SECONDS) as response:
106         if response.status != HTTPStatus.NO_CONTENT:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/sqlite3/_functions.py line 460

Likely real
Uncertain, 48% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False
```
459         return None
460     return sha1(text.encode()).hexdigest()
461
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/sqlite3/_functions.py line 414

Likely real
Uncertain, 48% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False
```
413         return None
414     return md5(text.encode()).hexdigest()
415
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 302

Likely real
Uncertain, 47% confidence

Possible SQL injection vector through string-based query construction.
```
301         with connection.cursor() as cursor:
302             cursor.execute("DELETE FROM %s" % table)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 649

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
648             if not features.supports_parentheses_in_compound:
649                 part_sql = "SELECT * FROM ({})".format(part_sql)
650             # Add parentheses when combining with compound query if not
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 272

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
271             cursor.execute(
272                 "DELETE FROM %s WHERE %s < %%s"
273                 % (
274                     table,
275                     connection.ops.quote_name("expires"),
276                 ),
277                 [connection.ops.adapt_datetimefield_value(now)],
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 254
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

253             cursor.execute(
254                 "SELECT %s FROM %s WHERE %s = %%s and %s > %%s"
255                 % (
256                     quote_name("cache_key"),
257                     quote_name(self._table),
258                     quote_name("cache_key"),
259                     quote_name("expires"),
260                 ),
261                 [key, connection.ops.adapt_datetimefield_value(now)],

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 289

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
288                     cursor.execute(
289                         "DELETE FROM %s WHERE %s < %%s"
290                         % (
291                             table,
292                             connection.ops.quote_name("cache_key"),
293                         ),
294                         [last_cache_key[0]],
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 233

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
232             cursor.execute(
233                 "DELETE FROM %s WHERE %s IN (%s)"
234                 % (
235                     table,
236                     quote_name("cache_key"),
237                     ", ".join(["%s"] * len(keys)),
238                 ),
239                 keys,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 177

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
176                         cursor.execute(
177                             "UPDATE %s SET %s = %%s WHERE %s = %%s"
178                             % (table, quote_name("expires"), quote_name("cache_key")),
179                             [exp, key],
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 151
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

150                     cursor.execute(
151                         "SELECT %s, %s FROM %s WHERE %s = %%s"
152                         % (
153                             quote_name("cache_key"),
154                             quote_name("expires"),
155                             table,
156                             quote_name("cache_key"),
157                         ),
158                         [key],

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 136

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
135             if self._cull_probability and random.random() <= self._cull_probability:
136                 cursor.execute("SELECT COUNT(*) FROM %s" % table)
137                 num = cursor.fetchone()[0]
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2253

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
2252         ).as_sql(with_col_aliases=True)
2253         sql = "SELECT %s FROM (%s) subquery" % (sql, inner_query_sql)
2254         params += inner_query_params
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2028

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
2027             sql, params = innerq.get_compiler(connection=self.connection).as_sql()
2028             innerq = RawSQL("SELECT * FROM (%s) subquery" % sql, params)
2029         outerq.add_filter("pk__in", innerq)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2001

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
2000     def _as_sql(self, query):
2001         delete = "DELETE FROM %s" % self.quote_name(query.base_table)
2002         try:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 974

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
973                         sub_params.extend(subparams)
974                 return "SELECT %s FROM (%s) subquery" % (
975                     ", ".join(sub_selects),
976                     " ".join(result),
977                 ), tuple(sub_params + params)
978
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/functions/text.py line 272

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
271             template=(
272                 "(SELECT LISTAGG(s) WITHIN GROUP (ORDER BY n DESC) FROM "
273                 f"(SELECT LEVEL n, SUBSTR(%(expressions)s, LEVEL, 1) s{suffix} "
274                 "CONNECT BY LEVEL <= LENGTH(%(expressions)s)) "
275                 "GROUP BY %(expressions)s)"
276             ),
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/schema.py line 257
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

256         self.execute(
257             "INSERT INTO %s (%s) SELECT %s FROM %s"
258             % (
259                 self.quote_name(new_model._meta.db_table),
260                 ", ".join(self.quote_name(x) for x in mapping),
261                 ", ".join(mapping.values()),
262                 self.quote_name(model._meta.db_table),
263             )
264         )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/base.py line 295
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

294                 primary_key_value, bad_value = cursor.execute(
295                     "SELECT %s, %s FROM %s WHERE rowid = %%s"
296                     % (
297                         self.ops.quote_name(primary_key_column_name),
298                         self.ops.quote_name(column_name),
299                         self.ops.quote_name(table_name),
300                     ),
301                     (rowid,),

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/postgresql/operations.py line 155

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
154         if isinstance(placeholder_rows, InsertUnnest):
155             return f"SELECT * FROM {placeholder_rows}"
156         return super().bulk_insert_sql(fields, placeholder_rows)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/postgresql/introspection.py line 120

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
119         cursor.execute(
120             "SELECT * FROM %s LIMIT 1" % self.connection.ops.quote_name(table_name)
121         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/schema.py line 146

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
145         self.execute(
146             "UPDATE %s set %s=%s"
147             % (
148                 self.quote_name(model._meta.db_table),
149                 self.quote_name(new_temp_field.column),
150                 new_value,
151             )
152         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/operations.py line 688

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
687         # UNION operator. To prevent incorrect SQL, move UNION to a subquery.
688         return "SELECT * FROM (%s)" % " UNION ALL ".join(query)
689
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/operations.py line 73

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
72         return (
73             f"SELECT {cache_key} "
74             f"FROM %s "
75             f"ORDER BY {cache_key} OFFSET %%s ROWS FETCH FIRST 1 ROWS ONLY"
76         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/introspection.py line 179

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
178         cursor.execute(
179             "SELECT * FROM {} WHERE ROWNUM < 2 AND {} > 0".format(
180                 self.connection.ops.quote_name(table_name), self.cache_bust_counter
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/base.py line 338

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
337                 cursor.execute(
338                     "SELECT 1 FROM DUAL WHERE DUMMY %s"
339                     % self._standard_operators["contains"],
340                     ["X"],
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/mysql/schema.py line 94

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
93             self.execute(
94                 "UPDATE %(table)s SET %(column)s = %%s"
95                 % {
96                     "table": self.quote_name(model._meta.db_table),
97                     "column": self.quote_name(field.column),
98                 },
99                 [effective_default],
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/mysql/introspection.py line 160

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
159         cursor.execute(
160             "SELECT * FROM %s LIMIT 1" % self.connection.ops.quote_name(table_name)
161         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/base/operations.py line 112

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
111         cache_key = self.quote_name("cache_key")
112         return f"SELECT {cache_key} FROM %s ORDER BY {cache_key} LIMIT 1 OFFSET %%s"
113
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/operations.py line 391
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

390         ):
391             return "ON CONFLICT(%s) DO UPDATE SET %s" % (
392                 ", ".join(map(self.quote_name, unique_fields)),
393                 ", ".join(
394                     [
395                         f"{field} = EXCLUDED.{field}"
396                         for field in map(self.quote_name, update_fields)
397                     ]
398                 ),
399             )
400         return super().on_conflict_suffix_sql(

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 76
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

75             cursor.execute(
76                 "SELECT %s, %s, %s FROM %s WHERE %s IN (%s)"
77                 % (
78                     quote_name("cache_key"),
79                     quote_name("value"),
80                     quote_name("expires"),
81                     table,
82                     quote_name("cache_key"),
83                     ", ".join(["%s"] * len(key_map)),
84                 ),
85                 list(key_map),

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 185
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

184                         cursor.execute(
185                             "UPDATE %s SET %s = %%s, %s = %%s WHERE %s = %%s"
186                             % (
187                                 table,
188                                 quote_name("value"),
189                                 quote_name("expires"),
190                                 quote_name("cache_key"),
191                             ),
192                             [b64encoded, exp, key],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 196
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

195                         cursor.execute(
196                             "INSERT INTO %s (%s, %s, %s) VALUES (%%s, %%s, %%s)"
197                             % (
198                                 table,
199                                 quote_name("cache_key"),
200                                 quote_name("value"),
201                                 quote_name("expires"),
202                             ),
203                             [key, b64encoded, exp],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/mysql/base.py line 340
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

339                     cursor.execute(
340                         """
341                         SELECT REFERRING.`%s`, REFERRING.`%s` FROM `%s` as REFERRING
342                         LEFT JOIN `%s` as REFERRED
343                         ON (REFERRING.`%s` = REFERRED.`%s`)
344                         WHERE REFERRING.`%s` IS NOT NULL AND REFERRED.`%s` IS NULL
345                         """
346                         % (
347                             primary_key_column_name,
348                             column_name,
349                             table_name,
350                             referenced_table_name,
351                             column_name,
352                             referenced_column_name,
353                             column_name,
354                             referenced_column_name,
355                         )
356                     )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/oracle/schema.py line 55
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

54         self.execute(
55             """
56             DECLARE
57                 i INTEGER;
58             BEGIN
59                 SELECT COUNT(1) INTO i FROM USER_SEQUENCES
60                     WHERE SEQUENCE_NAME = '%(sq_name)s';
61                 IF i = 1 THEN
62                     EXECUTE IMMEDIATE 'DROP SEQUENCE "%(sq_name)s"';
63                 END IF;
64             END;
65         /"""
66             % {
67                 "sq_name": self.connection.ops._get_no_autofield_sequence_name(
68                     model._meta.db_table
69                 )
70             }
71         )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/postgresql/operations.py line 381
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

380         if on_conflict == OnConflict.UPDATE:
381             return "ON CONFLICT(%s) DO UPDATE SET %s" % (
382                 ", ".join(map(self.quote_name, unique_fields)),
383                 ", ".join(
384                     [
385                         f"{field} = EXCLUDED.{field}"
386                         for field in map(self.quote_name, update_fields)
387                     ]
388                 ),
389             )
390         return super().on_conflict_suffix_sql(

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/schema.py line 456
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

455         self.execute(
456             "INSERT INTO %s (%s) SELECT %s FROM %s"
457             % (
458                 self.quote_name(new_field.remote_field.through._meta.db_table),
459                 ", ".join(
460                     [
461                         "id",
462                         new_field.m2m_column_name(),
463                         new_field.m2m_reverse_name(),
464                     ]
465                 ),
466                 ", ".join(
467                     [
468                         "id",
469                         old_field.m2m_column_name(),
470                         old_field.m2m_reverse_name(),
471                     ]
472                 ),
473                 self.quote_name(old_field.remote_field.through._meta.db_table),
474             )
475         )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/gis/db/backends/postgis/operations.py line 212
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

211                 raise ImproperlyConfigured(
212                     'Cannot determine PostGIS version for database "%s" '
213                     'using command "SELECT postgis_lib_version()". '
214                     "GeoDjango requires at least PostGIS version 3.2. "
215                     "Was the database created from a spatial database "
216                     "template?" % self.connection.settings_dict["NAME"]
217                 )

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/manage_translations.py line 201

Likely real
Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.
```
200         capture_output=True,
201         shell=True,
202     )
203     num_changes = int(p.stdout.strip())
204     print("%d changed/added messages in '%s' catalog." % (num_changes, cat_name))
205 
206
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/manage_translations.py line 403

Likely real
Uncertain, 40% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
402     cmd = kwargs.pop("cmd")
403     eval(cmd)(**kwargs)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/shell.py line 89

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
88                 try:
89                     exec(compile(pythonrc_code, pythonrc, "exec"), imported_objects)
90                 except Exception:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/shell.py line 272

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
271         ):
272             exec(sys.stdin.read(), {**globals(), **self.get_namespace(**options)})
273             return
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/shell.py line 262

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
261         if options["command"]:
262             exec(options["command"], {**globals(), **self.get_namespace(**options)})
263             return
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/locmem.py line 43

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
42             self._cache.move_to_end(key, last=False)
43         return pickle.loads(pickled)
44
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/filebased.py line 154

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
153         try:
154             exp = pickle.load(f)
155         except EOFError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/redis.py line 29

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
28         except ValueError:
29             return pickle.loads(data)
30
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/locmem.py line 73

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
72             pickled = self._cache[key]
73             value = pickle.loads(pickled)
74             new_value = value + delta
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/filebased.py line 71

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
70                     else:
71                         previous_value = pickle.loads(zlib.decompress(f.read()))
72                         f.seek(0)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/filebased.py line 38

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
37                 if not self._is_expired(f):
38                     return pickle.loads(zlib.decompress(f.read()))
39         except FileNotFoundError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 102

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
101                 value = connection.ops.process_clob(value)
102                 value = pickle.loads(base64.b64decode(value.encode(), validate=True))
103                 result[key_map.get(key)] = value
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/runserver.py line 178

Likely real
Uncertain, 37% confidence

Possible binding to all interfaces.
```
177         elif self.addr == "0":
178             addr = "0.0.0.0"
179         else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/manage_translations.py line 75

Likely real
Probably noise, 22% confidence

Call to requests without timeout
```
74         print(f"\n>>> GET {url=} {params=}")
75     response = requests.get(url, headers=headers, params=params)
76     if verbosity > 2:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 6

Likely real
Yes, 97% confidence

Using pulldom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace pulldom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
5 import json
6 from xml.dom import pulldom
7 from xml.sax import handler
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 7

Likely real
Yes, 97% confidence

Using handler to parse untrusted XML data is known to be vulnerable to XML attacks. Replace handler with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
6 from xml.dom import pulldom
7 from xml.sax import handler
8 from xml.sax.expatreader import ExpatParser as _ExpatParser
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 8

Likely real
Yes, 97% confidence

Using ExpatParser to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ExpatParser with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
7 from xml.sax import handler
8 from xml.sax.expatreader import ExpatParser as _ExpatParser
9
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/xmlutils.py line 5

Likely real
Yes, 97% confidence

Using XMLGenerator to parse untrusted XML data is known to be vulnerable to XML attacks. Replace XMLGenerator with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
4 
5 from xml.sax.saxutils import XMLGenerator
6
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/urls/resolvers.py line 14

Likely real
Yes, 96% confidence

Consider possible security implications associated with PicklingError module.
```
13 from importlib import import_module
14 from pickle import PicklingError
15 from urllib.parse import quote
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 175

Likely real
Yes, 95% confidence

Possible hardcoded password: 'not in'
```
174             elif token == "not" and i + 1 < num_tokens and tokens[i + 1] == "in":
175                 token = "not in"
176                 i += 1  # skip 'in'
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 171

Likely real
Yes, 95% confidence

Possible hardcoded password: 'is'
```
170             token = tokens[i]
171             if token == "is" and i + 1 < num_tokens and tokens[i + 1] == "not":
172                 token = "is not"
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 389

Likely real
Yes, 95% confidence

Possible hardcoded password: 'POST'
```
388         else:
389             token_source = "POST"
390
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 343

Likely real
Yes, 95% confidence

Possible hardcoded password: 'POST'
```
342     def _bad_token_message(self, reason, token_source):
343         if token_source != "POST":
344             # Assume it is a settings.CSRF_HEADER_NAME value.
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/sqlite3/introspection.py line 450

Likely real
Yes, 95% confidence

Possible hardcoded password: 'COLLATE'
```
449             for index, token in enumerate(tokens):
450                 if token == "COLLATE":
451                     collation = tokens[index + 1]
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/views.py line 246

Likely real
Yes, 95% confidence

Possible hardcoded password: '_password_reset_token'
```
245 
246 INTERNAL_RESET_SESSION_TOKEN = "_password_reset_token"
247
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 172

Likely real
Yes, 95% confidence

Possible hardcoded password: 'is not'
```
171             if token == "is" and i + 1 < num_tokens and tokens[i + 1] == "not":
172                 token = "is not"
173                 i += 1  # skip 'not'
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 174

Likely real
Yes, 95% confidence

Possible hardcoded password: 'not'
```
173                 i += 1  # skip 'not'
174             elif token == "not" and i + 1 < num_tokens and tokens[i + 1] == "in":
175                 token = "not in"
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/auth/forms.py line 166
Likely real: Yes, 95% confidence

Possible hardcoded password: 'usable_password'

165     @sensitive_variables("password1", "password2")
166     def validate_passwords(
167         self,
168         password1_field_name="password1",
169         password2_field_name="password2",
170         usable_password_field_name="usable_password",
171     ):
172         usable_password = (
173             self.cleaned_data.pop(usable_password_field_name, None) != "false"
174         )
175         self.cleaned_data["set_usable_password"] = usable_password
176 
177         if not usable_password:
178             return
179 
180         password1 = self.cleaned_data.get(password1_field_name)
181         password2 = self.cleaned_data.get(password2_field_name)
182 
183         if not password1 and password1_field_name not in self.errors:
184             error = ValidationError(
185                 self.fields[password1_field_name].error_messages["required"],
186                 code="required",
187             )
188             self.add_error(password1_field_name, error)
189 
190         if not password2 and password2_field_name not in self.errors:
191             error = ValidationError(
192                 self.fields[password2_field_name].error_messages["required"],
193                 code="required",
194             )
195             self.add_error(password2_field_name, error)
196 
197         super().validate_passwords(password1_field_name, password2_field_name)
198

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 79

Likely real
Yes, 95% confidence

Possible hardcoded password: 'NOTPROVIDED'
```
78         if csrf_token:
79             if csrf_token == "NOTPROVIDED":
80                 return format_html("")
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/forms.py line 131

Likely real
Yes, 95% confidence

Possible hardcoded password: 'password1'
```
130 
131     def set_password_and_save(self, user, password_field_name="password1", commit=True):
132         user.set_password(self.cleaned_data[password_field_name])
133         if commit:
134             user.save()
135         return user
136
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/auth/forms.py line 123
Likely real: Yes, 95% confidence

Possible hardcoded password: 'password2'

122     @sensitive_variables("password")
123     def validate_password_for_user(self, user, password_field_name="password2"):
124         password = self.cleaned_data.get(password_field_name)
125         if password:
126             try:
127                 password_validation.validate_password(password, user)
128             except ValidationError as error:
129                 self.add_error(password_field_name, error)
130

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/hashers.py line 25

Likely real
Yes, 95% confidence

Possible hardcoded password: '!'
```
24 
25 UNUSABLE_PASSWORD_PREFIX = "!"  # This will never be a valid encoded hash
26 UNUSABLE_PASSWORD_SUFFIX_LENGTH = (
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/creation.py line 292

Likely real
Yes, 95% confidence

Possible hardcoded password: 'ALTER USER %(user)s IDENTIFIED BY "%(password)s"'
```
291         if not success and self._test_settings_get("PASSWORD") is None:
292             set_password = 'ALTER USER %(user)s IDENTIFIED BY "%(password)s"'
293             self._execute_statements(cursor, [set_password], parameters, verbosity)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/checks/security/base.py line 22

Likely real
Yes, 94% confidence

Possible hardcoded password: 'django-insecure-'
```
21 
22 SECRET_KEY_INSECURE_PREFIX = "django-insecure-"
23 SECRET_KEY_MIN_LENGTH = 50
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/views.py line 262

Likely real
Yes, 93% confidence

Possible hardcoded password: 'set-password'
```
261     post_reset_login_backend = None
262     reset_url_token = "set-password"
263     success_url = reverse_lazy("password_reset_complete")
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 33

Likely real
Yes, 91% confidence

Possible hardcoded password: 'CSRF token missing.'
```
32 REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
33 REASON_CSRF_TOKEN_MISSING = "CSRF token missing."
34 REASON_MALFORMED_REFERER = "Referer checking failed - Referer is malformed."
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 365

Likely real
Uncertain, 45% confidence

Possible hardcoded password: ''
```
364         # Check non-cookie token for match.
365         request_csrf_token = ""
366         if request.method == "POST":
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 376

Likely real
Uncertain, 45% confidence

Possible hardcoded password: ''
```
375 
376         if request_csrf_token == "":
377             # Fall back to X-CSRFToken, to make things easier for AJAX, and
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/conf/global_settings.py line 215

Likely real
Uncertain, 45% confidence

Possible hardcoded password: ''
```
214 EMAIL_HOST_USER = ""
215 EMAIL_HOST_PASSWORD = ""
216 EMAIL_USE_TLS = False
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/conf/global_settings.py line 279

Likely real
Uncertain, 44% confidence

Possible hardcoded password: ''
```
278 # loudly.
279 SECRET_KEY = ""
280
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/version.py line 93

Likely real
Probably noise, 24% confidence

subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
```
92         capture_output=True,
93         shell=True,
94         cwd=repo_dir,
95         text=True,
96     )
97     timestamp = git_log.stdout
98     tz = datetime.UTC
99     try:
100         timestamp = datetime.datetime.fromtimestamp(int(timestamp), tz=tz)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/dbshell.py line 1

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
1 import subprocess
2 
3 from django.core.management.base import BaseCommand, CommandError
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/manage_translations.py line 25

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
24 import os
25 import subprocess
26 from argparse import ArgumentParser
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/do_django_release.py line 13

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
12 import re
13 import subprocess
14 from datetime import date
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/utils.py line 8

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
7 from pathlib import Path
8 from subprocess import run
9
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/mysql/creation.py line 2

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
1 import os
2 import subprocess
3 import sys
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/base/client.py line 2

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
1 import os
2 import subprocess
3
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/utils.py line 4

Likely real
Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.
```
3 import shutil
4 import subprocess
5 import sys
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'argon2-cffi>=23.1.0' — attacker could push malicious update
```
argon2-cffi>=23.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'bcrypt>=4.1.1' — attacker could push malicious update
```
bcrypt>=4.1.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'sqlparse>=0.5.0' — attacker could push malicious update
```
sqlparse>=0.5.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'asgiref>=3.12.1' — attacker could push malicious update
```
asgiref>=3.12.1
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'qunit^2.25.0' — attacker could push malicious update
```
qunit:^2.25.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'grunt-contrib-qunit^10.2.0' — attacker could push malicious update
```
grunt-contrib-qunit:^10.2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'grunt-cli^1.5.0' — attacker could push malicious update
```
grunt-cli:^1.5.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'grunt^1.6.2' — attacker could push malicious update
```
grunt:^1.6.2
```