Mark/docker_backup
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

[Security] MEDIUM: 11 Python security issue(s) #34

New issue
Closed
opened 2026-05-17 10:08:55 +00:00 by Mark · 1 comment
Mark commented 2026-05-17 10:08:55 +00:00
Owner
Copy link

Bandit Security Linter Findings

  • MEDIUM B108: [B108] Probable insecure usage of temp file/directory.
    File: /home/b/Projects/docker_backup/.agents/skills/docx/scripts/accept_changes.py (line 16)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/docx/scripts/office/helpers/simplify_redlines.py (line 131)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/docx/scripts/office/helpers/simplify_redlines.py (line 155)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/helpers/simplify_redlines.py (line 131)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/helpers/simplify_redlines.py (line 155)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/validators/redlining.py (line 34)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/validators/redlining.py (line 79)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/validators/redlining.py (line 81)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/xlsx/scripts/office/validators/redlining.py (line 34)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/xlsx/scripts/office/validators/redlining.py (line 79)
  • MEDIUM B314: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
    File: /home/b/Projects/docker_backup/.agents/skills/xlsx/scripts/office/validators/redlining.py (line 81)

Auto-filed by security-sweep.py on 2026-05-17 03:08 UTC

## Bandit Security Linter Findings - **MEDIUM** `B108`: [B108] Probable insecure usage of temp file/directory. *File: `/home/b/Projects/docker_backup/.agents/skills/docx/scripts/accept_changes.py` (line 16)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/docx/scripts/office/helpers/simplify_redlines.py` (line 131)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/docx/scripts/office/helpers/simplify_redlines.py` (line 155)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/helpers/simplify_redlines.py` (line 131)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/helpers/simplify_redlines.py` (line 155)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/validators/redlining.py` (line 34)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/validators/redlining.py` (line 79)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/pptx/scripts/office/validators/redlining.py` (line 81)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/xlsx/scripts/office/validators/redlining.py` (line 34)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/xlsx/scripts/office/validators/redlining.py` (line 79)* - **MEDIUM** `B314`: [B314] Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called *File: `/home/b/Projects/docker_backup/.agents/skills/xlsx/scripts/office/validators/redlining.py` (line 81)* --- *Auto-filed by security-sweep.py on 2026-05-17 03:08 UTC*
Mark commented 2026-05-19 00:45:25 +00:00
Author
Owner
Copy link

Quickfix applied via opencode.

Quickfix applied via opencode.
Mark 2026-05-19 00:45:25 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
No results found.
Labels
Clear labels   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:gate-fetch

   
blocked:lint-failed

   
blocked:needs-decision

   
blocked:no-changes

   
blocked:no-procedure

   
blocked:verify-failed

   
bug

Something is not working correctly

  
feature-request

   
in-progress

   
needs-decompose

Ready to be decomposed into sub-issues

  
needs-triage

   
ops-task

Operations task — install, configure, deploy, API calls

  
quickfix

   
security/high

High severity security issue

  
security/low

Low severity security issue

  
security/medium

Medium severity security issue

  
test-coverage

Test coverage review / gap report

  
triage-approved

Approved by triage pipeline

No labels
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-fetch
blocked:gate-fetch
blocked:lint-failed
blocked:needs-decision
blocked:no-changes
blocked:no-procedure
blocked:verify-failed
bug
feature-request
in-progress
needs-decompose
needs-triage
ops-task
quickfix
security/high
security/low
security/medium
test-coverage
triage-approved
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Mark/docker_backup#34
No description provided.