[Security] MEDIUM: 12 Python security issue(s) #228

New issue

Closed

opened 2026-05-17 10:13:42 +00:00 by Mark · 1 comment

Mark commented

2026-05-17 10:13:42 +00:00

Owner

Bandit Security Linter Findings

MEDIUM B108: [B108] Probable insecure usage of temp file/directory.
File: /home/b/Projects/mesh-seed/primitives/_muscle/image_generation/v1/run.py (line 20)
MEDIUM B310: [B310] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
File: /home/b/Projects/mesh-seed/runtime/cross_mesh_forwarding.py (line 124)
MEDIUM B310: [B310] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
File: /home/b/Projects/mesh-seed/runtime/cross_mesh_forwarding.py (line 173)
MEDIUM B104: [B104] Possible binding to all interfaces.
File: /home/b/Projects/mesh-seed/runtime/forgejo_bridge.py (line 217)
HIGH B324: [B324] Use of weak MD5 hash for security. Consider usedforsecurity=False
File: /home/b/Projects/mesh-seed/substrate/bone.py (line 67)
MEDIUM B608: [B608] Possible SQL injection vector through string-based query construction.
File: /home/b/Projects/mesh-seed/substrate/ledger/core.py (line 2042)
MEDIUM B608: [B608] Possible SQL injection vector through string-based query construction.
File: /home/b/Projects/mesh-seed/substrate/ledger/core.py (line 2461)
MEDIUM B608: [B608] Possible SQL injection vector through string-based query construction.
File: /home/b/Projects/mesh-seed/substrate/ledger/core.py (line 2469)
MEDIUM B608: [B608] Possible SQL injection vector through string-based query construction.
File: /home/b/Projects/mesh-seed/substrate/ledger_sync.py (line 392)
MEDIUM B608: [B608] Possible SQL injection vector through string-based query construction.
File: /home/b/Projects/mesh-seed/substrate/ledger_sync.py (line 446)
MEDIUM B608: [B608] Possible SQL injection vector through string-based query construction.
File: /home/b/Projects/mesh-seed/substrate/ledger_sync.py (line 467)
HIGH B602: [B602] subprocess call with shell=True identified, security issue.
File: /home/b/Projects/mesh-seed/tools/shell_command/run.py (line 138)

Auto-filed by security-sweep.py on 2026-05-17 03:13 UTC

## Bandit Security Linter Findings - **MEDIUM** `B108`: [B108] Probable insecure usage of temp file/directory. *File: `/home/b/Projects/mesh-seed/primitives/_muscle/image_generation/v1/run.py` (line 20)* - **MEDIUM** `B310`: [B310] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. *File: `/home/b/Projects/mesh-seed/runtime/cross_mesh_forwarding.py` (line 124)* - **MEDIUM** `B310`: [B310] Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. *File: `/home/b/Projects/mesh-seed/runtime/cross_mesh_forwarding.py` (line 173)* - **MEDIUM** `B104`: [B104] Possible binding to all interfaces. *File: `/home/b/Projects/mesh-seed/runtime/forgejo_bridge.py` (line 217)* - **HIGH** `B324`: [B324] Use of weak MD5 hash for security. Consider usedforsecurity=False *File: `/home/b/Projects/mesh-seed/substrate/bone.py` (line 67)* - **MEDIUM** `B608`: [B608] Possible SQL injection vector through string-based query construction. *File: `/home/b/Projects/mesh-seed/substrate/ledger/core.py` (line 2042)* - **MEDIUM** `B608`: [B608] Possible SQL injection vector through string-based query construction. *File: `/home/b/Projects/mesh-seed/substrate/ledger/core.py` (line 2461)* - **MEDIUM** `B608`: [B608] Possible SQL injection vector through string-based query construction. *File: `/home/b/Projects/mesh-seed/substrate/ledger/core.py` (line 2469)* - **MEDIUM** `B608`: [B608] Possible SQL injection vector through string-based query construction. *File: `/home/b/Projects/mesh-seed/substrate/ledger_sync.py` (line 392)* - **MEDIUM** `B608`: [B608] Possible SQL injection vector through string-based query construction. *File: `/home/b/Projects/mesh-seed/substrate/ledger_sync.py` (line 446)* - **MEDIUM** `B608`: [B608] Possible SQL injection vector through string-based query construction. *File: `/home/b/Projects/mesh-seed/substrate/ledger_sync.py` (line 467)* - **HIGH** `B602`: [B602] subprocess call with shell=True identified, security issue. *File: `/home/b/Projects/mesh-seed/tools/shell_command/run.py` (line 138)* --- *Auto-filed by security-sweep.py on 2026-05-17 03:13 UTC*