xonsh/xonsh · MalDet

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /xonsh/history/main.py line 102
Likely real: Yes, 99% confidence

Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]

location = _xh_find_histfile_var(
            [os.path.join("~", ".bashrc"), os.path.join("~", ".bash_profile")],
            os.path.join("~", ".bash_history"),
        )

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /xonsh/history/main.py line 125
Likely real: Yes, 99% confidence

Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]

location = _xh_find_histfile_var(
            [os.path.join("~", ".zshrc"), os.path.join("~", ".zprofile")],
            os.path.join("~", ".zsh_history"),
        )

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /xonsh/history/main.py line 84
Likely real: Yes, 99% confidence

Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart]

continue
        with open(f) as rc_file:
            for line in rc_file:
                if line.startswith("HISTFILE="):

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/publish.yml line 68
Likely real: Yes, 57% confidence

Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

run: gh release upload ${{ github.ref_name }} ./xonsh-x86_64.AppImage ./xonsh-x86_64.AppImage.sha256

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/tools.py line 1190
Likely real: Yes, 53% confidence

Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

shell=True,

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 81
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
                "ALTER TABLE " + XH_SQLITE_TABLE_NAME + " ADD COLUMN cwd TEXT"
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 294
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute(sql, (inp,))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 276
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute(
                f"UPDATE {XH_SQLITE_TABLE_NAME} SET frequency = ? WHERE rowid = ?",
                (total_freq, keep_rowid),
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 269
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute(
                f"DELETE FROM {XH_SQLITE_TABLE_NAME} WHERE inp = ? AND rowid != ?",
                (inp, keep_rowid),
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 238
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute(sql, (str(sessionid),))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 165
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

result = cursor.execute(sql, (max_tsb,))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 151
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(sql, tuple(params))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 136
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(sql, tuple(params))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 104
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
        sql.format(XH_SQLITE_TABLE_NAME, fields, marks), tuple(values.values())
    )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 88
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
            f"""\
CREATE INDEX IF NOT EXISTS  idx_inp_history
ON {XH_SQLITE_TABLE_NAME}(inp);"""
        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 71
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
                "ALTER TABLE "
                + XH_SQLITE_TABLE_NAME
                + " ADD COLUMN frequency INTEGER default 1"
            )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 53
Likely real: Yes, 53% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

cursor.execute(
            f"""
            CREATE TABLE IF NOT EXISTS {XH_SQLITE_TABLE_NAME}
                 (inp TEXT,
                  rtn INTEGER,
                  tsb REAL,
                  tse REAL,
                  sessionid TEXT,
                  out TEXT,
                  info TEXT,
                  frequency INTEGER default 1,
                  cwd TEXT
                 )
        """
        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 248
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute(f"SELECT COUNT(*) FROM {XH_SQLITE_TABLE_NAME}")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 219
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute(sql, (start_time, src_sessionid))

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 203
Likely real: Yes, 52% confidence

Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.

c.execute(sql, (oldest_pull_time, current_sessionid))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/shells/ptk_shell/__init__.py line 791
Likely real: Uncertain, 36% confidence

Starting a process with a shell, possible injection detected, security issue.

790             return
791         os.system(stty + " sane")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/shells/readline_shell.py line 831
Likely real: Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.

830         # os.system() function.
831         os.system(stty + " sane")
832

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/pytest/tools.py line 96
Likely real: Uncertain, 33% confidence

subprocess call with shell=True identified, security issue.

95 def sp(cmd):
96     return subprocess.check_output(cmd, text=True, shell=ON_WINDOWS)
97

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/tools.py line 1190
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

1189         stderr=subprocess.STDOUT,
1190         shell=True,
1191     )
1192     lines = [
1193         line
1194         for line in s.rstrip().splitlines()
1195         if not line.endswith(": command not found")
1196     ]

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2017
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

signature      = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2870
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(outp, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2862
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(self.lr_goto, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2861
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(self.lr_action, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2859
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(self.lr_method, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2858
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(__tabversion__, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2020
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

productions    = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2019
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

self.lr_goto   = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2013
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

tabversion = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2860
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(signature, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2018
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

self.lr_action = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2016
Likely real: Yes, 100% confidence

Avoid using `cPickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

self.lr_method = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/codecache.py line 114
Likely real: Yes, 100% confidence

The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security

marshal.dump(ccode, cfile)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/codecache.py line 163
Likely real: Yes, 100% confidence

The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security

ccode = marshal.load(cfile)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/codecache.py line 217
Likely real: Yes, 100% confidence

The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security

ccode = marshal.load(cfile)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/dependabot.yml line 3
Likely real: Yes, 99% confidence

This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown

- package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: setup.py line 126
Likely real: Yes, 98% confidence

setup.py overrides the install process (class xbuild_py(build_py)) — review its run()/initialize_options() for unexpected behavior

class xbuild_py(build_py):

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: setup.py line 146
Likely real: Yes, 98% confidence

setup.py overrides the install process (class xinstall(install)) — review its run()/initialize_options() for unexpected behavior

class xinstall(install):

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: setup.py line 163
Likely real: Yes, 98% confidence

setup.py overrides the install process (class xsdist(sdist)) — review its run()/initialize_options() for unexpected behavior

class xsdist(sdist):

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: setup.py line 217
Likely real: Yes, 98% confidence

setup.py overrides the install process (class xdevelop(develop)) — review its run()/initialize_options() for unexpected behavior

class xdevelop(develop):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/webconfig/tags.py line 106
Likely real: Yes, 98% confidence

Using xml.dom.minidom.parseString to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parseString with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

105 
106     dom = xml.dom.minidom.parseString(txt)
107     txt = dom.toprettyxml()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/codecache.py line 217
Likely real: Yes, 97% confidence

Deserialization with the marshal module is possibly dangerous.

216             try:
217                 ccode = marshal.load(cfile)
218             except Exception:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/codecache.py line 163
Likely real: Yes, 97% confidence

Deserialization with the marshal module is possibly dangerous.

162                 try:
163                     ccode = marshal.load(cfile)
164                 except Exception:

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /xonsh/parsers/base.py line 3537
Likely real: Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]

def _envvar_getter_by_name(self, var, lineno=None, col=None):
        xenv = load_attribute_chain("__xonsh__.env", lineno=lineno, col=col)
        func = ast.Attribute(
            value=xenv, attr="get", ctx=ast.Load(), lineno=li...

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /xonsh/parsers/base.py line 3506
Likely real: Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]

elif p1 == "${":
            xenv = load_attribute_chain("__xonsh__.env", lineno=lineno, col=col)
            idx = ast.Index(value=p2)
            p0 = ast.Subscript(

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'psutil' has no version lock — supply chain risk

psutil

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'pyperclip' has no version lock — supply chain risk

pyperclip

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'gnureadline' has no version lock — supply chain risk

gnureadline

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'distro' has no version lock — supply chain risk

distro

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'setproctitle' has no version lock — supply chain risk

setproctitle

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'pytest-cov' has no version lock — supply chain risk

pytest-cov

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'pre-commit' has no version lock — supply chain risk

pre-commit

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 're-ver' has no version lock — supply chain risk

re-ver

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'numpydoc' has no version lock — supply chain risk

numpydoc

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'matplotlib' has no version lock — supply chain risk

matplotlib

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'tornado' has no version lock — supply chain risk

tornado

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'myst-parser' has no version lock — supply chain risk

myst-parser

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'sphinx-prompt' has no version lock — supply chain risk

sphinx-prompt

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'xonsh' has no version lock — supply chain risk

xonsh[ptk,pygments]

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'distro' has no version lock — supply chain risk

distro; platform_system=='Linux'

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'setproctitle' has no version lock — supply chain risk

setproctitle; platform_system=='Windows'

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'gnureadline' has no version lock — supply chain risk

gnureadline; platform_system=='Darwin'

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'restructuredtext_lint' has no version lock — supply chain risk

restructuredtext_lint

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'pytest-rerunfailures' has no version lock — supply chain risk

pytest-rerunfailures

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'runthis-sphinxext' has no version lock — supply chain risk

runthis-sphinxext

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'sphinx-reredirects' has no version lock — supply chain risk

sphinx-reredirects

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'ujson' has no version lock — supply chain risk

ujson

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'click' has no version lock — supply chain risk

click

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'tomli' has no version lock — supply chain risk

tomli

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'furo' has no version lock — supply chain risk

furo

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'pyzmq' has no version lock — supply chain risk

pyzmq

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'xonsh' has no version lock — supply chain risk

xonsh[bestshell]

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'xonsh' has no version lock — supply chain risk

xonsh[test,doc]

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'xonsh' has no version lock — supply chain risk

xonsh[bestshell]

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 54% confidence

Unpinned dependency: 'sphinx-autobuild' has no version lock — supply chain risk

sphinx-autobuild

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 53% confidence

Unpinned dependency: 'sphinx-sitemap' has no version lock — supply chain risk

sphinx-sitemap

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 53
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

cursor.execute(
            f"""
            CREATE TABLE IF NOT EXISTS {XH_SQLITE_TABLE_NAME}
                 (inp TEXT,
                  rtn INTEGER,
                  tsb REAL,
                  tse REAL,
                  sessionid TEXT,
                  out TEXT,
                  info TEXT,
                  frequency INTEGER default 1,
                  cwd TEXT
                 )
        """
        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 88
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

cursor.execute(
            f"""\
CREATE INDEX IF NOT EXISTS  idx_inp_history
ON {XH_SQLITE_TABLE_NAME}(inp);"""
        )

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 248
Likely real: Yes, 52% confidence

Detected possible formatted SQL query. Use parameterized queries instead.

c.execute(f"SELECT COUNT(*) FROM {XH_SQLITE_TABLE_NAME}")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/lib/openpy.py line 117
Likely real: Yes, 52% confidence

Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.

response = urlopen(url)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 360
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 46
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 389
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nix-build.yml line 29
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nix-build.yml line 31
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: cachix/install-nix-action@v31

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nix-build.yml line 35
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: cachix/cachix-action@v17

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nix-build.yml line 52
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/publish.yml line 23
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/publish.yml line 25
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/publish.yml line 38
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: pypa/gh-action-pypi-publish@release/v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/publish.yml line 46
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/publish.yml line 48
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-please.yml line 18
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/create-github-app-token@v3

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/release-please.yml line 23
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: googleapis/release-please-action@v5

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 44
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 95
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 358
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 337
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 309
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 303
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 301
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 280
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 257
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 251
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 249
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 229
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 215
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 178
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 175
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 155
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 141
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 98
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/check-pr-title.yml line 15
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: amannn/action-semantic-pull-request@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 31
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 29
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 34
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: astral-sh/setup-uv@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 39
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: chetan/git-restore-mtime-action@v2

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 41
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/cache@v6

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 52
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: tibdex/github-app-token@v2

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 61
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: peaceiris/actions-gh-pages@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/docs.yml line 69
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: peaceiris/actions-gh-pages@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 49
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 52
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/nightly-build.yml line 73
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-artifact@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 49
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: astral-sh/setup-uv@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/update-flake-lock.yml line 25
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: DeterminateSystems/update-flake-lock@v29

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/update-flake-lock.yml line 22
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: cachix/install-nix-action@v31

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/update-flake-lock.yml line 19
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 82
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: vmactions/freebsd-vm@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 80
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v7

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/test.yml line 55
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: mxschmitt/action-tmate@v3

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Yes, 51% confidence

Unpinned dependency: 'pytest-mock' has no version lock — supply chain risk

pytest-mock

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 3262
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec('import %s' % pkgname)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 1986
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec('import %s' % module)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/lex.py line 1038
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec('import %s' % pkgname)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/lex.py line 217
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec('import %s' % tabfile)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/execer.py line 232
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

return exec(code, glbs, locs)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/debug.py line 309
Likely real: Yes, 50% confidence

Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

exec(line, globs, locs)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 1566
Likely real: Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

c = eval(s)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/cpp.py line 656
Likely real: Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

result = eval(expr)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/execer.py line 199
Likely real: Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

return eval(code, glbs, locs)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/debug.py line 307
Likely real: Uncertain, 50% confidence

Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.

result = eval(line, globs, locs)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/pygments_cache.py line 503
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

mod = importlib.import_module(modname)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/pygments_cache.py line 439
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

mod = importlib.import_module(modname)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/debug.py line 234
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

module = importlib.import_module(name)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/pygments_cache.py line 466
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

mod = importlib.import_module(modname)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/pygments_cache.py line 412
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

mod = importlib.import_module(modname)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/pygments_cache.py line 379
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

mod = importlib.import_module(modname)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2870
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(outp, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2862
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(self.lr_goto, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2861
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(self.lr_action, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2860
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(signature, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2859
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(self.lr_method, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2858
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

pickle.dump(__tabversion__, outf, pickle_protocol)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2020
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

productions    = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2019
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

self.lr_goto   = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2018
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

self.lr_action = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2017
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

signature      = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2016
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

self.lr_method = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2013
Likely real: Uncertain, 49% confidence

Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.

tabversion = pickle.load(in_f)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/completers/imports.py line 137
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

m = import_module(mod)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/lib/modules.py line 94
Likely real: Uncertain, 48% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

return importlib.import_module(f"{base}.{name}")

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/pytest/plugin.py line 61
Likely real: Uncertain, 48% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

mod = importlib.import_module(self.path.stem)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/shells/readline_shell.py line 154
Likely real: Uncertain, 48% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

readline = importlib.import_module(_rlmod_name)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/xontribs.py line 228
Likely real: Uncertain, 48% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

module = importlib.import_module(spec.name)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/lib/openpy.py line 117
Likely real: Uncertain, 48% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.

116 
117     response = urlopen(url)
118     buf = io.BytesIO(response.read())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 234
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

233     """Wipe the current session's entries from the database."""
234     sql = f"DELETE FROM {XH_SQLITE_TABLE_NAME} WHERE sessionid = ?"
235     with _xh_sqlite_get_conn(filename=filename) as conn:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 248
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

247         # Count total entries
248         c.execute(f"SELECT COUNT(*) FROM {XH_SQLITE_TABLE_NAME}")
249         total = c.fetchone()[0]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 253
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

252         c.execute(
253             f"SELECT inp, COUNT(*) as cnt, SUM(frequency) as total_freq "
254             f"FROM {XH_SQLITE_TABLE_NAME} GROUP BY inp HAVING cnt > 1"
255         )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 262
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

261             c.execute(
262                 f"SELECT rowid FROM {XH_SQLITE_TABLE_NAME} "
263                 f"WHERE inp = ? ORDER BY tsb DESC LIMIT 1",
264                 (inp,),

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 270
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

269             c.execute(
270                 f"DELETE FROM {XH_SQLITE_TABLE_NAME} WHERE inp = ? AND rowid != ?",
271                 (inp, keep_rowid),

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 277
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

276             c.execute(
277                 f"UPDATE {XH_SQLITE_TABLE_NAME} SET frequency = ? WHERE rowid = ?",
278                 (total_freq, keep_rowid),

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 293
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

292             if pattern.match(inp):
293                 sql = f"DELETE FROM {XH_SQLITE_TABLE_NAME} WHERE inp=?"
294                 c.execute(sql, (inp,))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 216
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

215     start_time = last_pull_times.get(src_sessionid, last_full_pull_time)
216     sql = f"SELECT inp FROM {XH_SQLITE_TABLE_NAME} WHERE tsb > ? AND sessionid = ? ORDER BY tsb"
217     with _xh_sqlite_get_conn(filename=filename) as conn:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 198
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

197 def xh_sqlite_pull_all(filename, last_pull_times, current_sessionid):
198     sql = f"SELECT inp, tsb, sessionid FROM {XH_SQLITE_TABLE_NAME} WHERE tsb > ? AND sessionid != ? ORDER BY tsb"
199     oldest_pull_time = min(last_pull_times.values())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 164
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

163     max_tsb = result[0]
164     sql = f"DELETE FROM {XH_SQLITE_TABLE_NAME} WHERE tsb < ?"
165     result = cursor.execute(sql, (max_tsb,))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 157
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

156     sql = "SELECT min(tsb) FROM ("
157     sql += f"SELECT tsb FROM {XH_SQLITE_TABLE_NAME} ORDER BY tsb DESC "
158     sql += "LIMIT %d)" % size_to_keep

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 131
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

130 def _xh_sqlite_get_count(cursor, sessionid=None):
131     sql = f"SELECT count(*) FROM {XH_SQLITE_TABLE_NAME} "
132     params = []

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/history/sqlite.py line 141
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

140 def _xh_sqlite_get_records(cursor, sessionid=None, limit=None, newest_first=False):
141     sql = f"SELECT inp, tsb, rtn, frequency, cwd FROM {XH_SQLITE_TABLE_NAME} "
142     params = []

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/foreign_shells.py line 691
Likely real: Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.

690         super().__init__(
691             shell=shell, sourcer=sourcer, files=files, extra_args=extra_args
692         )
693         self.src = src.strip()
694

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/foreign_shells.py line 653
Likely real: Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.

652         super().__init__(
653             shell=shell, sourcer=sourcer, files=files, extra_args=extra_args
654         )
655         self.funcname = funcname
656

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/foreign_shells.py line 528
Likely real: Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.

527             funcname=funcname,
528             shell=shell,
529             sourcer=sourcer,
530             files=files,
531             extra_args=extra_args,
532         )
533         funcs[funcname] = wrapper
534     return funcs
535

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/foreign_shells.py line 490
Likely real: Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.

489                     src=value,
490                     shell=shell,
491                     sourcer=sourcer,
492                     files=files,
493                     extra_args=extra_args,
494                 )
495         except ValueError as exc:
496             warnings.warn(
497                 f'could not parse alias "{key}": {exc!r}',

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/foreign_shells.py line 390
Likely real: Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.

389         s,
390         shell=shell,
391         sourcer=sourcer,
392         files=files,
393         extra_args=extra_args,
394     )
395     aliases.update(funcs)
396     return env, aliases
397

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/foreign_shells.py line 383
Likely real: Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.

382         s,
383         shell=shell,
384         sourcer=sourcer,
385         files=files,
386         extra_args=extra_args,
387     )
388     funcs = parse_funcs(
389         s,
390         shell=shell,

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/events.py line 364
Likely real: Uncertain, 45% confidence

Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

species = globals()[species]

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /xonsh/parsers/completion_context.py line 268
Likely real: Uncertain, 45% confidence

Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

new_value = new_args[variable]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/aliases.py line 1108
Likely real: Uncertain, 44% confidence

Function call with shell=True parameter identified, possible security issue.

1107     fsenv, fsaliases = foreign_shell_data(
1108         shell=shell,
1109         login=login,
1110         interactive=interactive,
1111         envcmd=envcmd,
1112         aliascmd=aliascmd,
1113         extra_args=extra_args,
1114         safe=safe,
1115         prevcmd=prevcmd,
1116         postcmd=postcmd,
1117         funcscmd=funcscmd or None,  # the default is None in the called function
1118         sourcer=sourcer,
1119         use_tmpfile=use_tmpfile,
1120         seterrprevcmd=seterrprevcmd,
1121         seterrpostcmd=seterrpostcmd,
1122         show=show,
1123         show_output=show_output,
1124         dryrun=dryrun,
1125         files=files,
1126     )
1127     if fsenv is None:
1128         if dryrun:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/aliases.py line 1327
Likely real: Uncertain, 44% confidence

Function call with shell=True parameter identified, possible security issue.

1326         return source_foreign_fn(
1327             shell="cmd",
1328             files_or_code=args,
1329             interactive=True,
1330             sourcer="call",
1331             envcmd="set",
1332             seterrpostcmd="if errorlevel 1 exit 1",
1333             use_tmpfile=True,
1334             prevcmd=prevcmd,
1335             #     from this function
1336             login=login,
1337             aliascmd=aliascmd,
1338             extra_args=extra_args,
1339             safe=safe,
1340             postcmd=postcmd,
1341             funcscmd=funcscmd,
1342             seterrprevcmd=seterrprevcmd,
1343             overwrite_aliases=overwrite_aliases,
1344             suppress_skip_message=suppress_skip_message,
1345             show=show,
1346             show_output=show_output,
1347             dryrun=dryrun,
1348         )
1349 
1350

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Uncertain, 44% confidence

Unpinned dependency: 'pytest-timeout' has no version lock — supply chain risk

pytest-timeout

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Uncertain, 43% confidence

Unpinned dependency: 'pytest-subprocess' has no version lock — supply chain risk

pytest-subprocess

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: pyproject.toml
Likely real: Uncertain, 41% confidence

Unpinned dependency: 'requests' has no version lock — supply chain risk

requests

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 1566
Likely real: Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.

1565                 try:
1566                     c = eval(s)
1567                     if (len(c) > 1):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/cpp.py line 656
Likely real: Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.

655         try:
656             result = eval(expr)
657         except Exception:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/execer.py line 199
Likely real: Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.

198                 return None  # handles comment only input
199         return eval(code, glbs, locs)
200

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/debug.py line 307
Likely real: Uncertain, 41% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.

306         try:
307             result = eval(line, globs, locs)
308         except SyntaxError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 3262
Likely real: Uncertain, 40% confidence

Use of exec detected.

3261                 pkgname = '.'.join(parts[:-1])
3262                 exec('import %s' % pkgname)
3263                 srcfile = getattr(sys.modules[pkgname], '__file__', '')

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/lex.py line 1038
Likely real: Uncertain, 40% confidence

Use of exec detected.

1037                     pkgname = '.'.join(parts[:-1])
1038                     exec('import %s' % pkgname)
1039                     srcfile = getattr(sys.modules[pkgname], '__file__', '')

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 1986
Likely real: Uncertain, 40% confidence

Use of exec detected.

1985         else:
1986             exec('import %s' % module)
1987             parsetab = sys.modules[module]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/lex.py line 217
Likely real: Uncertain, 40% confidence

Use of exec detected.

216         else:
217             exec('import %s' % tabfile)
218             lextab = sys.modules[tabfile]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/execer.py line 232
Likely real: Uncertain, 40% confidence

Use of exec detected.

231                 return None  # handles comment only input
232         return exec(code, glbs, locs)
233

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/debug.py line 309
Likely real: Uncertain, 40% confidence

Use of exec detected.

308         except SyntaxError:
309             exec(line, globs, locs)
310             return

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/webconfig/tags.py line 104
Likely real: Yes, 97% confidence

Using xml.dom.minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

103 def to_pretty(txt: str):
104     import xml.dom.minidom
105

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2854
Likely real: Yes, 96% confidence

Consider possible security implications associated with cPickle module.

2853         try:
2854             import cPickle as pickle
2855         except ImportError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/ply/yacc.py line 2004
Likely real: Yes, 96% confidence

Consider possible security implications associated with cPickle module.

2003         try:
2004             import cPickle as pickle
2005         except ImportError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/tokenize.py line 1291
Likely real: Yes, 95% confidence

Possible hardcoded password: '...'

1290                 elif initial in numchars or (  # ordinary number
1291                     initial == "." and token != "." and token != "..."
1292                 ):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/tokenize.py line 1291
Likely real: Yes, 95% confidence

Possible hardcoded password: '.'

1290                 elif initial in numchars or (  # ordinary number
1291                     initial == "." and token != "." and token != "..."
1292                 ):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/tokenize.py line 1403
Likely real: Yes, 95% confidence

Possible hardcoded password: 'async'

1402                             yield TokenInfo(
1403                                 ASYNC if token == "async" else AWAIT,
1404                                 token,

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/tokenize.py line 1412
Likely real: Yes, 95% confidence

Possible hardcoded password: 'async'

1411                     tok = TokenInfo(NAME, token, spos, epos, line)
1412                     if token == "async" and not stashed:
1413                         stashed = tok

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/tokenize.py line 1442
Likely real: Yes, 95% confidence

Possible hardcoded password: '\ '

1441                     yield tok
1442                 elif token == "\\\n" or token == "\\\r\n":  # continued stmt
1443                     continued = 1

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/tokenize.py line 1442
Likely real: Yes, 95% confidence

Possible hardcoded password: '\ '

1441                     yield tok
1442                 elif token == "\\\n" or token == "\\\r\n":  # continued stmt
1443                     continued = 1

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/parsers/tokenize.py line 1418
Likely real: Yes, 95% confidence

Possible hardcoded password: 'def'

1417                         HAS_ASYNC
1418                         and token == "def"
1419                         and (

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/cli_utils.py line 82
Likely real: Yes, 95% confidence

Possible hardcoded password: 'Parameters'

81         lines = doc.splitlines()
82         token = "Parameters"
83         if token in lines:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/pyghooks.py line 1970
Likely real: Yes, 95% confidence

Possible hardcoded password: '[^=\s\[\]{}()$"\'`<&|;!]+(?=\s|$|\)|\]|\}|!)'

1969 
1970 COMMAND_TOKEN_RE = r'[^=\s\[\]{}()$"\'`<&|;!]+(?=\s|$|\)|\]|\}|!)'
1971

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/shells/base_shell.py line 532
Likely real: Yes, 94% confidence

Possible hardcoded password: '<invalid directory>'

531                 # we have no idea where we are
532                 env["PWD"] = "<invalid directory>"
533             elif os.path.isdir(pwd):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/xoreutils/pwd.py line 20
Likely real: Yes, 88% confidence

Possible hardcoded password: 'Usage: pwd [OPTION]... Print the full filename of the current working directory. -P, --physical avoid all symlinks --help display this help and exit This version of pwd was written in Python for the xonsh project: http://xon.sh Based on pwd from GNU coreutils: http://www.gnu.org/software/coreutils/'

19 
20 PWD_HELP = """Usage: pwd [OPTION]...
21 Print the full filename of the current working directory.
22 
23   -P, --physical   avoid all symlinks
24       --help       display this help and exit
25 
26 This version of pwd was written in Python for the xonsh project: http://xon.sh
27 Based on pwd from GNU coreutils: http://www.gnu.org/software/coreutils/"""
28

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/webconfig/tags.py line 6
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

5     from collections.abc import Iterable
6 import xml.etree.ElementTree as etree
7 from functools import partial

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/aliases.py line 1789
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

1788             {
1789                 "output_format": lambda lines: __import__(
1790                     "xml.etree.ElementTree", fromlist=["fromstring"]
1791                 ).fromstring("\n".join(lines))
1792             },

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/main.py line 1224
Likely real: Uncertain, 36% confidence

Starting a process without a shell.

1223         print(f"Failback to {foreign_shell}", file=sys.stderr)
1224         os.execlp(foreign_shell, foreign_shell)
1225     else:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/aliases.py line 1428
Likely real: Uncertain, 36% confidence

Starting a process without a shell.

1427             if scriptcmd:
1428                 os.execvpe(scriptcmd[0], scriptcmd, denv)
1429             # fall through to the error return below

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/aliases.py line 1418
Likely real: Uncertain, 36% confidence

Starting a process without a shell.

1417     try:
1418         os.execvpe(cmd, command, denv)
1419     except OSError as e:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/pygments_cache.py line 137
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

136             val = (mod.__name__, cls.__name__)
137         except Exception:
138             continue
139         for filename in filenames:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/platforms/winutils.py line 26
Likely real: Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.

25 import os
26 import subprocess
27 from ctypes import POINTER, byref, c_char_p, c_int, c_ulong, c_void_p

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/built_ins.py line 563
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

562         return value
563     import subprocess
564

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/procs/posix.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 import signal
7 import subprocess
8 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/procs/pipelines.py line 8
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

7 import signal
8 import subprocess
9 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/procs/jobs.py line 8
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

7 import signal
8 import subprocess
9 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/platform.py line 15
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

14 import signal
15 import subprocess
16 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/foreign_shells.py line 9
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

8 import shlex
9 import subprocess
10 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/environ.py line 12
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

11 import re
12 import subprocess
13 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/dirstack.py line 8
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

7 import os
8 import subprocess
9 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/completers/tools.py line 6
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

5 import shlex
6 import subprocess
7 import textwrap

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/completers/bash_completion.py line 13
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

12 import shutil
13 import subprocess
14

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/built_ins.py line 412
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

411 
412     import subprocess
413

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh-in-docker.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 import shutil
7 import subprocess
8 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xompletions/git.py line 3
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

2 
3 import subprocess
4

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup.py line 5
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

4 import os
5 import subprocess
6 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /.github/scripts/update-nightly-release-descr.py line 27
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

26 import re
27 import subprocess
28 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/xoreutils/xcontext.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 import os
7 import subprocess
8 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/tools.py line 63
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

62 import string
63 import subprocess
64 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/shells/base_shell.py line 5
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

4 import os
5 import subprocess
6 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/pytest/tools.py line 8
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

7 import shutil
8 import subprocess
9 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/prompt/vc.py line 9
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

8 import re
9 import subprocess
10 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/prompt/gitstatus.py line 55
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

54 import os
55 import subprocess
56

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/procs/specs.py line 12
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

11 import stat
12 import subprocess
13 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/procs/proxies.py line 14
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

13 import signal
14 import subprocess
15 import sys

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/completers/man.py line 5
Likely real: Probably noise, 12% confidence

Consider possible security implications associated with the subprocess module.

4 import shutil
5 import subprocess
6 import textwrap

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/dirstack.py line 137
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

136 
137     subprocess.check_output(["NET", "USE", left_drive, "/delete"], text=True)
138     _unc_tempDrives.pop(left_drive)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/prompt/vc.py line 276
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

275     try:
276         s = subprocess.check_output(
277             ["hg", "identify", "--id"],
278             stderr=subprocess.PIPE,
279             cwd=cwd,
280             timeout=vcbt,
281             text=True,
282             env=denv,
283         )
284         return s.strip(os.linesep).endswith("+")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/procs/jobs.py line 231
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

230     def _kill(job):
231         subprocess.check_output(
232             ["taskkill", "/F", "/T", "/PID", str(job["obj"].pid)],
233             stderr=subprocess.STDOUT,
234         )
235

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/dirstack.py line 112
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

111         if not os.path.isdir(d):  # find unused drive letter starting from z:
112             subprocess.check_output(["NET", "USE", d, unc_share], text=True)
113             _unc_tempDrives[d] = unc_share

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/completers/man.py line 125
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

124     try:
125         out = subprocess.check_output(
126             ["man", "-w", cmd], stderr=subprocess.DEVNULL, text=True
127         )
128         p = Path(out.strip())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/completers/man.py line 35
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

34         # This is a trick to get rid of reverse line feeds
35         result = subprocess.check_output(["col", "-b"], stdin=manpage.stdout, env=env)
36         if manpage.stdout:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xompletions/git.py line 34
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

33     try:
34         return subprocess.check_output(
35             ["git", *args],
36             stderr=subprocess.PIPE,
37             text=True,
38             timeout=5,
39         )
40     except subprocess.CalledProcessError as e:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /setup.py line 68
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

67     try:
68         _version = subprocess.check_output(["git", "describe", "--tags"])
69     except Exception:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/completers/man.py line 31
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

30     # zombie (never reaped) and the pipe fd leaks.
31     with subprocess.Popen(
32         ["man", cmd], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, env=env
33     ) as manpage:
34         # This is a trick to get rid of reverse line feeds

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /.github/scripts/update-nightly-release-descr.py line 51
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

50 def gh_create(notes: str) -> None:
51     subprocess.run(
52         [
53             "gh", "release", "create", "nightly-build",
54             "--title", "Nightly build",
55             "--notes", notes,
56             "--prerelease",
57         ],
58         check=True,
59     )
60

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /.github/scripts/update-nightly-release-descr.py line 35
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

34 def get_body() -> str | None:
35     r = subprocess.run(
36         ["gh", "release", "view", "nightly-build", "--json", "body", "--jq", ".body"],
37         capture_output=True,
38         text=True,
39     )
40     return r.stdout.rstrip("\n") if r.returncode == 0 else None

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /xonsh/xoreutils/xcontext.py line 45
Likely real: Probably noise, 3% confidence