Scan report

django / django

View on GitHub (opens in a new tab)
Python
91537 stars
Scanned 29 Oct 2026, 09:23

Vulnerability Critical

Could an attacker exploit mistakes in this code?

437 risk score

Strong warning signs. Do not run or install this without a careful review.

High: 0
Medium: 170
Low: 96

Sources: Bandit, Semgrep, pip-audit

Malicious pattern High

Does this code look like it is trying to cause harm?

56 risk score

Serious issues. Review the high-severity findings before using it.

High: 13
Medium: 1
Low: 16

Sources: YARA, ClamAV, GuardDog, dependency checker

Findings overview

296 total findings

Likely real: 147
Uncertain: 59
Likely noise: 90

The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.

What we found, in plain English

147 findings likely need attention, 90 look like noise. Most notable: Detects dynamic code loading: downloading and importing/executing code at runtime [thre... in /django/contrib/auth/hashers.py (99% confidence).

Detections by engine

Bandit 266

Python security linter · Vulnerability
YARA 13

Malware signature rules · Malicious pattern
Dependency checker 9

CVEs, typosquats and risky installs · Supply chain
GuardDog 8

Supply-chain attack heuristics · Malicious pattern

Score over time

Overall score each time this repository was scanned.

Findings

Highest severity first. Select a finding to see the code and what it means.

Large result: showing the top 230 of 296 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.

Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/django/contrib/auth/hashers.py line 127

Likely real
Yes, 99% confidence

Detects dynamic code loading: downloading and importing/executing code at runtime [threat-runtime-dynamic-loader]
```
hasher = hasher_cls()
        if not getattr(hasher, "algorithm"):
            raise ImproperlyConfigured(
                "hasher doesn't specify an algorithm name: %s" % hasher_path
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/manage_translations.py line 404

Likely real
Yes, 96% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
```
cmd = kwargs.pop("cmd")
    eval(cmd)(**kwargs)
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/manage_translations.py line 76

Likely real
Yes, 95% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
```
print(f"\n>>> GET {url=} {params=}")
    response = requests.get(url, headers=headers, params=params)
    if verbosity > 2:
        print(f">>>> GET {response=}\n")
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/manage_translations.py line 49

Likely real
Yes, 95% confidence

Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
```
print(f"\n** subprocess.run ** command: {args=} {kwargs=}")
    return subprocess.run(*args, **kwargs)
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/django/template/defaulttags.py line 919

Likely real
Yes, 91% confidence

Detects steganography decode followed by code execution [threat-runtime-obfuscation-steganography]
```
def eval(self, context):
        return self.value.resolve(context, ignore_failures=True)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 244

Likely real
Yes, 98% confidence

Using xml.dom.pulldom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.pulldom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called
```
243         self.handle_forward_references = options.pop("handle_forward_references", False)
244         self.event_stream = pulldom.parse(self.stream, self._make_parser())
245         self.db = using
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admindocs/utils.py line 96

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
95     )
96     return mark_safe(parts["fragment"])
97
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 63

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
62     """
63     return SafeString(html.escape(str(text)))
64
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 738

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
737 
738     return mark_safe(list_formatter(value))
739
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 621

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
620         return value
621     return mark_safe(data)
622
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 525

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
524     """
525     return [mark_safe(obj) for obj in value]
526
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_filters.py line 79

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
78 
79     return mark_safe(rendered_object_list + remaining_objects_message)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 68

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
69
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 61

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
60         if self.setting:
61             return mark_safe(output)
62         else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 256

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
255                     context.pop()
256         return mark_safe("".join(nodelist))
257
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/loader_tags.py line 82

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
81         ):
82             return mark_safe(self.render(self.context))
83         return ""
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/templatetags/i18n.py line 96

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
95         value = value.replace("%%", "%")
96         value = mark_safe(value) if is_safe else value
97         if self.asvar:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/templatetags/i18n.py line 201

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
200         if self.asvar:
201             context[self.asvar] = SafeString(result)
202             return ""
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 114

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
113         template = '<script id="{}" type="application/json">{}</script>'
114         args = (element_id, mark_safe(json_str))
115     else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 117

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
116         template = '<script type="application/json">{}</script>'
117         args = (mark_safe(json_str),)
118     return format_html(template, *args)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 146

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
145     kwargs_safe = {k: conditional_escape(v) for (k, v) in kwargs.items()}
146     return mark_safe(format_string.format(*args_safe, **kwargs_safe))
147
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/utils/html.py line 163
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

162     """
163     return mark_safe(
164         conditional_escape(sep).join(
165             (
166                 format_html(format_string, **args)
167                 if isinstance(args, Mapping)
168                 else format_html(format_string, *args)
169             )
170             for args in args_generator
171         )
172     )
173

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 401

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
400                 )
401                 return SafeString(f"{lead}{middle}{trail}")
402             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 404

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
403                 if safe_input:
404                     return mark_safe(word)
405                 elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 408

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
407         elif safe_input:
408             return mark_safe(word)
409         elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 533

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
532     klass_str = klass.__str__
533     klass.__str__ = lambda self: mark_safe(klass_str(self))
534     klass.__html__ = lambda self: str(self)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 29

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
28     if number is None or number == "":
29         return mark_safe(number)
30     if use_l10n is None:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 37

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
36     if isinstance(number, int) and not use_grouping and not decimal_pos:
37         return mark_safe(number)
38     # sign
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 393

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
392     if isinstance(message, SafeData):
393         return mark_safe(result)
394
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 405

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
404     elif isinstance(message, SafeData):
405         result = mark_safe(result)
406     return result
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 91

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
90     """Hex encode characters for use in JavaScript strings."""
91     return mark_safe(str(value).translate(_js_escapes))
92
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 508

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
507         value = escape(value)
508     return mark_safe(value.replace("\n", "<br>"))
509
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/admin/helpers.py line 161
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

160     def errors(self):
161         return mark_safe(
162             "\n".join(
163                 self.form[f].errors.as_ul()
164                 for f in self.fields
165                 if f not in self.readonly_fields
166             ).strip("\n")
167         )
168

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 193

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
192         return self.field.label_tag(
193             contents=mark_safe(contents),
194             attrs=attrs,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 200

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
199     def errors(self):
200         return mark_safe(self.field.errors.as_ul())
201
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 433

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
432         try:
433             return mark_safe(self.empty_value_display)
434         except AttributeError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 435

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
434         except AttributeError:
435             return mark_safe(self.admin_site.empty_value_display)
436
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/admin/templatetags/admin_list.py line 106
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

105                 yield {
106                     "text": SafeString(
107                         f'<input type="checkbox" id="action-toggle" '
108                         f'aria-label="{aria_label}">'
109                     ),
110                     "class_attrib": SafeString(' class="action-checkbox-column"'),

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 264

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
263                     row_classes.append("nowrap")
264         row_class = SafeString(' class="%s"' % " ".join(row_classes))
265         # If list_display_links not defined, add the link tag to the first
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 315

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
314                 bf = form[field_name]
315                 result_repr = mark_safe(str(bf.errors) + str(bf))
316             yield format_html("<td{}>{}</td>", row_class, result_repr)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 346

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
345             if form[cl.model._meta.pk.name].is_hidden:
346                 yield mark_safe(form[cl.model._meta.pk.name])
347
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admindocs/utils.py line 182

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
181 def strip_p_tags(value):
182     return mark_safe(value.replace("<p>", "").replace("</p>", ""))
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 67

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
66     # content in the first place).
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/humanize/templatetags/humanize.py line 69

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
68     # Mark value safe so i18n does not break with <sup> or <sub> see #19988
69     return mark_safe(value)
70
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/messages/storage/cookie.py line 38

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
37                 if obj[1]:
38                     obj[3] = mark_safe(obj[3])
39                 return Message(*obj[2:])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/utils.py line 55

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
54         context = context or self.get_context()
55         return mark_safe(renderer.render(template, context))
56
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/forms/widgets.py line 186
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

185     def render(self, *, attrs=None):
186         return mark_safe(
187             "\n".join(
188                 chain.from_iterable(
189                     getattr(self, "render_" + name)(attrs=attrs) for name in MEDIA_TYPES
190                 )
191             )
192         )
193

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 948

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
947                 if not lookup:
948                     arg_vals.append(mark_safe(arg))
949                 else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 515

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
514     """Mark the value as a string that should not be auto-escaped."""
515     return mark_safe(value)
516
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 494

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
493     autoescape = autoescape and not isinstance(value, SafeData)
494     return mark_safe(linebreaks(value, autoescape))
495
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 448

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
447     if safe and arg != ";":
448         return mark_safe(value)
449     return value
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 398

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
397     """
398     return mark_safe(
399         _urlize(value, trim_url_limit=int(limit), nofollow=True, autoescape=autoescape)
400     )
401
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/widgets.py line 381

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
380             renderer = get_default_renderer()
381         return mark_safe(renderer.render(template_name, context))
382
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 386

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
385     """Convert URLs in plain text into clickable links."""
386     return mark_safe(_urlize(value, nofollow=True, autoescape=autoescape))
387
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 244

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
243             lines[i] = ("%0" + width + "d. %s") % (i + 1, escape(line))
244     return mark_safe("\n".join(lines))
245
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 213

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
212     number = "".join(reversed(digits))
213     return mark_safe(
214         formats.number_format(
215             number,
216             abs(p),
217             use_l10n=use_l10n,
218             force_grouping=force_grouping,
219         )
220     )
221
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/template/defaultfilters.py line 185
Likely real: Yes, 98% confidence

Potential XSS on mark_safe function.

184     if not m and p <= 0:
185         return mark_safe(
186             formats.number_format(
187                 "%d" % (int(d)),
188                 0,
189                 use_l10n=use_l10n,
190                 force_grouping=force_grouping,
191             )
192         )
193

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 49

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
48         if isinstance(first, SafeData) and getattr(unwrap(func), "is_safe", False):
49             result = mark_safe(result)
50         return result
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 1231

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
1230     def render(self, context):
1231         return SafeString("".join([node.render_annotated(context) for node in self]))
1232
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 1075

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
1074             msgid = value.replace("%", "%%")
1075             msgid = mark_safe(msgid) if is_safe else msgid
1076             if self.message_context:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 1046

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
1045             try:
1046                 self.literal = mark_safe(unescape_string_literal(var))
1047             except ValueError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 958

Likely real
Yes, 98% confidence

Potential XSS on mark_safe function.
```
957             if getattr(func, "is_safe", False) and isinstance(obj, SafeData):
958                 obj = mark_safe(new_obj)
959             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 621

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
620         return value
621     return mark_safe(data)
622
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 738

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
737 
738     return mark_safe(list_formatter(value))
739
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 61

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
60         if self.setting:
61             return mark_safe(output)
62         else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 256

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
255                     context.pop()
256         return mark_safe("".join(nodelist))
257
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/loader_tags.py line 82

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
81         ):
82             return mark_safe(self.render(self.context))
83         return ""
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/templatetags/i18n.py line 96

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
95         value = value.replace("%%", "%")
96         value = mark_safe(value) if is_safe else value
97         if self.asvar:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 91

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
90     """Hex encode characters for use in JavaScript strings."""
91     return mark_safe(str(value).translate(_js_escapes))
92
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 114

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
113         template = '<script id="{}" type="application/json">{}</script>'
114         args = (element_id, mark_safe(json_str))
115     else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 117

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
116         template = '<script type="application/json">{}</script>'
117         args = (mark_safe(json_str),)
118     return format_html(template, *args)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 146

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
145     kwargs_safe = {k: conditional_escape(v) for (k, v) in kwargs.items()}
146     return mark_safe(format_string.format(*args_safe, **kwargs_safe))
147
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/utils/html.py line 163
Likely real: Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.

162     """
163     return mark_safe(
164         conditional_escape(sep).join(
165             (
166                 format_html(format_string, **args)
167                 if isinstance(args, Mapping)
168                 else format_html(format_string, *args)
169             )
170             for args in args_generator
171         )
172     )
173

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 404

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
403                 if safe_input:
404                     return mark_safe(word)
405                 elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 408

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
407         elif safe_input:
408             return mark_safe(word)
409         elif autoescape:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/html.py line 533

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
532     klass_str = klass.__str__
533     klass.__str__ = lambda self: mark_safe(klass_str(self))
534     klass.__html__ = lambda self: str(self)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 29

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
28     if number is None or number == "":
29         return mark_safe(number)
30     if use_l10n is None:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/numberformat.py line 37

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
36     if isinstance(number, int) and not use_grouping and not decimal_pos:
37         return mark_safe(number)
38     # sign
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 393

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
392     if isinstance(message, SafeData):
393         return mark_safe(result)
394
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/translation/trans_real.py line 405

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
404     elif isinstance(message, SafeData):
405         result = mark_safe(result)
406     return result
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 346

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
345             if form[cl.model._meta.pk.name].is_hidden:
346                 yield mark_safe(form[cl.model._meta.pk.name])
347
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_filters.py line 33

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
32         if max_items <= 0:
33             return mark_safe("")
34
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/utils.py line 55

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
54         context = context or self.get_context()
55         return mark_safe(renderer.render(template, context))
56
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/messages/storage/cookie.py line 38

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
37                 if obj[1]:
38                     obj[3] = mark_safe(obj[3])
39                 return Message(*obj[2:])
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 161

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
160     def errors(self):
161         return mark_safe(
162             "\n".join(
163                 self.form[f].errors.as_ul()
164                 for f in self.fields
165                 if f not in self.readonly_fields
166             ).strip("\n")
167         )
168
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 525

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
524     """
525     return [mark_safe(obj) for obj in value]
526
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 193

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
192         return self.field.label_tag(
193             contents=mark_safe(contents),
194             attrs=attrs,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/helpers.py line 200

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
199     def errors(self):
200         return mark_safe(self.field.errors.as_ul())
201
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 433

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
432         try:
433             return mark_safe(self.empty_value_display)
434         except AttributeError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/options.py line 435

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
434         except AttributeError:
435             return mark_safe(self.admin_site.empty_value_display)
436
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/widgets.py line 186

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
185     def render(self, *, attrs=None):
186         return mark_safe(
187             "\n".join(
188                 chain.from_iterable(
189                     getattr(self, "render_" + name)(attrs=attrs) for name in MEDIA_TYPES
190                 )
191             )
192         )
193
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/humanize/templatetags/humanize.py line 69

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
68     # Mark value safe so i18n does not break with <sup> or <sub> see #19988
69     return mark_safe(value)
70
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 68

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
69
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/flatpages/views.py line 67

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
66     # content in the first place).
67     f.title = mark_safe(f.title)
68     f.content = mark_safe(f.content)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admindocs/utils.py line 182

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
181 def strip_p_tags(value):
182     return mark_safe(value.replace("<p>", "").replace("</p>", ""))
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admindocs/utils.py line 96

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
95     )
96     return mark_safe(parts["fragment"])
97
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_filters.py line 79

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
78 
79     return mark_safe(rendered_object_list + remaining_objects_message)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/admin/templatetags/admin_list.py line 315

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
314                 bf = form[field_name]
315                 result_repr = mark_safe(str(bf.errors) + str(bf))
316             yield format_html("<td{}>{}</td>", row_class, result_repr)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/forms/widgets.py line 381

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
380             renderer = get_default_renderer()
381         return mark_safe(renderer.render(template_name, context))
382
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 948

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
947                 if not lookup:
948                     arg_vals.append(mark_safe(arg))
949                 else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 958

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
957             if getattr(func, "is_safe", False) and isinstance(obj, SafeData):
958                 obj = mark_safe(new_obj)
959             else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 1046

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
1045             try:
1046                 self.literal = mark_safe(unescape_string_literal(var))
1047             except ValueError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/base.py line 1075

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
1074             msgid = value.replace("%", "%%")
1075             msgid = mark_safe(msgid) if is_safe else msgid
1076             if self.message_context:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 49

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
48         if isinstance(first, SafeData) and getattr(unwrap(func), "is_safe", False):
49             result = mark_safe(result)
50         return result
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 185

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
184     if not m and p <= 0:
185         return mark_safe(
186             formats.number_format(
187                 "%d" % (int(d)),
188                 0,
189                 use_l10n=use_l10n,
190                 force_grouping=force_grouping,
191             )
192         )
193
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 213

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
212     number = "".join(reversed(digits))
213     return mark_safe(
214         formats.number_format(
215             number,
216             abs(p),
217             use_l10n=use_l10n,
218             force_grouping=force_grouping,
219         )
220     )
221
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 244

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
243             lines[i] = ("%0" + width + "d. %s") % (i + 1, escape(line))
244     return mark_safe("\n".join(lines))
245
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 386

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
385     """Convert URLs in plain text into clickable links."""
386     return mark_safe(_urlize(value, nofollow=True, autoescape=autoescape))
387
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 398

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
397     """
398     return mark_safe(
399         _urlize(value, trim_url_limit=int(limit), nofollow=True, autoescape=autoescape)
400     )
401
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 448

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
447     if safe and arg != ";":
448         return mark_safe(value)
449     return value
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 494

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
493     autoescape = autoescape and not isinstance(value, SafeData)
494     return mark_safe(linebreaks(value, autoescape))
495
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 508

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
507         value = escape(value)
508     return mark_safe(value.replace("\n", "<br>"))
509
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaultfilters.py line 515

Likely real
Yes, 98% confidence

Use of mark_safe() may expose cross-site scripting vulnerabilities and should be reviewed.
```
514     """Mark the value as a string that should not be auto-escaped."""
515     return mark_safe(value)
516
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 274

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
273                 *(
274                     (alias, RawSQL(*args))
275                     for alias, args in self.query.extra_select.items()
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/query.py line 2622

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
2621                         extra_names.append(f)
2622                         selected[f] = RawSQL(*extra)
2623                     elif f in self.annotation_select:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2051

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
2050             sql, params = innerq.get_compiler(connection=self.connection).as_sql()
2051             innerq = RawSQL("SELECT * FROM (%s) subquery" % sql, params)
2052         outerq.add_filter("pk__in", innerq)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 481

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
480                     yield (
481                         OrderBy(RawSQL(*self.query.extra[col]), descending=descending),
482                         False,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 474

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
473                         OrderBy(
474                             Ref(col, RawSQL(*self.query.extra[col])),
475                             descending=descending,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 463

Likely real
Yes, 98% confidence

Use of RawSQL potential SQL attack vector.
```
462                     OrderBy(
463                         RawSQL("%s.%s" % (self.quote_name(table), col), []),
464                         descending=descending,
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/models/fields/related_descriptors.py line 1241
Likely real: Yes, 98% confidence

Use of extra potential SQL attack vector.

1240             qn = connection.ops.quote_name
1241             queryset = queryset.extra(
1242                 select={
1243                     "_prefetch_related_val_%s"
1244                     % f.attname: "%s.%s"
1245                     % (qn(join_table), qn(f.column))
1246                     for f in fk.local_related_fields
1247                 }
1248             )
1249             # Restore subsequent cloning operations.

Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Yes, 54% confidence

Unpinned dependency: 'tzdata' has no version lock — supply chain risk
```
tzdata; sys_platform == 'win32'
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/hashers.py line 665

Likely real
Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False
```
664         self._check_encode_args(password, salt)
665         hash = hashlib.md5(force_bytes(salt) + force_bytes(password)).hexdigest()
666         return "%s$%s$%s" % (self.algorithm, force_str(salt), hash)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/loaders/cached.py line 96

Likely real
Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False
```
95     def generate_hash(self, values):
96         return hashlib.sha1("|".join(values).encode()).hexdigest()
97
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/pr_quality/check_pr.py line 122

Likely real
Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
```
121     try:
122         with urllib.request.urlopen(url, timeout=URLOPEN_TIMEOUT_SECONDS) as response:
123             return json.loads(response.read())
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/github.py line 27

Likely real
Uncertain, 49% confidence

Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
```
26     req = urllib.request.Request(url, data=body, headers=headers, method=method)
27     with urllib.request.urlopen(req, timeout=URLOPEN_TIMEOUT_SECONDS) as response:
28         if response.status != HTTPStatus.NO_CONTENT:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/sqlite3/_functions.py line 460

Likely real
Uncertain, 48% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False
```
459         return None
460     return sha1(text.encode()).hexdigest()
461
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/sqlite3/_functions.py line 414

Likely real
Uncertain, 48% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False
```
413         return None
414     return md5(text.encode()).hexdigest()
415
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 302

Likely real
Uncertain, 47% confidence

Possible SQL injection vector through string-based query construction.
```
301         with connection.cursor() as cursor:
302             cursor.execute("DELETE FROM %s" % table)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/mysql/schema.py line 94

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
93             self.execute(
94                 "UPDATE %(table)s SET %(column)s = %%s"
95                 % {
96                     "table": self.quote_name(model._meta.db_table),
97                     "column": self.quote_name(field.column),
98                 },
99                 [effective_default],
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/base/operations.py line 113

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
112         cache_key = self.quote_name("cache_key")
113         return f"SELECT {cache_key} FROM %s ORDER BY {cache_key} LIMIT 1 OFFSET %%s"
114
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 289

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
288                     cursor.execute(
289                         "DELETE FROM %s WHERE %s < %%s"
290                         % (
291                             table,
292                             connection.ops.quote_name("cache_key"),
293                         ),
294                         [last_cache_key[0]],
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 272

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
271             cursor.execute(
272                 "DELETE FROM %s WHERE %s < %%s"
273                 % (
274                     table,
275                     connection.ops.quote_name("expires"),
276                 ),
277                 [connection.ops.adapt_datetimefield_value(now)],
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 254
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

253             cursor.execute(
254                 "SELECT %s FROM %s WHERE %s = %%s and %s > %%s"
255                 % (
256                     quote_name("cache_key"),
257                     quote_name(self._table),
258                     quote_name("cache_key"),
259                     quote_name("expires"),
260                 ),
261                 [key, connection.ops.adapt_datetimefield_value(now)],

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 233

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
232             cursor.execute(
233                 "DELETE FROM %s WHERE %s IN (%s)"
234                 % (
235                     table,
236                     quote_name("cache_key"),
237                     ", ".join(["%s"] * len(keys)),
238                 ),
239                 keys,
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 177

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
176                         cursor.execute(
177                             "UPDATE %s SET %s = %%s WHERE %s = %%s"
178                             % (table, quote_name("expires"), quote_name("cache_key")),
179                             [exp, key],
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 151
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

150                     cursor.execute(
151                         "SELECT %s, %s FROM %s WHERE %s = %%s"
152                         % (
153                             quote_name("cache_key"),
154                             quote_name("expires"),
155                             table,
156                             quote_name("cache_key"),
157                         ),
158                         [key],

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 136

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
135             if self._cull_probability and random.random() <= self._cull_probability:
136                 cursor.execute("SELECT COUNT(*) FROM %s" % table)
137                 num = cursor.fetchone()[0]
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/mysql/introspection.py line 160

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
159         cursor.execute(
160             "SELECT * FROM %s LIMIT 1" % self.connection.ops.quote_name(table_name)
161         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/postgresql/operations.py line 155

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
154         if isinstance(placeholder_rows, InsertUnnest):
155             return f"SELECT * FROM {placeholder_rows}"
156         return super().bulk_insert_sql(fields, placeholder_rows)
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/base.py line 301
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

300                 primary_key_value, bad_value = cursor.execute(
301                     "SELECT %s, %s FROM %s WHERE rowid = %%s"
302                     % (
303                         self.ops.quote_name(primary_key_column_name),
304                         self.ops.quote_name(column_name),
305                         self.ops.quote_name(table_name),
306                     ),
307                     (rowid,),

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/schema.py line 257
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

256         self.execute(
257             "INSERT INTO %s (%s) SELECT %s FROM %s"
258             % (
259                 self.quote_name(new_model._meta.db_table),
260                 ", ".join(self.quote_name(x) for x in mapping),
261                 ", ".join(mapping.values()),
262                 self.quote_name(model._meta.db_table),
263             )
264         )

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/functions/text.py line 272

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
271             template=(
272                 "(SELECT LISTAGG(s) WITHIN GROUP (ORDER BY n DESC) FROM "
273                 f"(SELECT LEVEL n, SUBSTR(%(expressions)s, LEVEL, 1) s{suffix} "
274                 "CONNECT BY LEVEL <= LENGTH(%(expressions)s)) "
275                 "GROUP BY %(expressions)s)"
276             ),
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 667

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
666             if not features.supports_parentheses_in_compound:
667                 part_sql = "SELECT * FROM ({})".format(part_sql)
668             # Add parentheses when combining with compound query if not
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 992

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
991                         sub_params.extend(subparams)
992                 return "SELECT %s FROM (%s) subquery" % (
993                     ", ".join(sub_selects),
994                     " ".join(result),
995                 ), tuple(sub_params + params)
996
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2024

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
2023     def _as_sql(self, query):
2024         delete = "DELETE FROM %s" % self.quote_name(query.base_table)
2025         try:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2051

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
2050             sql, params = innerq.get_compiler(connection=self.connection).as_sql()
2051             innerq = RawSQL("SELECT * FROM (%s) subquery" % sql, params)
2052         outerq.add_filter("pk__in", innerq)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/postgresql/introspection.py line 120

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
119         cursor.execute(
120             "SELECT * FROM %s LIMIT 1" % self.connection.ops.quote_name(table_name)
121         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/schema.py line 146

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
145         self.execute(
146             "UPDATE %s set %s=%s"
147             % (
148                 self.quote_name(model._meta.db_table),
149                 self.quote_name(new_temp_field.column),
150                 new_value,
151             )
152         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/operations.py line 687

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
686         # UNION operator. To prevent incorrect SQL, move UNION to a subquery.
687         return "SELECT * FROM (%s)" % " UNION ALL ".join(query)
688
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/operations.py line 72

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
71         return (
72             f"SELECT {cache_key} "
73             f"FROM %s "
74             f"ORDER BY {cache_key} OFFSET %%s ROWS FETCH FIRST 1 ROWS ONLY"
75         )
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/introspection.py line 179

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
178         cursor.execute(
179             "SELECT * FROM {} WHERE ROWNUM < 2 AND {} > 0".format(
180                 self.connection.ops.quote_name(table_name), self.cache_bust_counter
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/base.py line 338

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
337                 cursor.execute(
338                     "SELECT 1 FROM DUAL WHERE DUMMY %s"
339                     % self._standard_operators["contains"],
340                     ["X"],
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/models/sql/compiler.py line 2276

Likely real
Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.
```
2275         ).as_sql(with_col_aliases=True)
2276         sql = "SELECT %s FROM (%s) subquery" % (sql, inner_query_sql)
2277         params += inner_query_params
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/gis/db/backends/postgis/operations.py line 212
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

211                 raise ImproperlyConfigured(
212                     'Cannot determine PostGIS version for database "%s" '
213                     'using command "SELECT postgis_lib_version()". '
214                     "GeoDjango requires at least PostGIS version 3.3. "
215                     "Was the database created from a spatial database "
216                     "template?" % self.connection.settings_dict["NAME"]
217                 )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 76
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

75             cursor.execute(
76                 "SELECT %s, %s, %s FROM %s WHERE %s IN (%s)"
77                 % (
78                     quote_name("cache_key"),
79                     quote_name("value"),
80                     quote_name("expires"),
81                     table,
82                     quote_name("cache_key"),
83                     ", ".join(["%s"] * len(key_map)),
84                 ),
85                 list(key_map),

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 185
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

184                         cursor.execute(
185                             "UPDATE %s SET %s = %%s, %s = %%s WHERE %s = %%s"
186                             % (
187                                 table,
188                                 quote_name("value"),
189                                 quote_name("expires"),
190                                 quote_name("cache_key"),
191                             ),
192                             [b64encoded, exp, key],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/core/cache/backends/db.py line 196
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

195                         cursor.execute(
196                             "INSERT INTO %s (%s, %s, %s) VALUES (%%s, %%s, %%s)"
197                             % (
198                                 table,
199                                 quote_name("cache_key"),
200                                 quote_name("value"),
201                                 quote_name("expires"),
202                             ),
203                             [key, b64encoded, exp],

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/mysql/base.py line 341
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

340                     cursor.execute(
341                         """
342                         SELECT REFERRING.`%s`, REFERRING.`%s` FROM `%s` as REFERRING
343                         LEFT JOIN `%s` as REFERRED
344                         ON (REFERRING.`%s` = REFERRED.`%s`)
345                         WHERE REFERRING.`%s` IS NOT NULL AND REFERRED.`%s` IS NULL
346                         """
347                         % (
348                             primary_key_column_name,
349                             column_name,
350                             table_name,
351                             referenced_table_name,
352                             column_name,
353                             referenced_column_name,
354                             column_name,
355                             referenced_column_name,
356                         )
357                     )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/schema.py line 456
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

455         self.execute(
456             "INSERT INTO %s (%s) SELECT %s FROM %s"
457             % (
458                 self.quote_name(new_field.remote_field.through._meta.db_table),
459                 ", ".join(
460                     [
461                         "id",
462                         new_field.m2m_column_name(),
463                         new_field.m2m_reverse_name(),
464                     ]
465                 ),
466                 ", ".join(
467                     [
468                         "id",
469                         old_field.m2m_column_name(),
470                         old_field.m2m_reverse_name(),
471                     ]
472                 ),
473                 self.quote_name(old_field.remote_field.through._meta.db_table),
474             )
475         )

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/sqlite3/operations.py line 393
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

392         ):
393             return "ON CONFLICT(%s) DO UPDATE SET %s" % (
394                 ", ".join(map(self.quote_name, unique_fields)),
395                 ", ".join(
396                     [
397                         f"{field} = EXCLUDED.{field}"
398                         for field in map(self.quote_name, update_fields)
399                     ]
400                 ),
401             )
402         return super().on_conflict_suffix_sql(

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/postgresql/operations.py line 381
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

380         if on_conflict == OnConflict.UPDATE:
381             return "ON CONFLICT(%s) DO UPDATE SET %s" % (
382                 ", ".join(map(self.quote_name, unique_fields)),
383                 ", ".join(
384                     [
385                         f"{field} = EXCLUDED.{field}"
386                         for field in map(self.quote_name, update_fields)
387                     ]
388                 ),
389             )
390         return super().on_conflict_suffix_sql(

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/db/backends/oracle/schema.py line 55
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

54         self.execute(
55             """
56             DECLARE
57                 i INTEGER;
58             BEGIN
59                 SELECT COUNT(1) INTO i FROM USER_SEQUENCES
60                     WHERE SEQUENCE_NAME = '%(sq_name)s';
61                 IF i = 1 THEN
62                     EXECUTE IMMEDIATE 'DROP SEQUENCE "%(sq_name)s"';
63                 END IF;
64             END;
65         /"""
66             % {
67                 "sq_name": self.connection.ops._get_no_autofield_sequence_name(
68                     model._meta.db_table
69                 )
70             }
71         )

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/manage_translations.py line 202

Likely real
Uncertain, 45% confidence

Function call with shell=True parameter identified, possible security issue.
```
201         capture_output=True,
202         shell=True,
203     )
204     num_changes = int(p.stdout.strip())
205     print("%d changed/added messages in '%s' catalog." % (num_changes, cat_name))
206 
207
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/manage_translations.py line 404

Likely real
Uncertain, 40% confidence

Use of possibly insecure function - consider using safer ast.literal_eval.
```
403     cmd = kwargs.pop("cmd")
404     eval(cmd)(**kwargs)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/shell.py line 272

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
271         ):
272             exec(sys.stdin.read(), {**globals(), **self.get_namespace(**options)})
273             return
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/shell.py line 262

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
261         if options["command"]:
262             exec(options["command"], {**globals(), **self.get_namespace(**options)})
263             return
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/shell.py line 89

Likely real
Uncertain, 40% confidence

Use of exec detected.
```
88                 try:
89                     exec(compile(pythonrc_code, pythonrc, "exec"), imported_objects)
90                 except Exception:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/locmem.py line 43

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
42             self._cache.move_to_end(key, last=False)
43         return pickle.loads(pickled)
44
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/filebased.py line 152

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
151         try:
152             exp = pickle.load(f)
153         except EOFError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/redis.py line 29

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
28         except ValueError:
29             return pickle.loads(data)
30
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/locmem.py line 73

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
72             pickled = self._cache[key]
73             value = pickle.loads(pickled)
74             new_value = value + delta
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/filebased.py line 71

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
70                     else:
71                         previous_value = pickle.loads(zlib.decompress(f.read()))
72                         f.seek(0)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/filebased.py line 38

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
37                 if not self._is_expired(f):
38                     return pickle.loads(zlib.decompress(f.read()))
39         except FileNotFoundError:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/cache/backends/db.py line 102

Likely real
Uncertain, 38% confidence

Pickle and modules that wrap it can be unsafe when used to deserialize untrusted data, possible security issue.
```
101                 value = connection.ops.process_clob(value)
102                 value = pickle.loads(base64.b64decode(value.encode(), validate=True))
103                 result[key_map.get(key)] = value
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/runserver.py line 178

Likely real
Uncertain, 37% confidence

Possible binding to all interfaces.
```
177         elif self.addr == "0":
178             addr = "0.0.0.0"
179         else:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/manage_translations.py line 76

Likely real
Probably noise, 22% confidence

Call to requests without timeout
```
75         print(f"\n>>> GET {url=} {params=}")
76     response = requests.get(url, headers=headers, params=params)
77     if verbosity > 2:
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 6

Likely real
Yes, 97% confidence

Using pulldom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace pulldom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
5 import json
6 from xml.dom import pulldom
7 from xml.sax import handler
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 8

Likely real
Yes, 97% confidence

Using ExpatParser to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ExpatParser with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
7 from xml.sax import handler
8 from xml.sax.expatreader import ExpatParser as _ExpatParser
9
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/serializers/xml_serializer.py line 7

Likely real
Yes, 97% confidence

Using handler to parse untrusted XML data is known to be vulnerable to XML attacks. Replace handler with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
6 from xml.dom import pulldom
7 from xml.sax import handler
8 from xml.sax.expatreader import ExpatParser as _ExpatParser
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/xmlutils.py line 5

Likely real
Yes, 97% confidence

Using XMLGenerator to parse untrusted XML data is known to be vulnerable to XML attacks. Replace XMLGenerator with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
```
4 
5 from xml.sax.saxutils import XMLGenerator
6
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/urls/resolvers.py line 14

Likely real
Yes, 96% confidence

Consider possible security implications associated with PicklingError module.
```
13 from importlib import import_module
14 from pickle import PicklingError
15 from urllib.parse import quote
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 172

Likely real
Yes, 95% confidence

Possible hardcoded password: 'is not'
```
171             if token == "is" and i + 1 < num_tokens and tokens[i + 1] == "not":
172                 token = "is not"
173                 i += 1  # skip 'not'
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/views.py line 246

Likely real
Yes, 95% confidence

Possible hardcoded password: '_password_reset_token'
```
245 
246 INTERNAL_RESET_SESSION_TOKEN = "_password_reset_token"
247
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/sqlite3/introspection.py line 450

Likely real
Yes, 95% confidence

Possible hardcoded password: 'COLLATE'
```
449             for index, token in enumerate(tokens):
450                 if token == "COLLATE":
451                     collation = tokens[index + 1]
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 345

Likely real
Yes, 95% confidence

Possible hardcoded password: 'POST'
```
344     def _bad_token_message(self, reason, token_source):
345         if token_source != "POST":
346             # Assume it is a settings.CSRF_HEADER_NAME value.
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 391

Likely real
Yes, 95% confidence

Possible hardcoded password: 'POST'
```
390         else:
391             token_source = "POST"
392
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 171

Likely real
Yes, 95% confidence

Possible hardcoded password: 'is'
```
170             token = tokens[i]
171             if token == "is" and i + 1 < num_tokens and tokens[i + 1] == "not":
172                 token = "is not"
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 174

Likely real
Yes, 95% confidence

Possible hardcoded password: 'not'
```
173                 i += 1  # skip 'not'
174             elif token == "not" and i + 1 < num_tokens and tokens[i + 1] == "in":
175                 token = "not in"
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/smartif.py line 175

Likely real
Yes, 95% confidence

Possible hardcoded password: 'not in'
```
174             elif token == "not" and i + 1 < num_tokens and tokens[i + 1] == "in":
175                 token = "not in"
176                 i += 1  # skip 'in'
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/auth/forms.py line 166
Likely real: Yes, 95% confidence

Possible hardcoded password: 'usable_password'

165     @sensitive_variables("password1", "password2")
166     def validate_passwords(
167         self,
168         password1_field_name="password1",
169         password2_field_name="password2",
170         usable_password_field_name="usable_password",
171     ):
172         usable_password = (
173             self.cleaned_data.pop(usable_password_field_name, None) != "false"
174         )
175         self.cleaned_data["set_usable_password"] = usable_password
176 
177         if not usable_password:
178             return
179 
180         password1 = self.cleaned_data.get(password1_field_name)
181         password2 = self.cleaned_data.get(password2_field_name)
182 
183         if not password1 and password1_field_name not in self.errors:
184             error = ValidationError(
185                 self.fields[password1_field_name].error_messages["required"],
186                 code="required",
187             )
188             self.add_error(password1_field_name, error)
189 
190         if not password2 and password2_field_name not in self.errors:
191             error = ValidationError(
192                 self.fields[password2_field_name].error_messages["required"],
193                 code="required",
194             )
195             self.add_error(password2_field_name, error)
196 
197         super().validate_passwords(password1_field_name, password2_field_name)
198

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/template/defaulttags.py line 79

Likely real
Yes, 95% confidence

Possible hardcoded password: 'NOTPROVIDED'
```
78         if csrf_token:
79             if csrf_token == "NOTPROVIDED":
80                 return format_html("")
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/forms.py line 131

Likely real
Yes, 95% confidence

Possible hardcoded password: 'password1'
```
130 
131     def set_password_and_save(self, user, password_field_name="password1", commit=True):
132         user.set_password(self.cleaned_data[password_field_name])
133         if commit:
134             user.save()
135         return user
136
```

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /django/contrib/auth/forms.py line 123
Likely real: Yes, 95% confidence

Possible hardcoded password: 'password2'

122     @sensitive_variables("password")
123     def validate_password_for_user(self, user, password_field_name="password2"):
124         password = self.cleaned_data.get(password_field_name)
125         if password:
126             try:
127                 password_validation.validate_password(password, user)
128             except ValidationError as error:
129                 self.add_error(password_field_name, error)
130

Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/hashers.py line 25

Likely real
Yes, 95% confidence

Possible hardcoded password: '!'
```
24 
25 UNUSABLE_PASSWORD_PREFIX = "!"  # This will never be a valid encoded hash
26 UNUSABLE_PASSWORD_SUFFIX_LENGTH = (
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/db/backends/oracle/creation.py line 292

Likely real
Yes, 95% confidence

Possible hardcoded password: 'ALTER USER %(user)s IDENTIFIED BY "%(password)s"'
```
291         if not success and self._test_settings_get("PASSWORD") is None:
292             set_password = 'ALTER USER %(user)s IDENTIFIED BY "%(password)s"'
293             self._execute_statements(cursor, [set_password], parameters, verbosity)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/checks/security/base.py line 22

Likely real
Yes, 94% confidence

Possible hardcoded password: 'django-insecure-'
```
21 
22 SECRET_KEY_INSECURE_PREFIX = "django-insecure-"
23 SECRET_KEY_MIN_LENGTH = 50
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/contrib/auth/views.py line 262

Likely real
Yes, 93% confidence

Possible hardcoded password: 'set-password'
```
261     post_reset_login_backend = None
262     reset_url_token = "set-password"
263     success_url = reverse_lazy("password_reset_complete")
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/do_django_release.py line 141

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
def main():
    pgp_key_id = os.getenv("PGP_KEY_ID")
    pgp_key_url = os.getenv("PGP_KEY_URL")
    pgp_email = os.getenv("PGP_EMAIL")
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/scripts/do_django_release.py line 142

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
pgp_key_id = os.getenv("PGP_KEY_ID")
    pgp_key_url = os.getenv("PGP_KEY_URL")
    pgp_email = os.getenv("PGP_EMAIL")
    dest_folder = os.path.expanduser(os.getenv("DEST_FOLDER"))
```
Engine
GuardDog · Supply-chain attack heuristics

Counts towards
Malicious pattern

File
/django/contrib/auth/management/commands/createsuperuser.py line 201

Likely real
Yes, 93% confidence

Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read]
```
):
                    user_data[PASSWORD_FIELD] = os.environ["DJANGO_SUPERUSER_PASSWORD"]
                # Use username from environment variable, if not provided in
                # options.
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 33

Likely real
Yes, 91% confidence

Possible hardcoded password: 'CSRF token missing.'
```
32 REASON_NO_CSRF_COOKIE = "CSRF cookie not set."
33 REASON_CSRF_TOKEN_MISSING = "CSRF token missing."
34 REASON_MALFORMED_REFERER = "Referer checking failed - Referer is malformed."
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/pr_limit/tests.py line 10

Likely real
Yes, 56% confidence

Possible hardcoded password: 'test-token'
```
9 REPO = "django/django"
10 TOKEN = "test-token"
11 PR_NUMBER = 20
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/conf/global_settings.py line 215

Likely real
Uncertain, 45% confidence

Possible hardcoded password: ''
```
214 EMAIL_HOST_USER = ""
215 EMAIL_HOST_PASSWORD = ""
216 EMAIL_USE_TLS = False
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 367

Likely real
Uncertain, 45% confidence

Possible hardcoded password: ''
```
366         # Check non-cookie token for match.
367         request_csrf_token = ""
368         if request.method == "POST":
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/middleware/csrf.py line 378

Likely real
Uncertain, 45% confidence

Possible hardcoded password: ''
```
377 
378         if request_csrf_token == "":
379             # Fall back to X-CSRFToken, to make things easier for AJAX, and
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/conf/global_settings.py line 279

Likely real
Uncertain, 44% confidence

Possible hardcoded password: ''
```
278 # loudly.
279 SECRET_KEY = ""
280
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/utils/version.py line 237

Likely real
Probably noise, 24% confidence

subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell
```
236         capture_output=True,
237         shell=True,
238         cwd=repo_dir,
239         text=True,
240     )
241     timestamp = git_log.stdout
242     tz = datetime.UTC
243     try:
244         timestamp = datetime.datetime.fromtimestamp(int(timestamp), tz=tz)
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/django/core/management/commands/dbshell.py line 1

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
1 import subprocess
2 
3 from django.core.management.base import BaseCommand, CommandError
```
Engine
Bandit · Python security linter

Counts towards
Vulnerability

File
/scripts/do_django_release.py line 13

Likely real
Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.
```
12 import re
13 import subprocess
14 from datetime import date
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'argon2-cffi>=23.1.0' — attacker could push malicious update
```
argon2-cffi>=23.1.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'grunt^1.6.2' — attacker could push malicious update
```
grunt:^1.6.2
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'grunt-cli^1.5.0' — attacker could push malicious update
```
grunt-cli:^1.5.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'grunt-contrib-qunit^10.2.0' — attacker could push malicious update
```
grunt-contrib-qunit:^10.2.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
package.json

Likely real
Probably noise, 2% confidence

Loose version constraint: 'qunit^2.25.0' — attacker could push malicious update
```
qunit:^2.25.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'asgiref>=3.13' — attacker could push malicious update
```
asgiref>=3.13
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'sqlparse>=0.5.0' — attacker could push malicious update
```
sqlparse>=0.5.0
```
Engine
Dependency checker · CVEs, typosquats and risky installs

Counts towards
Supply chain

File
pyproject.toml

Likely real
Probably noise, 2% confidence

Loose version constraint: 'bcrypt>=4.1.1' — attacker could push malicious update
```
bcrypt>=4.1.1
```