> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="dangerous-spawn-process">
    Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="insecure-hash-algorithm-sha1">
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="insecure-hash-algorithm-md5">
    Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="dangerous-subinterpreters-run-string">
    Found user controlled content in `run_string`. This is dangerous because it allows a malicious actor to run arbitrary Python code.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="use-defused-xmlrpc">
    Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
    <br />**OWASP**: <br />- A04:2017 - XML External Entities (XXE)
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="dangerous-interactive-code-run">
    Found user controlled data inside InteractiveConsole/InteractiveInterpreter method. This is dangerous if external data can reach this function call because it allows a malicious actor to run arbitrary Python code.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="dangerous-globals-use">
    Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="dangerous-os-exec">
    Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="use-defused-xml-parse">
    The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks.  These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead  the Python documentation recommends using `defusedxml`.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-611: Improper Restriction of XML External Entity Reference
    <br />**OWASP**: <br />- A04:2017 - XML External Entities (XXE)
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="use-defused-xml">
    The Python documentation recommends using `defusedxml` instead of `xml` because the native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-611: Improper Restriction of XML External Entity Reference
    <br />**OWASP**: <br />- A04:2017 - XML External Entities (XXE)
    <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="dangerous-subprocess-use">
    Detected subprocess function '\$FUNC' with user controlled data. A malicious actor could leverage this to perform command injection. You may consider using 'shlex.escape()'.<br />**Likelihood**: MEDIUM<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="unverified-ssl-context">
    Unverified SSL context detected. This will permit insecure connections without verifying SSL certificates. Use 'ssl.create\_default\_context' instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-295: Improper Certificate Validation
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A07:2021 - Identification and Authentication Failures
  </Accordion>

  <Accordion title="use-defusedcsv">
    Detected the generation of a CSV file using the built-in `csv` module. If user data is used to generate the data in this file, it is possible that an attacker could inject a formula when the CSV is imported into a spreadsheet application that runs an attacker script, which could steal data from the importing user or, at worst, install malware on the user's computer. `defusedcsv` is a drop-in replacement with the same API that will attempt to mitigate formula injection attempts. You can use `defusedcsv` instead of `csv` to safely generate CSVs.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-1236: Improper Neutralization of Formula Elements in a CSV File
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="dangerous-system-call">
    Found user-controlled data used in a system call. This could allow a malicious actor to execute commands. Use the 'subprocess' module instead, which is easier to use without accidentally exposing a command injection vulnerability.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="dangerous-testcapi-run-in-subinterp">
    Found user controlled content in `run_in_subinterp`. This is dangerous because it allows a malicious actor to run arbitrary Python code.<br />**Likelihood**: HIGH<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
    <br />**OWASP**: <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="insecure-hash-function">
    Detected use of an insecure MD4 or MD5 hash function. These functions have known vulnerabilities and are considered deprecated. Consider using 'SHA256' or a similar function instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>
</AccordionGroup>