10 Common Python Security Vulnerabilities and How to Fix Them

Writing secure code is challenging; many Python developers are unaware of common pitfalls in the standard library and third‑party packages.

1. Input Injection

Injection attacks such as SQL injection, command injection via popen, subprocess, or os.system can occur when user‑controlled data is concatenated into queries or shell commands. Use ORM sanitization, framework utilities, or shlex for proper escaping.

2. Unsafe XML Parsing

Parsing untrusted XML can trigger denial‑of‑service attacks like the “billion laughs” payload or external entity expansion, allowing attackers to consume massive memory or access internal resources. Replace vulnerable standard modules with defusedxml to mitigate these risks.

3. Misuse of assert Statements

Using assert for runtime security checks is unsafe because Python can be started with optimizations that skip these statements, potentially exposing privileged code paths. Reserve assert for testing only.

4. Timing Attacks

When password comparison is performed with naive string equality, an attacker can measure execution time to infer correct characters. Use secrets.compare_digest (Python 3.5+) for constant‑time comparisons.

5. Compromised site‑packages or Import Path

Installing malicious packages that mimic popular names or injecting code via the import system can give attackers arbitrary execution. Employ virtual environments, audit dependencies with tools like PyUp.io, and verify package signatures.

6. Insecure Temporary Files

Creating temporary files with mktemp() is vulnerable to race conditions; another process may replace the file between name generation and opening. Use tempfile.mkstemp() or higher‑level tempfile utilities instead.

7. Unsafe yaml.load

Loading untrusted YAML with yaml.load can execute arbitrary objects, similar to pickle.load. Always prefer yaml.safe_load unless a trusted schema is guaranteed.

8. Pickle Deserialization Vulnerabilities

Deserializing untrusted data with pickle allows execution of arbitrary code via the __reduce__ protocol. Never unpickle data from unknown sources; use safer formats like JSON.

9. Using Out‑of‑Date System Python

System‑provided Python interpreters (often Python 2) may contain known C‑level memory safety bugs. Regularly upgrade to the latest Python releases to obtain upstream security patches.

10. Unpatched Dependency Packages

Third‑party libraries can harbor vulnerabilities; relying on fixed versions without monitoring updates is risky. Use dependency‑checking services (e.g., PyUp.io) and automation tools like InSpec to verify that installed packages are free of known CVEs.