Will It Vibe?XML parser with resolve_entities=True (Python)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
An lxml XMLParser created with resolve_entities=True expands external entities, which is XXE: local file disclosure and SSRF. Use defusedxml or leave resolve_entities at its safe default.
Why it matters
Creating an lxml XMLParser with resolve_entities=True expands external entities, so a crafted document can read local files or trigger requests to internal hosts (XXE and SSRF). The safe default already blocks this.
How to fix it
Remove resolve_entities=True, and for untrusted XML use the defusedxml package, which disables entity expansion and other XML attacks by default. If you use lxml directly, also set no_network=True and resolve_entities=False on the parser.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo