From ce262e1c4e7afdd22c17d26e2aa2d64f0dcebbd5 Mon Sep 17 00:00:00 2001 From: anupamme Date: Thu, 3 Sep 2026 05:30:48 +0000 Subject: [PATCH] fix: gitlab.bandit.B313.B314.B315.B316.B318.B319.B320.B405.B406.B407.B408.B409.B410 security vulnerability Automated security fix generated by OrbisAI Security --- lib/crewai-tools/pyproject.toml | 1 + .../src/crewai_tools/rag/loaders/xml_loader.py | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/lib/crewai-tools/pyproject.toml b/lib/crewai-tools/pyproject.toml index ab17af65b5..9f5f0feddc 100644 --- a/lib/crewai-tools/pyproject.toml +++ b/lib/crewai-tools/pyproject.toml @@ -16,6 +16,7 @@ dependencies = [ "python-docx~=1.2.0", "youtube-transcript-api~=1.2.2", "pymupdf~=1.26.6", + "defusedxml>=0.7.1,<1", ] diff --git a/lib/crewai-tools/src/crewai_tools/rag/loaders/xml_loader.py b/lib/crewai-tools/src/crewai_tools/rag/loaders/xml_loader.py index f7f9a6d00d..baf8c51418 100644 --- a/lib/crewai-tools/src/crewai_tools/rag/loaders/xml_loader.py +++ b/lib/crewai-tools/src/crewai_tools/rag/loaders/xml_loader.py @@ -1,5 +1,6 @@ from typing import Any -from xml.etree.ElementTree import ParseError, fromstring, parse + +from defusedxml.ElementTree import ParseError, fromstring, parse from crewai_tools.rag.base_loader import BaseLoader, LoaderResult from crewai_tools.rag.loaders.utils import load_from_url @@ -40,9 +41,9 @@ def _load_from_file(path: str) -> str: def _parse_xml(self, content: str, source_ref: str) -> LoaderResult: try: if content.strip().startswith("<"): - root = fromstring(content) # noqa: S314 + root = fromstring(content) else: - root = parse(source_ref).getroot() # noqa: S314 + root = parse(source_ref).getroot() text_parts = [] for text_content in root.itertext():