TL;DR: Every core module of a popular firewall management SDK uses Python's unsafe XML parser. Here's what that means for production systems — and how to fix it in 10 lines.
Your SDK dependencies may be parsing untrusted XML without protection — and you wouldn't know until an incident.
I audited an open source Python SDK for firewall management. Auditor Core v2.3 flagged 13 critical findings across 10 production modules — all the same root cause.
Every core module uses Python's native xml.etree.ElementTree parser — the one Python's own documentation recommends replacing.
Affected files: base.py, firewall.py, network.py, panorama.py, policies.py, objects.py, ha.py, plugins.py, userid.py, __init__.py.
The library's purpose is to parse XML responses from live network devices. Any attacker-influenced response (MitM, compromised appliance, rogue endpoint) gets processed without XXE or Billion Laughs protection.
Second finding: hashlib.sha1() used for value hashing in production logic — with the comment documenting it explicitly in the source. SHA-1 has been broken since 2017.
Both were found using Auditor Core v2.3 — my deterministic security engine that combines SAST, SCA, secrets, and CI/CD analysis with AI validation.
What makes it different from running Bandit or Semgrep directly:
→ Findings are deduplicated and correlated across detectors (the SHA-1 issue was caught by 3 rules, reported once with full context)
→ Every finding maps to SOC 2 TSC, CIS Controls v8, and ISO 27001:2022
→ Code quality noise is separated from real vulnerabilities before report generation
→ PDF output is structured for cyber insurance underwriting and SOC 2 readiness
The fix is trivial: replace import xml.etree.ElementTree as ET with import defusedxml.ElementTree as ET in each module. Drop-in compatible.
The broader lesson: libraries defer security hardening of internal parsing, then ship that risk into hundreds of downstream projects.
I'm currently offering confidential audits for Python/TS backends — $490, 3-day turnaround, NDA, SOC 2 ready report. If your team hasn't reviewed its dependencies for unsafe XML parsing or weak crypto this year, let's talk.