python-vulnerable-outdated-components

A Python security rule set based on OWASP’s guidance about vulnerable and outdated components. OWASP is a security organisation that publishes common web-application risks.

In plain words
What is it for?
Checking Python dependency files such as requirements files, setup.py, and pyproject.toml for unpinned or potentially outdated packages.
Why use it?
It flags dependencies without fixed versions and examples of old Django or Flask versions that may miss security updates.

Cursor rule for Cursor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/abderrahimghazali/cursor-rules/python-vulnerable-outdated-components
Clone the repo
git clone --depth 1 https://github.com/abderrahimghazali/cursor-rules

Made for: Cursor.

Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 2,880 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.02880
Opus 5 $0.00000 $0.01440
Sonnet 5 $0.00000 $0.00576
Haiku 4.5 $0.00000 $0.00288

Measured yesterday against content hash ba8ce975a780, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

python-vulnerable-outdated-components scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- pattern: "from\\s+xml\\.etree\\.ElementTree\\s+import\\s+.*parse|from\\s+urllib2\\s+import|from\\s+urllib\\s+import\\s+urlopen|import\\s+cgi|import\\s+imp"
.cursor/rules/python-vulnerable-outdated-components.mdc · 251 lines

How it starts

The opening of the file, as written. The whole thing — 251 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Python Vulnerable and Outdated Components Standards (OWASP A06:2021)

This rule enforces security best practices to prevent vulnerabilities related to outdated dependencies and components in Python applications, as defined in OWASP Top 10:2021-A06.

actions:

  • type: enforce conditions:

    Pattern 1: Unpinned dependencies in requirements files

    • pattern: "^(django|flask|fastapi|requests|cryptography|pyyaml|sqlalchemy|celery|numpy|pandas|pillow|tensorflow|torch|boto3|psycopg2)\s*$" file_pattern: "requirements.*\.txt$|setup\.py$|pyproject\.toml$" message: "Unpinned dependency detected. Always pin dependencies to specific versions to prevent automatic updates to potentially vulnerable versions."

    Pattern 2: Outdated/vulnerable Django versions

    • pattern: "django([<>=]=|~=|==)\s*["']?(1\.|2\.[0-2]\.|3\.[0-2]\.|4\.0\.)[0-9]+["']?" message: "Potentially outdated Django version detected. Consider upgrading to the latest stable version with security updates."

    Pattern 3: Outdated/vulnerable Flask versions

    • pattern: "flask([<>=]=|~=|==)\s*["']?(0\.|1\.[0-3]\.|2\.0\.[0-3])[0-9]*["']?" message: "Potentially outdated Flask version detected. Consider upgrading to the latest stable version with security updates."

    Pattern 4: Outdated/vulnerable Requests versions

    • pattern: "requests([<>=]=|~=|==)\s*["']?(0\.|1\.|2\.[0-2][0-5]\.[0-9]+)["']?" message: "Potentially outdated Requests version detected. Consider upgrading to the latest stable version with security updates."

    Pattern 5: Outdated/vulnerable Cryptography versions

    • pattern: "cryptography([<>=]=|~=|==)\s*["']?(0\.|1\.|2\.|3\.[0-3]\.|3\.4\.[0-7])[0-9]*["']?" message: "Potentially outdated Cryptography version detected. Consider upgrading to the latest stable version with security updates."

    Pattern 6: Outdated/vulnerable PyYAML versions

    • pattern: "pyyaml([<>=]=|~=|==)\s*["']?(0\.|1\.|2\.|3\.|4\.|5\.[0-5]\.[0-9]+)["']?" message: "Potentially outdated PyYAML version detected. Consider upgrading to the latest stable version with security updates."

    Pattern 7: Outdated/vulnerable Pillow versions

    • pattern: "pillow([<>=]=|~=|==)\s*["']?(0\.|1\.|2\.|3\.|4\.|5\.|6\.|7\.|8\.[0-3]\.[0-9]+)["']?" message: "Potentially outdated Pillow version detected. Consider upgrading to the latest stable version with security updates."

    Pattern 8: Direct imports of deprecated modules

    • pattern: "from\s+xml\.etree\.ElementTree\s+import\s+.*parse|from\s+urllib2\s+import|from\s+urllib\s+import\s+urlopen|import\s+cgi|import\s+imp" message: "Use of deprecated or insecure module detected. Consider using more secure alternatives."

    Pattern 9: Use of deprecated functions

    • pattern: "\.set_password\([^)]*\)|hashlib\.md5\(|hashlib\.sha1\(|random\.random\(|random\.randrange\(|random\.randint\(" message: "Use of deprecated or insecure function detected. Consider using more secure alternatives."

    Pattern 10: Insecure dependency loading

    • pattern: "import\(|importlib\.import_module\(|exec\(|eval\(" message: "Dynamic code execution or module loading detected. This can lead to code injection if user input is involved."

    Pattern 11: Outdated TLS/SSL versions

    • pattern: "ssl\.PROTOCOL_TLSv1|ssl\.PROTOCOL_TLSv1_1|ssl\.PROTOCOL_SSLv2|ssl\.PROTOCOL_SSLv3|ssl\.PROTOCOL_TLSv1_2" message: "Outdated TLS/SSL protocol version detected. Use ssl.PROTOCOL_TLS_CLIENT or ssl.PROTOCOL_TLS_SERVER instead."

Read the full file on GitHub · 251 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 251 lines · 2,880 tokens per session scan A ba8ce975a780

Subscribe to this mod's changes

python-vulnerable-outdated-components is a cursor rule published in the GitHub repository abderrahimghazali/cursor-rules (2 stars, last pushed 1y ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,880 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.