Follow-up on GHSA-ggq6-wv5j-cpfg

[rise0311]

Describe the bug

Dear Mantainers，

Just wanted to gently follow up on the security advisory (GHSA-ggq6-wv5j-cpfg) I submitted about two weeks ago.

I understand you're likely busy, so I wanted to make sure this didn't fall through the cracks. If you have any questions about the report or need more details to reproduce the issue, please let me know. I'm happy to help.

Thanks for your time!

Reproduction steps

Details are included in the advisory (GHSA-ggq6-wv5j-cpfg)

Expected behavior

Validate this bug. And if this bug truly exists, repair it.

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response