I.e. right now they are insisting we use v3.12 only because older versions have some vulnerabilities their scanner picked up.
I need to somehow explain that this is a terrible idea and that many packages won't support the most up to date version without causing them to panic and overstep even more.
This requirement is company wide (affects development, data science and analytics).
Edit - thanks for all the advice, I think the crux is that they don't understand how the versioning works and are confusing major and minor versions. I will explain this and hopefully we will be able to use the latest minor versions for 3.11/3.10/3.9
Microsoft Vulnerability Manager Security Recommendations - Python
Is Python a Security Vulnerability?
No, there is nothing inherently insecure about python.
However Python can be used to make a vulnerability. For instance it would be easy to make a web portal that executes anything that is typed in. This is true for any programming language, but python makes it extra easy.
And I know, you would know better, but IT departments see all their users as idiots (often with good reason).
More on reddit.comCritical Python Package Vulnerability Now Actively Exploited – CVE-2025-3248
How can I check Python package vulnerabilities before installing them in Microsoft Fabric?
I recently sent a request to my employer's IT department asking for access to Python 3.6.3. The request was denied with the justification "Python is dangerous to have on a pc. It is a useful attack vector."
Can anyone provide insight on what this might mean? Does simply having Python installed on your computer make you more susceptible to attacks? I can't tell if my employer has a valid concern here or if they are just taking the easy route.
EDIT: Spelling
No, there is nothing inherently insecure about python.
However Python can be used to make a vulnerability. For instance it would be easy to make a web portal that executes anything that is typed in. This is true for any programming language, but python makes it extra easy.
And I know, you would know better, but IT departments see all their users as idiots (often with good reason).
Every Macintosh and a lot of Linux distributions for desktop have Python installed by default. I don't think they are unsafe.
There's a critical unauthenticated RCE vulnerability (CVSS 9.8) in Langflow (<1.3.0), a widely-used Python framework for building AI apps (70k+ GitHub stars, 21k+ PyPI downloads/week).
Link to blog post:
https://cloudsmith.com/blog/cve-2025-3248-serious-vulnerability-found-in-popular-python-ai-package
Attackers are actively exploiting this flaw to install the Flodrix DDoS botnet via the /api/v1/validate/code endpoint, which (incredibly) uses ast.parse() + compile() + exec() without auth.
If you're pulling anything from PyPI or running Langflow-based AI services exposed to the internet, you should check your versions now.
I often install Python packages using pip install in notebooks. I want to make sure the packages I use are safe with a tool that acts as a gatekeeper or alerts me about known vulnerabilities before installation.
Does Microsoft Fabric support anything like Microsoft Defender for package-level security?
If not, are there best practices or external tools I can integrate into to check packages? Has anyone solved this kind of problem for securing Python environments in a managed platform like Fabric?