`bandit -ii -ll -ii -ll` raises an `IndexError`

Author: ngie-eignCreated May 22, 2026Updated Aug 17, 2026

Labelsbug

Describe the bug

Specifying -ii -ll twice on the command line to bandit appears to raise the following IndexError:

% bandit -ii -ll -ii -ll /tmp/empty.py 
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.14.5
Traceback (most recent call last):
  File "/Users/ngie/.local/bin/bandit", line 6, in <module>
    sys.exit(main())
             ~~~~^^
  File "/Users/ngie/.local/pipx/venvs/bandit/lib/python3.14/site-packages/bandit/cli/main.py", line 680, in main
    sev_level = constants.RANKING[args.severity - 1]
                ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
IndexError: list index out of range

This can happen if args.severity is None (not specified); a similar bug likely exists for args.confidence as well. I suspect it's caused by an edgecase with how -i is calculated vs --confidence-level.

The value should probably be reinterpreted using argparse's action= keyword argument.

Reproduction steps

bash

1. `echo > /tmp/empty.py`
2. `bandit -ii -ll -ii -ll /tmp/empty.py`

Expected behavior

The command should not raise an IndexError.

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response

Source: PyCQA/bandit

View original on GitHub View discussion on GitHub