Run Bandit on CI via pre-commit

.pre-commit-config.yaml

@@ -3,7 +3,7 @@ repos:
     rev: 22.12.0
     hooks:
       - id: black
-        args: ["--target-version", "py37"]
+        args: [--target-version=py37]
         # Only .py files, until https://github.com/psf/black/issues/402 resolved
         files: \.py$
         types: []
@@ -13,6 +13,13 @@ repos:
     hooks:
       - id: isort
 
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.4
+    hooks:
+    - id: bandit
+      args: [--severity-level=high]
+      files: ^src/
+
   - repo: https://github.com/asottile/yesqa
     rev: v1.4.0
     hooks:

src/PIL/ImageShow.py

@@ -125,7 +125,7 @@ class Viewer:
                 path = options.pop("file")
             else:
                 raise TypeError("Missing required argument: 'path'")
-        os.system(self.get_command(path, **options))
+        os.system(self.get_command(path, **options))  # nosec
         return 1