Don't use PyYAML's .load() for reading YAML, use .safe_load() to avoid security problems.

common/lib/xmodule/xmodule/x_module.py

@@ -406,7 +406,7 @@ class ResourceTemplates(object):
                 log.warning("Skipping unknown template file %s" % template_file)
                 continue
             template_content = resource_string(__name__, os.path.join(dirname, template_file))
-            template = yaml.load(template_content)
+            template = yaml.safe_load(template_content)
             templates.append(Template(**template))
 
         return templates