~ / search / GHSA-qpg2-vx7j-3869

GHSA-qpg2-vx7j-3869

XML Injection in ReportLab

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-17626

Packages

EcosystemPackageAffectedFixed in
PyPI reportlab < 3.5.28 3.5.28

Details

As written in the advisory (Markdown source, shown as plain text).

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

References

External links from the advisory. They lead to third-party sites.