Executive brief
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Affected products
- PyPI pygments
Junglewise Threat Intelligence
CVE-2015-8557: PYSEC-2016-32 - The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrar
CVE-2015-8557 · Severity: low · CVSS 3 · Published 2016-01-08
Technologies: pygments (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2987 - Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
- PYSEC-2023-117 - A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.
- PYSEC-2021-140 - An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standa
- PYSEC-2021-141 - In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular ex