Executive brief
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
Affected products
- PyPI reportlab
Junglewise Threat Intelligence
PYSEC-2019-47 - ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document
Severity: info · Published 2019-10-16
Technologies: reportlab (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1871 - Reportlab vulnerable to remote code execution
- PYSEC-2026-522 - ReportLab vulnerable to remote code execution via paraparser
- PYSEC-2021-146 - All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSch
- PYSEC-2019-117 - ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document