Vulnerabilities

TI-2019-14012 CVE-2019-19450 · GHSA-pj98-2xf6-cff5

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar…

MEDIUM 51

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by a…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05978 Published 2023-09-20 Partial fix · 3.5.31 CWE-91

TI-2023-16658 CVE-2023-33733 · GHSA-9q9m-c65c-37pq

Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

HIGH 69

Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.02123 Published 2023-06-05 Fixed in 3.6.13 CWE-94

TI-2020-17278 CVE-2020-28463 · GHSA-mpvw-25mg-59vx

Server-side request forgery (SSRF) in reportlab

LOW 32

All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01346 Published 2021-02-18 Partial fix · 3.5.55 CWE-918

TI-2019-13152 CVE-2019-17626 · GHSA-qpg2-vx7j-3869

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in…

MEDIUM 61

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09526 Published 2019-10-16 Partial fix · 3.5.28 CWE-91

Vulnerabilities

Filters

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar…

Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.

Server-side request forgery (SSRF) in reportlab

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in…