Search for packages
| purl | pkg:pypi/reportlab@2.6 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7ae4-65em-sbdg
Aliases: CVE-2019-17626 GHSA-qpg2-vx7j-3869 PYSEC-2019-117 |
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code. |
Affected by 3 other vulnerabilities. |
|
VCID-gn2v-c44r-7bc8
Aliases: CVE-2019-19450 GHSA-pj98-2xf6-cff5 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626. |
Affected by 2 other vulnerabilities. |
|
VCID-jkaa-rknn-p7au
Aliases: CVE-2020-28463 GHSA-mpvw-25mg-59vx PYSEC-2021-146 SNYK-PYTHON-REPORTLAB-1022145 |
url request injection |
Affected by 1 other vulnerability. |
|
VCID-u1pp-ngnq-ybar
Aliases: PYSEC-2019-47 |
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code. |
Affected by 3 other vulnerabilities. |
|
VCID-vz5z-udbg-vufv
Aliases: CVE-2023-33733 GHSA-9q9m-c65c-37pq |
Reportlab vulnerable to remote code execution Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||