Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/reportlab@3.1.8
purl pkg:pypi/reportlab@3.1.8
Next non-vulnerable version 3.5.55
Latest non-vulnerable version 3.6.13
Risk
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-7ae4-65em-sbdg
Aliases:
CVE-2019-17626
GHSA-qpg2-vx7j-3869
PYSEC-2019-117
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
3.5.28
Affected by 1 other vulnerability.
VCID-jkaa-rknn-p7au
Aliases:
CVE-2020-28463
GHSA-mpvw-25mg-59vx
PYSEC-2021-146
SNYK-PYTHON-REPORTLAB-1022145
url request injection
3.5.55
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:08:22.165498+00:00 Pypa Importer Affected by VCID-jkaa-rknn-p7au https://github.com/pypa/advisory-database/blob/main/vulns/reportlab/PYSEC-2021-146.yaml 38.6.0
2026-06-02T04:05:55.295419+00:00 Pypa Importer Affected by VCID-7ae4-65em-sbdg https://github.com/pypa/advisory-database/blob/main/vulns/reportlab/PYSEC-2019-117.yaml 38.6.0