Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/reportlab@3.5.31
purl pkg:pypi/reportlab@3.5.31
Next non-vulnerable version 3.5.55
Latest non-vulnerable version 3.6.13
Risk
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-jkaa-rknn-p7au
Aliases:
CVE-2020-28463
GHSA-mpvw-25mg-59vx
PYSEC-2021-146
SNYK-PYTHON-REPORTLAB-1022145
url request injection
3.5.55
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-gn2v-c44r-7bc8 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626. CVE-2019-19450
GHSA-pj98-2xf6-cff5

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-02T04:45:50.072561+00:00 GitLab Importer Fixing VCID-gn2v-c44r-7bc8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/reportlab/CVE-2019-19450.yml 38.6.0
2026-06-02T04:08:22.268777+00:00 Pypa Importer Affected by VCID-jkaa-rknn-p7au https://github.com/pypa/advisory-database/blob/main/vulns/reportlab/PYSEC-2021-146.yaml 38.6.0