Vulnerability CVE-2019-17626
Published: 2019-10-16

Description:
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

 References:
https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
https://bitbucket.org/rptlab/reportlab/src/default/CHANGES.md
Copyright 2024, cxsecurity.com

 

Back to Top