Critical DLA-2112-1 1 CVE

python-reportlab - security update

Published Feb 20, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 8	python-reportlab	3.1.8-3+deb8u2

Vulnerabilities 1

Critical 9.8

CVE-2019-17626

XML Injection in ReportLab

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

reportlab python-reportlab python-reportlab Debian Ubuntu PyPI

Oct 16, 2019