Skip to content
OpenAdvisories
Critical USN-2862-1 1 CVE

pygments vulnerability

Published Jan 7, 2016 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Pygments incorrectly sanitized strings used to
search system fonts. An attacker could possibly use this issue to execute
arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS pygments 1.6+dfsg-1ubuntu1.1

Vulnerabilities 1

  • Critical 9.0
    CVE-2015-8557

    Command Injection in Pygments

    The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

    pygments pygments pygments Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2015-8557