Description
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xhtml2pdf | xhtml2pdf | < 0.2.19 | 0.2.19 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xhtml2pdf | No fix yet | — |
| Debian 13 | xhtml2pdf | No fix yet | — |
| Debian 12 | xhtml2pdf | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | xhtml2pdf | No fix yet | — |
| Ubuntu 26.04 LTS | xhtml2pdf | No fix yet | — |
| Ubuntu 24.04 LTS | xhtml2pdf | No fix yet | — |
| Ubuntu 22.04 LTS | xhtml2pdf | No fix yet | — |
| Ubuntu 20.04 LTS | xhtml2pdf | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | xhtml2pdf | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-xhtml2pdf | 0.2.24-1.1 | openSUSE-SU-2026:12160-1 |
Advisories 1
- openSUSE-SU-2026:12160-1 python313-xhtml2pdf-0.2.24-1.1 on GA media SUSE / openSUSE Security Updates · Oct 17, 2026
References
- https://github.com/xhtml2pdf/xhtml2pdf/pull/835 patch issue-tracking
- https://github.com/xhtml2pdf/xhtml2pdf/commit/f86380dad15b3a6810201d08755a3ee6b19d5063 patch
- v0.2.19 Release Notes release-notes
- https://github.com/xhtml2pdf/xhtml2pdf/blob/v0.2.18/xhtml2pdf/pisa.py#L393-L400 technical-description
- VulnCheck Advisory: xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name third-party-advisory