CVE-2019-17626: Critical severity reportlab reportlab vulnerability
A vulnerability was found in ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
Reference: https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code https://bitbucket.org/rptlab/reportlab/src/default/CHANGES.md
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17626?
CVE-2019-17626 is a vulnerability in ReportLab through 3.5.26 that allows remote code execution.
How severe is CVE-2019-17626?
CVE-2019-17626 has a severity score of 9.8, which is considered critical.
How does CVE-2019-17626 allow remote code execution?
CVE-2019-17626 allows remote code execution through the 'toColor(eval(arg))' function in colors.py when processing a crafted XML document.
Which software versions are affected by CVE-2019-17626?
CVE-2019-17626 affects ReportLab versions up to and including 3.5.26.
How can I fix CVE-2019-17626?
To fix CVE-2019-17626, update ReportLab to version 3.5.28 or later.