Skip to content

CVE-2019-19450

ReportLab vulnerable to remote code execution via paraparser

9.8 CriticalFix available

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

5.98%Up 5.9 points since Sep 22, 2023

What each source reports

NVD Score used 9.8

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: CVE-2019-19450
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-91
Updated: 2026-11-02

CVE List No score

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: CVE-2019-19450
Updated: 2026-11-02

EUVDEUVD-2023-2562 No score

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: EUVD-2023-2562
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pj98-2xf6-cff5 9.8

ReportLab vulnerable to remote code execution via paraparser

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: GHSA-pj98-2xf6-cff5
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-91
Updated: 2026-11-02

OSV 9.8

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: CVE-2019-19450
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-19450 9.8

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: DEBIAN-CVE-2019-19450
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 12 moreShow less

OSVGHSA-pj98-2xf6-cff5 9.8

ReportLab vulnerable to remote code execution via paraparser

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: GHSA-pj98-2xf6-cff5
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-91
Updated: 2026-11-02

OSVPYSEC-2026-522 9.8

ReportLab vulnerable to remote code execution via paraparser

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: PYSEC-2026-522
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:5616 9.8

Red Hat Security Advisory: python-reportlab security update

Record: RHSA-2023:5616
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:5786 9.8

Red Hat Security Advisory: python-reportlab security update

Record: RHSA-2023:5786
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:5787 9.8

Red Hat Security Advisory: python-reportlab security update

Record: RHSA-2023:5787
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:5788 9.8

Red Hat Security Advisory: python-reportlab security update

Record: RHSA-2023:5788
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:5789 9.8

Red Hat Security Advisory: python-reportlab security update

Record: RHSA-2023:5789
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:5790 9.8

Red Hat Security Advisory: python-reportlab security update

Record: RHSA-2023:5790
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-19450 9.8

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Record: UBUNTU-CVE-2019-19450
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVALSA-2023:5790 No score

Important: python-reportlab security update

Python-reportlab is a library used for generation of PDF documents.

Security Fix(es):

python-reportlab: code injection in paraparser.py allows code execution (CVE-2019-19450)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2023:5790
Updated: 2026-11-02

OSVSUSE-SU-2023:3972-1 No score

Security update for python-reportlab

This update for python-reportlab fixes the following issues:

CVE-2019-19450: Fixed an issue which allowed remote code execution via start_unichar in paraparser.py evaluating untrusted user input. (bsc#1215560)

Record: SUSE-SU-2023:3972-1
Updated: 2026-11-02

OSVSUSE-SU-2023:4048-1 No score

Security update for python-reportlab

This update for python-reportlab fixes the following issues:

CVE-2019-19450: Fixed an issue which allowed remote code execution via start_unichar in paraparser.py evaluating untrusted user input. (bsc#1215560)

Record: SUSE-SU-2023:4048-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`reportlab` PyPI	before 3.5.31	3.5.31
`python3-reportlab` AlmaLinux:8	before 3.4.0-8.el8_8.1.alma.1	3.4.0-8.el8_8.1.alma.1
`python-reportlab` Debian:12	before 3.5.31-1	3.5.31-1
`python-reportlab` Debian:13	before 3.5.31-1	3.5.31-1
`python-reportlab` Debian:14	before 3.5.31-1	3.5.31-1
`python-reportlab` Debian:10 From an advisory covering 2 CVEs	before 3.5.13-1+deb10u2, plus listed versions 3.5.13-13.5.13-1+deb10u1	3.5.13-1+deb10u2
`reportlab` PyPI	before 3.5.31, plus listed versions 2.02.32.42.52.6 Show 28 moreShow less 2.73.03.1.443.1.83.2.03.3.03.4.03.5.03.5.13.5.103.5.113.5.123.5.133.5.163.5.173.5.183.5.193.5.23.5.203.5.213.5.233.5.263.5.283.5.43.5.53.5.63.5.83.5.9	3.5.31
`python-reportlab` Red Hat:enterprise_linux:7::client	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab-debuginfo` Red Hat:enterprise_linux:7::client	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab-docs` Red Hat:enterprise_linux:7::client	before 0:2.5-11.el7_9	0:2.5-11.el7_9

Show 49 moreShow less

Affected packages
Package	Affected	Fixed
`python-reportlab` Red Hat:enterprise_linux:7::server	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab-debuginfo` Red Hat:enterprise_linux:7::server	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab-docs` Red Hat:enterprise_linux:7::server	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab` Red Hat:enterprise_linux:7::workstation	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab-docs` Red Hat:enterprise_linux:7::workstation	before 0:2.5-11.el7_9	0:2.5-11.el7_9
`python-reportlab` Red Hat:rhel_eus:8.6::appstream	before 0:3.4.0-8.el8_6.1	0:3.4.0-8.el8_6.1
`python-reportlab-debugsource` Red Hat:rhel_eus:8.6::appstream	before 0:3.4.0-8.el8_6.1	0:3.4.0-8.el8_6.1
`python3-reportlab` Red Hat:rhel_eus:8.6::appstream	before 0:3.4.0-8.el8_6.1	0:3.4.0-8.el8_6.1
`python3-reportlab-debuginfo` Red Hat:rhel_eus:8.6::appstream	before 0:3.4.0-8.el8_6.1	0:3.4.0-8.el8_6.1
`python-reportlab` Red Hat:rhel_aus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python-reportlab-debugsource` Red Hat:rhel_aus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python3-reportlab` Red Hat:rhel_aus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python3-reportlab-debuginfo` Red Hat:rhel_aus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python-reportlab` Red Hat:rhel_e4s:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python-reportlab-debugsource` Red Hat:rhel_e4s:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python3-reportlab` Red Hat:rhel_e4s:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python3-reportlab-debuginfo` Red Hat:rhel_e4s:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python-reportlab` Red Hat:rhel_tus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python-reportlab-debugsource` Red Hat:rhel_tus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python3-reportlab` Red Hat:rhel_tus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python3-reportlab-debuginfo` Red Hat:rhel_tus:8.4::appstream	before 0:3.4.0-8.el8_4.1	0:3.4.0-8.el8_4.1
`python-reportlab` Red Hat:rhel_aus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python-reportlab-debugsource` Red Hat:rhel_aus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python3-reportlab` Red Hat:rhel_aus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python3-reportlab-debuginfo` Red Hat:rhel_aus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python-reportlab` Red Hat:rhel_e4s:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python-reportlab-debugsource` Red Hat:rhel_e4s:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python3-reportlab` Red Hat:rhel_e4s:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python3-reportlab-debuginfo` Red Hat:rhel_e4s:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python-reportlab` Red Hat:rhel_tus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python-reportlab-debugsource` Red Hat:rhel_tus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python3-reportlab` Red Hat:rhel_tus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python3-reportlab-debuginfo` Red Hat:rhel_tus:8.2::appstream	before 0:3.4.0-8.el8_2.1	0:3.4.0-8.el8_2.1
`python-reportlab` Red Hat:rhel_e4s:8.1::appstream	before 0:3.4.0-6.el8_1.5	0:3.4.0-6.el8_1.5
`python-reportlab-debugsource` Red Hat:rhel_e4s:8.1::appstream	before 0:3.4.0-6.el8_1.5	0:3.4.0-6.el8_1.5
`python3-reportlab` Red Hat:rhel_e4s:8.1::appstream	before 0:3.4.0-6.el8_1.5	0:3.4.0-6.el8_1.5
`python3-reportlab-debuginfo` Red Hat:rhel_e4s:8.1::appstream	before 0:3.4.0-6.el8_1.5	0:3.4.0-6.el8_1.5
`python-reportlab` Red Hat:enterprise_linux:8::appstream	before 0:3.4.0-8.el8_8.1	0:3.4.0-8.el8_8.1
`python-reportlab-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:3.4.0-8.el8_8.1	0:3.4.0-8.el8_8.1
`python3-reportlab` Red Hat:enterprise_linux:8::appstream	before 0:3.4.0-8.el8_8.1	0:3.4.0-8.el8_8.1
`python3-reportlab-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:3.4.0-8.el8_8.1	0:3.4.0-8.el8_8.1
`python-reportlab` SUSE:Linux Enterprise Module for Package Hub 15 SP4	before 3.4.0-150000.3.12.1	3.4.0-150000.3.12.1
`python-reportlab` SUSE:Linux Enterprise Module for Package Hub 15 SP5	before 3.4.0-150000.3.12.1	3.4.0-150000.3.12.1
`python-reportlab` openSUSE:Leap 15.4	before 3.4.0-150000.3.12.1	3.4.0-150000.3.12.1
`python-reportlab` openSUSE:Leap 15.5	before 3.4.0-150000.3.12.1	3.4.0-150000.3.12.1
`python-reportlab` SUSE:Linux Enterprise Workstation Extension 12 SP5	before 2.7-3.16.1	2.7-3.16.1
`python-reportlab` Ubuntu:16.04:LTS	All versions, plus listed versions 3.2.0-1build13.2.0-1build23.3.0-13.3.0-1ubuntu0.1	None known
`python-reportlab` Ubuntu:18.04:LTS	All versions, plus listed versions 3.4.0-3build13.4.0-3ubuntu0.1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-19450 is a critical vulnerability (CVSS 9.8) in Reportlab, published September 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.98%, the 93rd percentile. Fixed in reportlab 3.5.31.

References

Show 29 moreShow less