CVE-2019-17626
XML Injection in ReportLab
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
CVE-2019-17626- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-91
- Updated
- 2026-11-02
CVE List
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
CVE-2019-17626- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
EUVDEUVD-2019-0122
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
EUVD-2019-0122- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qpg2-vx7j-3869
XML Injection in ReportLab
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
GHSA-qpg2-vx7j-3869- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
OSV
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
CVE-2019-17626- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-17626
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
DEBIAN-CVE-2019-17626- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 16 moreShow less
OSVGHSA-qpg2-vx7j-3869
XML Injection in ReportLab
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
GHSA-qpg2-vx7j-3869- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-91
- Updated
- 2026-11-02
OSVOESA-2021-1281
python-reportlab security update
The ReportLab Toolkit. An Open Source Python library for generating PDFs and graphics.
Security Fix(es):
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.(CVE-2019-17626)
- Record
OESA-2021-1281- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0195
Red Hat Security Advisory: python-reportlab security update
- Record
RHSA-2020:0195- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0197
Red Hat Security Advisory: python-reportlab security update
- Record
RHSA-2020:0197- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0201
Red Hat Security Advisory: python-reportlab security update
- Record
RHSA-2020:0201- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:0230
Red Hat Security Advisory: python-reportlab security update
- Record
RHSA-2020:0230- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-17626
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
UBUNTU-CVE-2019-17626- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0059 No score
Updated python-reportlab packages fix security vulnerability
A code injection vulnerability in python-reportlab allows an attacker to execute code while parsing a color attribute. An application that uses python-reportlab to parse untrusted input files may be vulnerable to this flaw and allow remote code execution (CVE-2019-17626).
- Record
MGASA-2020-0059- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:0160-1 No score
Security update for python-reportlab
This update for python-reportlab fixes the following issues:
- CVE-2019-17626: Fixed a potential remote code execution because of the lack of input sanitization in toColor() (bsc#1154370).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:0160-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11265-1 No score
python36-reportlab-3.5.59-2.6 on GA media
These are all security issues fixed in the python36-reportlab-3.5.59-2.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11265-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14160-1 No score
python310-reportlab-4.0.7-1.3 on GA media
These are all security issues fixed in the python310-reportlab-4.0.7-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14160-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12037-1 No score
python313-reportlab-4.5.1-1.2 on GA media
These are all security issues fixed in the python313-reportlab-4.5.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12037-1- Updated
- 2026-11-02
OSVPYSEC-2019-117 No score
ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.
- Record
PYSEC-2019-117- Updated
- 2026-11-02
OSVSUSE-SU-2020:0255-1 No score
Security update for python-reportlab
This update for python-reportlab fixes the following issues:
- CVE-2019-17626: Fixed a potential remote code execution because of the lack of input sanitization in toColor() (bsc#1154370).
- Record
SUSE-SU-2020:0255-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:0324-1 No score
Security update for python-reportlab
This update for python-reportlab fixes the following issues:
- CVE-2019-17626: Fixed a potential remote code execution because of the lack of input sanitization in toColor() (bsc#1154370).
- Record
SUSE-SU-2020:0324-1- Updated
- 2026-11-02
OSVUSN-4273-1 No score
python-reportlab vulnerability
It was discovered that ReportLab incorrectly handled certain XML documents. If a user or automated system were tricked into processing a specially crafted document, a remote attacker could possibly use this issue to execute arbitrary code.
- Record
USN-4273-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
reportlabPyPI |
before 3.5.28 | 3.5.28 |
python-reportlabDebian:12 |
before 3.5.34-1 | 3.5.34-1 |
python-reportlabDebian:13 |
before 3.5.34-1 | 3.5.34-1 |
python-reportlabDebian:14 |
before 3.5.34-1 | 3.5.34-1 |
python-reportlabDebian:8 |
before 3.1.8-3+deb8u2, plus listed versions 3.1.8-33.1.8-3+deb8u1 |
3.1.8-3+deb8u2 |
python-reportlabDebian:9 |
before 3.3.0-2+deb9u1, plus listed versions 3.3.0-2 |
3.3.0-2+deb9u1 |
python-reportlabDebian:10 |
before 3.5.13-1+deb10u1, plus listed versions 3.5.13-1 |
3.5.13-1+deb10u1 |
reportlabPyPI |
before 3.5.28, plus listed versions 2.02.32.42.52.6 Show 27 moreShow less2.73.03.1.443.1.83.2.03.3.03.4.03.5.03.5.13.5.103.5.113.5.123.5.133.5.163.5.173.5.183.5.193.5.23.5.203.5.213.5.233.5.263.5.43.5.53.5.63.5.83.5.9 |
3.5.28 |
python-reportlabMageia:7 |
before 3.5.34-1.mga7 | 3.5.34-1.mga7 |
python-reportlabopenEuler:20.03-LTS-SP1 |
before 3.4.0-13.oe1 | 3.4.0-13.oe1 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-reportlabopenEuler:20.03-LTS-SP2 |
before 3.4.0-13.oe1 | 3.4.0-13.oe1 |
reportlabPyPI |
before 3.5.28, plus listed versions 2.02.32.42.52.6 Show 27 moreShow less2.73.03.1.83.1.443.2.03.3.03.4.03.5.03.5.13.5.23.5.43.5.53.5.63.5.83.5.93.5.103.5.113.5.123.5.133.5.163.5.173.5.183.5.193.5.203.5.213.5.233.5.26 |
3.5.28 |
python-reportlabRed Hat:enterprise_linux:7::client |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlab-debuginfoRed Hat:enterprise_linux:7::client |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlab-docsRed Hat:enterprise_linux:7::client |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlabRed Hat:enterprise_linux:7::server |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlab-debuginfoRed Hat:enterprise_linux:7::server |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlab-docsRed Hat:enterprise_linux:7::server |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlabRed Hat:enterprise_linux:7::workstation |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlab-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlab-docsRed Hat:enterprise_linux:7::workstation |
before 0:2.5-9.el7_7.1 | 0:2.5-9.el7_7.1 |
python-reportlabRed Hat:enterprise_linux:6::client |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlab-debuginfoRed Hat:enterprise_linux:6::client |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlab-docsRed Hat:enterprise_linux:6::client |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlabRed Hat:enterprise_linux:6::server |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlab-debuginfoRed Hat:enterprise_linux:6::server |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlab-docsRed Hat:enterprise_linux:6::server |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlabRed Hat:enterprise_linux:6::workstation |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlab-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlab-docsRed Hat:enterprise_linux:6::workstation |
before 0:2.3-3.el6_10.1 | 0:2.3-3.el6_10.1 |
python-reportlabRed Hat:enterprise_linux:8::appstream |
before 0:3.4.0-6.el8_1.2 | 0:3.4.0-6.el8_1.2 |
python-reportlab-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:3.4.0-6.el8_1.2 | 0:3.4.0-6.el8_1.2 |
python3-reportlabRed Hat:enterprise_linux:8::appstream |
before 0:3.4.0-6.el8_1.2 | 0:3.4.0-6.el8_1.2 |
python3-reportlab-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:3.4.0-6.el8_1.2 | 0:3.4.0-6.el8_1.2 |
python-reportlabRed Hat:rhel_e4s:8.0::appstream |
before 0:3.4.0-6.el8_0.2 | 0:3.4.0-6.el8_0.2 |
python-reportlab-debugsourceRed Hat:rhel_e4s:8.0::appstream |
before 0:3.4.0-6.el8_0.2 | 0:3.4.0-6.el8_0.2 |
python3-reportlabRed Hat:rhel_e4s:8.0::appstream |
before 0:3.4.0-6.el8_0.2 | 0:3.4.0-6.el8_0.2 |
python3-reportlab-debuginfoRed Hat:rhel_e4s:8.0::appstream |
before 0:3.4.0-6.el8_0.2 | 0:3.4.0-6.el8_0.2 |
python-reportlabSUSE:Linux Enterprise Workstation Extension 12 SP4 |
before 2.7-3.3.1 | 2.7-3.3.1 |
python-reportlabSUSE:Linux Enterprise Workstation Extension 12 SP5 |
before 2.7-3.3.1 | 2.7-3.3.1 |
python-reportlabUbuntu:16.04:LTS |
before 3.3.0-1ubuntu0.1, plus listed versions 3.2.0-1build13.2.0-1build23.3.0-1 |
3.3.0-1ubuntu0.1 |
python-reportlabUbuntu:18.04:LTS |
before 3.4.0-3ubuntu0.1, plus listed versions 3.4.0-3build1 |
3.4.0-3ubuntu0.1 |
python-reportlabopenSUSE:Leap 15.1 |
before 3.4.0-lp151.3.3.1 | 3.4.0-lp151.3.3.1 |
python-reportlabopenSUSE:Tumbleweed |
before 4.0.7-1.3 | 4.0.7-1.3 |
python-reportlabopenSUSE:Tumbleweed |
before 4.5.1-1.2 | 4.5.1-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-17626 is a critical vulnerability (CVSS 9.8) in Reportlab, published October 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.53%, the 95th percentile. Fixed in reportlab 3.5.28.
References
bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
access.redhat.com/errata/RHSA-2020:0197
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZPHP2BJSTP4IYCSJRQINP763IHO6ASL
Show 36 moreShow less
lists.opensuse.org/opensuse-security-announce/2020-02/msg00002.html
usn.ubuntu.com/4273-1
lists.debian.org/debian-lts-announce/2020/02/msg00019.html
debian.org/security/2020/dsa-4663
security.gentoo.org/glsa/202007-35
security.netapp.com/advisory/ntap-20240719-0006
nvd.nist.gov/vuln/detail/CVE-2019-17626
hg.reportlab.com/hg-public/reportlab/rev/51a521ad7dd3
web.archive.org/web/20191016111823/https://bitbucket.org/rptlab/reportlab/issues/199/eval-in-colorspy-leads-to-remote-code
github.com/advisories/GHSA-qpg2-vx7j-3869
security-tracker.debian.org/tracker/CVE-2019-17626
advisories.mageia.org/MGASA-2020-0059.html
bugs.mageia.org/show_bug.cgi?id=26115
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1281
bugzilla.redhat.com/show_bug.cgi?id=1769661
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0195.json
cve.org/CVERecord?id=CVE-2019-17626
suse.com/support/update/announcement/2020/suse-su-20200255-1
bugzilla.suse.com/1154370
ubuntu.com/security/CVE-2019-17626