GHSA-77mv-mp2j-gxxh
pygmentize Remote Code Execution
8.1 HighFix available
GHSA-77mv-mp2j-gxxh is a high vulnerability (CVSS 8.1) in 3f/pygmentize, published May 15, 2024. No source lists public exploit code. Fixed in 3f/pygmentize 1.2.
- Severity
- 8.1 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.23f/pygmentize +1 more
Description
pygmentize is prone to remote code execution due to an unsafe sanitazation of user input when passed to the highlight function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
3f/pygmentizePackagist | before 1.2 | 1.2 |
3f/pygmentizePackagist | before 1.2, plus listed versions 1.01.1 | 1.2 |
What each source reports
GitHub Advisories Score used
pygmentize Remote Code Execution
pygmentize is prone to remote code execution due to an unsafe sanitazation of user input when passed to the highlight function.
- Record
GHSA-77mv-mp2j-gxxh- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
pygmentize Remote Code Execution
pygmentize is prone to remote code execution due to an unsafe sanitazation of user input when passed to the highlight function.
- Record
GHSA-77mv-mp2j-gxxh- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.