CVE-2015-8557

Command Injection in Pygments

9.0 CriticalFix available

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.72%Up 4.7 points since Feb 4, 2022

What each source reports

NVD Score used 9.0

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: CVE-2015-8557
CVSS 3.0: 9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-78
Updated: 2026-11-02

CVE List No score

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: CVE-2015-8557
Updated: 2026-11-02

EUVDEUVD-2016-0026 No score

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: EUVD-2016-0026
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fff8-4w9p-7v76 9.5

Command Injection in Pygments

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: GHSA-fff8-4w9p-7v76
CVSS 4.0: 9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.0: 9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSV 9.0

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: CVE-2015-8557
CVSS 3.0: 9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2015-8557 9.0

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: DEBIAN-CVE-2015-8557
CVSS 3.0: 9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVGHSA-fff8-4w9p-7v76 9.5

Command Injection in Pygments

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: GHSA-fff8-4w9p-7v76
CVSS 4.0: 9.5 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS 3.0: 9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-8557 9.0

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: UBUNTU-CVE-2015-8557
CVSS 3.0: 9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2015-0478 No score

Updated python-pygments packages fix security vulnerability

An unsafe use of string concatenation in a shell string occurs in FontManager. If the developer allows the attacker to choose the font and outputs an image, the attacker can execute any shell command on the remote system. The name variable injected comes from the constructor of FontManager, which is invoked by ImageFormatter from options (CVE-2015-8557, rhbz#1276321).

Record: MGASA-2015-0478
Updated: 2026-11-02

OSVPYSEC-2016-32 No score

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Record: PYSEC-2016-32
Updated: 2026-11-02

OSVUSN-2862-1 No score

pygments vulnerability

It was discovered that Pygments incorrectly sanitized strings used to search system fonts. An attacker could possibly use this issue to execute arbitrary code.

Record: USN-2862-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`pygments` PyPI	1.2.2 up to 2.1	2.1
`pygments` Debian:12	before 2.0.1+dfsg-2	2.0.1+dfsg-2
`pygments` Debian:13	before 2.0.1+dfsg-2	2.0.1+dfsg-2
`pygments` Debian:14	before 2.0.1+dfsg-2	2.0.1+dfsg-2
`pygments` Debian:6.0	before 1.3.1+dfsg-1+deb6u11, plus listed versions 1.3.1+dfsg-1	1.3.1+dfsg-1+deb6u11
`pygments` Debian:7	before 1.5+dfsg-1+deb7u1, plus listed versions 1.5+dfsg-1	1.5+dfsg-1+deb7u1
`pygments` Debian:8	before 2.0.1+dfsg-1.1+deb8u1, plus listed versions 2.0.1+dfsg-1.1	2.0.1+dfsg-1.1+deb8u1
`pygments` PyPI	1.2.2 up to 2.1, plus listed versions 1.31.3.11.41.51.6 Show 5 moreShow less 1.6rc12.02.0.12.0.22.0rc1	2.1
`python-pygments` Mageia:5	before 1.6-9.1.mga5	1.6-9.1.mga5
`pygments` Ubuntu:14.04:LTS	before 1.6+dfsg-1ubuntu1.1, plus listed versions 1.6+dfsg-11.6+dfsg-1build11.6+dfsg-1ubuntu1	1.6+dfsg-1ubuntu1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-8557 is a critical vulnerability (CVSS 9.0) in Pygments, published December 15, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.72%, the 93rd percentile. Fixed in pygments 2.1.

References

Show 15 moreShow less