{"id":"CVE-2015-8557","aliases":["DEBIAN-CVE-2015-8557","DLA-369-1","DSA-3445-1","EUVD-2016-0026","GHSA-fff8-4w9p-7v76","MGASA-2015-0478","PYSEC-2016-32","UBUNTU-CVE-2015-8557","USN-2862-1"],"status":"published","title":"Command Injection in Pygments","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","severity":{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06718,"percentile":0.93969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2015-12-15T00:00:00Z","modified":"2026-09-09T07:01:55Z","fixes":[{"ecosystem":"PyPI","package":"pygments","fixed_in":["2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pygments","fixed_in":["2.0.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pygments","fixed_in":["2.0.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pygments","fixed_in":["2.0.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"pygments","fixed_in":["1.3.1+dfsg-1+deb6u11"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"pygments","fixed_in":["1.5+dfsg-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"pygments","fixed_in":["2.0.1+dfsg-1.1+deb8u1"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"python-pygments","fixed_in":["1.6-9.1.mga5"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"pygments","fixed_in":["1.6+dfsg-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1+dfsg-1+deb6u11"}]}],"versions":["1.3.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:7","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5+dfsg-1+deb7u1"}]}],"versions":["1.5+dfsg-1"]},{"source":"osv","ecosystem":"Debian:8","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1+dfsg-1.1+deb8u1"}]}],"versions":["2.0.1+dfsg-1.1"]},{"source":"osv","ecosystem":"PyPI","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"2.1"}]}],"versions":["1.2.2","1.3","1.3.1","1.4","1.5","1.6","1.6rc1","2.0","2.0.1","2.0.2","2.0rc1"]},{"source":"osv","ecosystem":"Mageia:5","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6-9.1.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.2"},{"fixed":"2.1"}]}],"versions":["1.2.2","1.3","1.3.1","1.4","1.5","1.6","1.6rc1","2.0","2.0.1","2.0.2","2.0rc1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6+dfsg-1ubuntu1.1"}]}],"versions":["1.6+dfsg-1","1.6+dfsg-1build1","1.6+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6+dfsg-1ubuntu1.1"}]}],"versions":["1.6+dfsg-1","1.6+dfsg-1build1","1.6+dfsg-1ubuntu1"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"pygments","product":"pygments"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2862-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://packetstormsecurity.com/files/133823/Pygments-FontManager._get_nix_font_path-Shell-Injection.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/14/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/12/14/17","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://seclists.org/fulldisclosure/2015/Oct/4","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3445","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201612-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://bitbucket.org/birkenfeld/pygments-main/pull-requests/501/fix-shell-injection-in/diff","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8557","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fff8-4w9p-7v76","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pygments/PYSEC-2016-32.yaml","tags":["web"]},{"url":"https://github.com/pygments/pygments/commit/db6dd826f8624179e563aaded391efe824462f51","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8557","tags":["advisory"]},{"url":"https://github.com/pygments/pygments","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0478.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17331","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/12/14/6","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1276321","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8557","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2862-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8557","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8557","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2016-01-08T20:00:00Z","modified":"2024-08-06T08:20:43.361Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2016-0026","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2016-01-08T20:00:00Z","modified":"2024-08-06T08:20:43Z","updated_at":"2026-11-03T01:57:26.384611Z"}],"ghsa":[{"id":"GHSA-fff8-4w9p-7v76","title":"Command Injection in Pygments","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2022-05-17T02:37:56Z","modified":"2024-10-24T21:50:37Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:38:13.09489Z"}],"nvd":[{"id":"CVE-2015-8557","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2016-01-08T20:59:02.233Z","modified":"2026-06-17T00:34:46.24Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"CVE-2015-8557","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2016-01-08T20:59:02Z","modified":"2026-04-16T06:25:53.480704775Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8557","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2016-01-08T20:59:02.233Z","modified":"2026-09-09T07:01:55.212855738Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-fff8-4w9p-7v76","title":"Command Injection in Pygments","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2022-05-17T02:37:56Z","modified":"2024-10-24T22:26:14.588075Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"UBUNTU-CVE-2015-8557","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2015-12-16T00:00:00Z","modified":"2026-02-04T04:36:49.574457Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"DLA-369-1","title":"pygments - security update","status":"published","published":"2015-12-15T00:00:00Z","modified":"2026-03-09T02:09:58.36324Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-3445-1","title":"pygments - security update","status":"published","published":"2016-01-13T00:00:00Z","modified":"2026-03-09T01:22:29.388546Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0478","title":"Updated python-pygments packages fix security vulnerability","description":"An unsafe use of string concatenation in a shell string occurs in FontManager.\nIf the developer allows the attacker to choose the font and outputs an image,\nthe attacker can execute any shell command on the remote system. The name\nvariable injected comes from the constructor of FontManager, which is invoked\nby ImageFormatter from options (CVE-2015-8557, rhbz#1276321).\n","status":"published","published":"2015-12-17T20:19:23Z","modified":"2026-04-16T06:23:46.507185139Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"PYSEC-2016-32","description":"The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.","status":"published","published":"2016-01-08T20:59:00Z","modified":"2023-11-08T03:58:02.518743Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"USN-2862-1","title":"pygments vulnerability","description":"It was discovered that Pygments incorrectly sanitized strings used to\nsearch system fonts. An attacker could possibly use this issue to execute\narbitrary code.\n","status":"published","published":"2016-01-07T13:41:49Z","modified":"2026-02-10T04:40:56Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}