Arbitrary Command Execution Vulnerability in Pygments Package
Summary
CVE-2015-8557: The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name. Affects pygments versions < 2.0.1+dfsg-2. Fixed in 2.0.1+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pygments is a popular syntax highlighting library written in Python, widely used for formatting code snippets in various applications. It supports numerous programming languages and is often integrated into documentation generators and web applications. The vulnerability in question affects versions 1.2.2 through 2.0.2, where improper handling of font names can lead to severe security risks.
Vulnerability Detail
The vulnerability arises from the FontManager._get_nix_font_path function in Pygments, which allows remote attackers to execute arbitrary commands by injecting shell metacharacters into font names. This flaw can be exploited to gain unauthorized access to the system, potentially leading to data breaches or system compromise. The vulnerability is particularly critical due to its ease of exploitation and the high impact it can have on affected systems.
How To Fix
Minimum fixed version
2.0.1+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pygmentsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using font names that contain shell metacharacters until the package is updated. Additionally, restricting access to the application that utilizes Pygments can help mitigate potential exploitation.
Conclusion
The CVE-2015-8557 vulnerability in Pygments poses a significant risk due to its potential for arbitrary command execution. Users are strongly advised to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for pygments →
FAQ
Versions 1.2.2 through 2.0.2 of Pygments are affected by this vulnerability.
The CVSS score of this vulnerability is 9.0, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to arbitrary command execution, allowing attackers to gain unauthorized access to the system and potentially compromise sensitive data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for pygments.
