CVE-2020-10571: psd-tools RLE Decoding Vulnerability
Summary
CVE-2020-10571: An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data. Affects psd-tools versions < 1.9.4. Fixed in 1.9.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
psd-tools is a Python package available on PyPI that provides tools for working with Adobe Photoshop PSD files. It allows users to read, write, and manipulate PSD files programmatically. The package is widely used in various applications and projects that involve working with PSD files. However, a vulnerability has been discovered in versions prior to 1.9.4 that affects the Cython implementation of RLE decoding in psd-tools.
Vulnerability Detail
The vulnerability in psd-tools arises from the lack of proper validation in the Cython implementation of RLE decoding. This oversight allows for the possibility of malicious data being processed, potentially leading to various security issues. Attackers could exploit this vulnerability to execute arbitrary code, cause denial of service, or disclose sensitive information. The impact of this vulnerability depends on how the affected package is used within different applications.
How To Fix
Latest published version: 1.26.0 as of 23 Oct 2026
pip install --upgrade "psd-tools==1.26.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.4
This is the first release that contains the fix.
pip install --upgrade "psd-tools==1.9.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of psd-tools to ensure the security of applications that rely on this package.
Conclusion
The vulnerability in psd-tools prior to version 1.9.4 exposes applications to potential security risks due to the lack of proper validation in the Cython implementation of RLE decoding. It is crucial for users of psd-tools to update to the fixed version to ensure the security of their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for psd-tools →
FAQ
psd-tools is a Python package that provides tools for working with Adobe Photoshop PSD files. It allows users to read, write, and manipulate PSD files programmatically.
The vulnerability in psd-tools could potentially allow attackers to execute arbitrary code, cause denial of service, or disclose sensitive information.
To fix this vulnerability, it is recommended to upgrade to psd-tools version 1.9.4 or later by running the command 'pip install --upgrade psd-tools'.
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of psd-tools.
For more information about this vulnerability, you can refer to the official advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/psd-tools/PYSEC-2020-91.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for psd-tools.
