CVE-2015-8557: Command Injection in Pygments
Summary
CVE-2015-8557: Command Injection in Pygments. Affects pygments versions >= 1.2.2, < 2.1. Fixed in 2.1. How to fix ↓
Also tracked for
- pygments · Debian:11
The same CVE-2015-8557 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pygments is a syntax highlighting package that supports over 500 programming languages. It is widely used in various applications and platforms to provide code highlighting and formatting capabilities. However, Pygments versions 1.2.2 through 2.0.2 are vulnerable to command injection attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2015-8557, originates from the FontManager._get_nix_font_path function in Pygments' img.py module. This function fails to properly sanitize user-supplied input, allowing remote attackers to execute arbitrary commands by exploiting shell metacharacters in a font name. An attacker can craft a malicious font name that includes shell commands, which are executed when the vulnerable code is triggered. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "pygments==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1
This is the first release that contains the fix.
pip install --upgrade "pygments==2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using user-supplied input as font names in Pygments. Instead, it is advisable to use predefined or trusted font names to eliminate the possibility of command injection. By carefully selecting the font names, the risk of exploitation can be minimized. Here is an example of how to use a predefined font name:
from pygments.formatters import HtmlFormatter
font_name = 'Arial'
formatter = HtmlFormatter(style='default', font_name=font_name)
Conclusion
In conclusion, Pygments versions 1.2.2 through 2.0.2 are vulnerable to command injection attacks due to improper input validation in the FontManager._get_nix_font_path function. Upgrading to Pygments 2.1 or later is recommended to address this vulnerability. By following the provided steps, users can protect their systems from potential exploitation and ensure the secure usage of Pygments in their applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pygments →
FAQ
Pygments is a syntax highlighting package used for code formatting and highlighting in various programming languages.
Pygments versions 1.2.2 through 2.0.2 are affected by this vulnerability.
An attacker can exploit this vulnerability by providing a specially crafted font name that includes shell commands. When the vulnerable code is triggered, these commands are executed, allowing the attacker to gain unauthorized access or perform malicious actions on the affected system.
The consequences of this vulnerability can range from unauthorized access to sensitive information leakage or even complete compromise of the affected system. Attackers can execute arbitrary commands with the privileges of the user running the Pygments code, potentially leading to further exploitation or control over the system.
To mitigate the risk, it is crucial to upgrade Pygments to version 2.1 or later. This will ensure that the vulnerable code is replaced with the patched version, which includes proper input validation and sanitization techniques. Additionally, avoiding the use of user-supplied input as font names can reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pygments.
