CVE-2019-17626: Remote Code Execution in reportlab
Summary
CVE-2019-17626: ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '. Affects reportlab versions < 3.5.28. Fixed in 3.5.28. How to fix ↓
Also tracked for
- python-reportlab · Debian:11
The same CVE-2019-17626 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ReportLab is a Python library used for creating PDF documents. It provides a wide range of functionality for generating complex PDFs. However, versions up to 3.5.26 are vulnerable to remote code execution due to a flaw in the 'colors.py' module. This vulnerability can be exploited by crafting a malicious XML document that includes arbitrary Python code.
Vulnerability Detail
The vulnerability in ReportLab arises from the 'toColor(eval(arg))' function call in the 'colors.py' module. An attacker can inject arbitrary Python code by manipulating the XML document and using the '<span color="' tag. This code will be executed when the XML document is processed, leading to remote code execution. The impact of this vulnerability can be severe, as an attacker can execute arbitrary commands on the target system.
How To Fix
Latest published version: 5.1.0 as of 23 Oct 2026
pip install --upgrade "reportlab==5.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.28
This is the first release that contains the fix.
pip install --upgrade "reportlab==3.5.28"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of ReportLab as soon as possible.
Conclusion
The vulnerability in ReportLab allows remote code execution, which can have severe consequences. It is crucial to update to the fixed version of ReportLab (3.5.28 or later) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for reportlab →
FAQ
ReportLab is a Python library used for creating PDF documents. It provides various features for generating complex PDFs.
The vulnerability allows remote code execution, enabling an attacker to execute arbitrary commands on the target system.
To fix this vulnerability, update ReportLab to version 3.5.28 or later using the 'pip install --upgrade reportlab' command.
No, there is no known workaround. It is essential to update to the fixed version of ReportLab.
You can find more information about this vulnerability in the ReportLab advisory database: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for reportlab.
