CVE-2019-17626: XML Injection in ReportLab
Summary
CVE-2019-17626: XML Injection in ReportLab. Affects reportlab versions < 3.5.28. Fixed in 3.5.28. How to fix ↓
Also tracked for
- python-reportlab · Debian:11
The same CVE-2019-17626 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ReportLab is a Python library used for generating PDF documents. It provides various functionalities for creating and manipulating PDF files. However, versions up to 3.5.26 of ReportLab are vulnerable to XML injection, which can lead to remote code execution. This vulnerability exists in the 'toColor' function in the 'colors.py' module, specifically in the 'toColor.call' method. An attacker can exploit this vulnerability by crafting a malicious XML document containing Python code within a '<span color="' tag. When this document is processed by ReportLab, the Python code will be executed, allowing the attacker to execute arbitrary commands on the system.
Vulnerability Detail
The XML injection vulnerability in ReportLab allows an attacker to execute arbitrary Python code remotely. By injecting malicious XML code containing Python commands, an attacker can bypass input validation and execute arbitrary code within the context of the application. This can lead to various consequences, including unauthorized access, data theft, or even complete compromise of the affected system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 5.1.0 as of 23 Oct 2026
pip install --upgrade "reportlab==5.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.28
This is the first release that contains the fix.
pip install --upgrade "reportlab==3.5.28"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement input validation and sanitization to prevent the injection of malicious XML code. It is crucial to carefully validate and sanitize any user-supplied input that is used in XML processing within the application. By ensuring that only safe and expected values are accepted, the risk of XML injection can be mitigated.
Conclusion
The XML injection vulnerability in ReportLab can have severe consequences, including remote code execution. It is crucial to upgrade to the latest version of ReportLab (3.5.28 or later) to fix this vulnerability. Additionally, implementing input validation and sanitization can provide an extra layer of protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for reportlab →
FAQ
XML injection is a type of vulnerability where an attacker can insert malicious XML code into an application's input, leading to various security risks such as remote code execution, data manipulation, or unauthorized access.
The vulnerability in ReportLab allows an attacker to inject arbitrary Python code into an XML document. When this document is processed by ReportLab, the injected code is executed, leading to remote code execution.
The XML injection vulnerability in ReportLab can allow an attacker to execute arbitrary Python code remotely. This can lead to unauthorized access, data theft, or complete compromise of the affected system.
Yes, the vulnerability can be fixed by upgrading ReportLab to version 3.5.28 or later. It is recommended to update the package as soon as possible to mitigate the risk of exploitation.
Implementing input validation and sanitization can help mitigate the risk of XML injection. By carefully validating and sanitizing user-supplied input used in XML processing, the chances of successful exploitation can be reduced.
Related vulnerabilities
Recent vulnerabilities recorded for reportlab.
