CVE-2023-33733: Reportlab Remote Code Execution Vulnerability
Summary
CVE-2023-33733: Reportlab vulnerable to remote code execution. Affects reportlab versions < 3.6.13. Fixed in 3.6.13. How to fix ↓
Also tracked for
- python-reportlab · Debian:11
The same CVE-2023-33733 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Reportlab is a widely used Python library for generating PDFs. It provides a robust set of features for creating complex documents programmatically. However, versions up to and including 3.6.12 are vulnerable to a serious security flaw that allows attackers to execute arbitrary code through specially crafted PDF files.
Vulnerability Detail
The vulnerability in Reportlab arises from improper handling of crafted PDF files, which can lead to remote code execution. Attackers can exploit this flaw by supplying a malicious PDF, potentially compromising the system running the Reportlab library. This vulnerability is particularly concerning as it can lead to unauthorized access and manipulation of sensitive data, making it critical for users to address it promptly.
How To Fix
Latest published version: 5.1.0 as of 23 Oct 2026
pip install --upgrade "reportlab==5.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.6.13
This is the first release that contains the fix.
pip install --upgrade "reportlab==3.6.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted PDF files with Reportlab until you can update to the patched version. Always validate and sanitize input files before processing them.
Conclusion
The vulnerability CVE-2023-33733 in Reportlab poses a significant risk due to its potential for remote code execution. Users are strongly advised to update to version 3.6.13 or later to mitigate this risk. Additionally, implementing workarounds can help protect systems until the update is applied.
See every vulnerability recorded for reportlab →
FAQ
CVE-2023-33733 is a vulnerability in Reportlab that allows remote code execution through crafted PDF files.
Reportlab versions up to and including 3.6.12 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 7.8, indicating a high level of severity.
If you cannot update immediately, avoid processing untrusted PDF files and validate all input files before processing.
Related vulnerabilities
Recent vulnerabilities recorded for reportlab.
