CVE-2019-19450: ReportLab Remote Code Execution via paraparser
Summary
CVE-2019-19450: ReportLab vulnerable to remote code execution via paraparser. Affects reportlab versions < 3.5.31. Fixed in 3.5.31. How to fix ↓
Also tracked for
- python-reportlab · Debian:11
The same CVE-2019-19450 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ReportLab is a widely used library for generating PDFs and graphics in Python. It provides functionalities for creating complex documents programmatically. However, prior to version 3.5.31, ReportLab contained a vulnerability in its paraparser module that allowed for remote code execution, making it susceptible to attacks when processing untrusted XML documents.
Vulnerability Detail
The vulnerability in ReportLab arises from the paraparser module, specifically in the start_unichar function within paraparser.py. This function evaluates untrusted user input contained in a unichar element of a crafted XML document. An attacker can exploit this by injecting arbitrary Python code into the 'code' attribute of the unichar element, leading to remote code execution. This poses significant risks, as it allows attackers to execute malicious code on the server where the ReportLab library is used, potentially compromising the entire system.
How To Fix
Latest published version: 5.1.0 as of 23 Oct 2026
pip install --upgrade "reportlab==5.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.31
This is the first release that contains the fix.
pip install --upgrade "reportlab==3.5.31"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation to sanitize XML documents before processing them with ReportLab. This can help mitigate the risk of executing untrusted code.
Conclusion
CVE-2019-19450 represents a significant security risk for applications using the ReportLab library prior to version 3.5.31. It is crucial for developers to update to the patched version to prevent potential remote code execution attacks. Additionally, employing input validation can serve as a temporary measure to mitigate risks.
See every vulnerability recorded for reportlab →
FAQ
CVE-2019-19450 is a vulnerability in the ReportLab library that allows for remote code execution through the paraparser module.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring a signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to run arbitrary code on the server, which can compromise the system's security.
Yes, the vulnerability has been patched in ReportLab version 3.5.31 and later. It is recommended to upgrade to this version.
The CVSS score for CVE-2019-19450 is 9.8, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for reportlab.
