debian/xhtml2pdf vulnerabilities

Latest debian/xhtml2pdf CVEs

Newest publication first

1. CVE-2026-110642 xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name

   Published 2026-10-14

   High·CVSS 8.5 EPSS 1.1%

   xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharact...

2. CVE-2024-25885 xhtml2pdf Denial of Service via crafted string

   Published 2024-10-08

   High·CVSS 7.5 EPSS 0.64%

   An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.