https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:57:00.761031+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2019-17626 CVE-2019-17626 2026-10-02T22:57:00.778875+00:00

Affected: reportlab

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

 https://cve.radiocsirt.org/vuln/ghsa-qpg2-vx7j-3869 GHSA-qpg2-vx7j-3869 — XML Injection in ReportLab 2026-10-02T22:57:00.778936+00:00

Affected: PyPI: reportlab

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.