Approved changes feed: RSS · Atom
cpe:2.3:a:xhtml2pdf:xhtml2pdf:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Xhtml2Pdf (6a4ec2d0-637f-5f0b-9fa8-d8dc76893852) |
|---|---|
| Product | Xhtml2Pdf (75d95b18-34a7-5451-bf7a-e379f84da3e5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-110642 |
vulnerable | 2026-11-03 10:16:01.511820 |
xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
HIGH (7.8)
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
Published: 2026-10-14T14:17:12.576Z
Updated: 2026-10-14T18:18:52.884Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25885 |
vulnerable | 2026-06-08 06:31:23.952996 |
Details available
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
Published: 2024-10-08T00:00:00.000Z
Updated: 2026-07-05T16:04:09.105Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.