Skip to content

PatchFirst · Latest vulnerabilities

xhtml2pdf vulnerabilities

Vulnerabilities published for xhtml2pdf in the last 30 days: 1. Listed in the KEV catalogue: 0.

Vulnerabilities: 2

CVE-2026-110642
High · CVSS 8.5EPSS 1.15%No fix published
xhtml2pdf before 0.2.19 OS Command Injection via startViewer File Name
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.
xhtml2pdf Operating systems
Published October 14, 2026Updated October 14, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2024-25885
High · CVSS 7.5EPSS 0.64%Fix available
CVE-2024-25885
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
xhtml2pdf Operating systems
- Update to 0.2.16+dfsg-1
Published October 8, 2024Updated July 5, 2026
Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →