MEDIUM 5.3

PYSEC-2026-2056

xhtml2pdf Denial of Service via crafted string

Details

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / xhtml2pdf

Introduced in: 0

No fixed version published yet for xhtml2pdf (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-25885 [ADVISORY]
https://gist.github.com/salvatore-abello/c88dd0027496774023ef36c7b576d206 [WEB]
https://github.com/xhtml2pdf/xhtml2pdf [PACKAGE]
https://pypi.org/project/xhtml2pdf [PACKAGE]
https://github.com/advisories/GHSA-jj5c-hhrg-vv5h [ADVISORY]