CVE-2026-110642

HighCVSS 7.8

Published: 14/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.15%

66th percentile - higher than 66% of all known CVEs

Summary

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer(). Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

Risk Assessment

An attacker can execute arbitrary OS commands with the privileges of the invoking user, potentially leading to unauthorized access or system modification.

Recommendation

Update xhtml2pdf to version 0.2.19 or later and avoid passing unescaped file names to os.system.

Other vulnerabilities in xhtml2pdf

CVE-2024-25885High
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string.

Original NVD description (English source)

xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS