CVE-2019-17626

Name of the Vulnerable Software and Affected Versions ReportLab versions prior to 3.5.27

Description The issue is related to the toColor(eval(arg)) function in the ReportLab library, which is connected to an error in processing XML documents. This can be exploited by a remote attacker to gain access to confidential data, compromise data integrity, and cause a denial of service. The exploitation can be achieved through a crafted XML document containing arbitrary Python code, for example, using the <span color=" endpoint followed by malicious code.

Recommendations For ReportLab versions prior to 3.5.27, update to version 3.5.27 or later to resolve the issue. As a temporary workaround, consider restricting the use of the toColor(eval(arg)) function in the colors.py module to minimize the risk of exploitation. Avoid using the eval(arg) parameter in the affected API endpoint until the issue is resolved.