CVE-2015-8557

Name of the Vulnerable Software and Affected Versions Pygments versions 1.2.2 through 2.0.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a font name, specifically in the FontManager. get nix font path function in formatters/img.py.

Recommendations For Pygments versions 1.2.2 through 2.0.2, consider disabling the FontManager. get nix font path function until a patch is available to prevent the execution of arbitrary commands. Restrict access to the formatters/img.py module to minimize the risk of exploitation. Avoid using font names that contain shell metacharacters in the affected function until the issue is resolved.