Fonttools
Monthly
Arbitrary file write leading to remote code execution in the fontTools Python library (versions 4.33.0 through 4.60.1) is reachable through the `fonttools varLib` CLI, `python3 -m fontTools.varLib`, or any code that calls `fontTools.varLib.main()` on an attacker-supplied `.designspace` file. The `<variable-font>` `filename` attribute is passed unsanitized into the output path calculation, letting path-traversal sequences escape the intended output directory, while labelname XML injection lets the attacker control the content that is written; landing that file in a web-accessible or executable location turns the write into code execution, and overwriting files such as `/etc/passwd` produces denial of service. Publicly available exploit code exists (a full proof-of-concept ships with the GitHub advisory), but there is no CISA KEV confirmation of active exploitation, EPSS is low at roughly 0.10% (27th percentile), and the assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), because the victim or an automated build pipeline must actually run varLib against the malicious design file.
fontTools is a library for manipulating fonts, written in Python. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Arbitrary file write leading to remote code execution in the fontTools Python library (versions 4.33.0 through 4.60.1) is reachable through the `fonttools varLib` CLI, `python3 -m fontTools.varLib`, or any code that calls `fontTools.varLib.main()` on an attacker-supplied `.designspace` file. The `<variable-font>` `filename` attribute is passed unsanitized into the output path calculation, letting path-traversal sequences escape the intended output directory, while labelname XML injection lets the attacker control the content that is written; landing that file in a web-accessible or executable location turns the write into code execution, and overwriting files such as `/etc/passwd` produces denial of service. Publicly available exploit code exists (a full proof-of-concept ships with the GitHub advisory), but there is no CISA KEV confirmation of active exploitation, EPSS is low at roughly 0.10% (27th percentile), and the assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), because the victim or an automated build pipeline must actually run varLib against the malicious design file.
fontTools is a library for manipulating fonts, written in Python. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.