Xhtml2Pdf
Monthly
OS command injection in xhtml2pdf before 0.2.19 lets an attacker execute arbitrary OS commands as the invoking user when the pisa command-line tool is run with the -s/--start-viewer option against a file whose name contains a double quote plus shell metacharacters. The flaw lives in pisa.startViewer(), which interpolates an unescaped filename into os.system('open "%s"'); because the vulnerable path is only reached in viewer-launch mode, the default programmatic HTML-to-PDF conversion API is not affected. The vector is local and requires a user (or job) to actually launch the viewer, and no public exploit code has been identified at time of analysis - confirmed actively exploited status is not present in the available data.
OS command injection in xhtml2pdf before 0.2.19 lets an attacker execute arbitrary OS commands as the invoking user when the pisa command-line tool is run with the -s/--start-viewer option against a file whose name contains a double quote plus shell metacharacters. The flaw lives in pisa.startViewer(), which interpolates an unescaped filename into os.system('open "%s"'); because the vulnerable path is only reached in viewer-launch mode, the default programmatic HTML-to-PDF conversion API is not affected. The vector is local and requires a user (or job) to actually launch the viewer, and no public exploit code has been identified at time of analysis - confirmed actively exploited status is not present in the available data.