Exploit for XML Injection (aka Blind XPath Injection) in Fonttools

🗓️ 15 Mar 2026 14:16:58Reported by symphony2colourType

githubexploit🔗 github.com👁 844 Views

PoC exploit for CVE-2025-66034 in fontTools varLib enables arbitrary file write via designspace.

Reporter	Title	Published	Views	Family All 87
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	21 Mar 202616:36	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	16 Mar 202610:43	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	28 Mar 202608:04	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	17 Mar 202620:03	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	16 Mar 202622:57	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	15 Mar 202614:16	–	githubexploit
GithubExploit	Exploit for XML Injection (aka Blind XPath Injection) in Fonttools	7 Apr 202613:43	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection Component uses fontTools dependency which is vulnerable to CVE-2025-66034.	17 Mar 202611:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses werkzeug-3.1.3,fonttools-4.60.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl,lodash.clonedeep-4.5.0.tgz,js-yaml-4.1.0.tgz,mdast-util-towhich is vulnerable to multiple CVEs	30 Jan 202605:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an XML Injection in fonttools [CVE-2025-66034]	27 Feb 202615:45	–	ibm

15 Mar 2026 15:12Current

8High risk

Vulners AI Score8

CVSS 3.16.3 - 9.8

EPSS0.00587

SSVC

fontTools variable font designspace CVE-2025-66034 arbitrary file write proof of concept