CVE-2023-45139

A flaw was found in the subsetting module of FontTools, which contains an XML External Entity Injection (XXE) vulnerability. This flaw allows malicious actors to exploit the parsing of candidate fonts, particularly those with an OT-SVG format that includes an SVG table. Through this vulnerability, attackers can manipulate the system to resolve arbitrary entities, potentially allowing them to include files from the filesystem where FontTools is operating or even initiate web requests from the host system.

Mitigation

There may be other ways to mitigate the issue. Here are some suggestions:

Set the resolve_entities=False flag on parsing methods.
Consider further methods of disallowing doctype declarations.
Consider recursive regex matching.