Lab_Reportlab

LAB Reportlab This lab was set up to test CVE-2023-33733. Setup and Run Setup pip3 install -r requirements.txt Run python3 app.py...

CVE-2023-33733

CODE INJECTION VULNERABILITY IN REPORTLAB PYTHON LIBRARY tl;dr This write-up details how an RCE in Reportlab - was found and exploited. Due to the prevalence of Reportlab in HTML to PDF processing, this vulnerability may be reachable in many applications that process PDF files, making this an...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup pip3 install -r requirements.txt Run python3 app.py Attacker Connect to server Connect to server ...

CVE-2023-33733

CVE-2023-33733 Reportlab Library - Remote Code Execution...

CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

EUVD-2026-97001

Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in reportcontent ...

CVE-2026-108850

The Company Research Agent software (versions through 2.2.0 ) is vulnerable to a server-side request forgery (SSRF) via the /generate-pdf endpoint. The root cause is the injection of unescaped ReportLab paragraph markup into the report_content parameter. Unauthenticated attackers can embed inline...

Astra Linux – Vulnerability in python-reportlab

All versions of the reportlab package are vulnerable to Server-side Request Forgery SSRF via img tags. To reduce this risk, use trustedSchemes and trustedHosts see Reportlab’s documentation. Steps to reproduce by Karan Bamal: 1. Download and install the latest version of the reportlab package. 2...

OPENSUSE-SU-2026:12037-1 python313-reportlab-4.5.1-1.2 on GA media

These are all security issues fixed in the python313-reportlab-4.5.1-1.2 package on the GA media of openSUSE Tumbleweed...

PT-2026-105746

These are all security issues fixed in the python313-reportlab-4.5.1-1.2 package on the GA media of openSUSE Tumbleweed...

Rocky Linux 8.8 [CIQ] Security Update: python3-reportlab / python3-reportlab-debuginfo (ciqsa-2026_0354)

The Rocky Linux 8.8 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260354 advisory. This advisory aggregates security fixes for the python-reportlab SRPM in CIQ LTS 8.8. It addresses 1 CVE: CVE-2019-19450. Tenable has extracted the preceding...

Rocky Linux 8.6 [CIQ] Security Update: python3-reportlab / python3-reportlab-debuginfo (ciqsa-2026_0247)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20260247 advisory. This advisory aggregates security fixes for the python-reportlab SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2019-19450. Tenable has extracted the preceding...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-reportlab (UTSA-2023-002178)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002178 advisory. Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. Tenable has extracted the preceding description block directly...

Astra Linux – Vulnerability in python-reportlab

The paraparser module in ReportLab before version 3.5.31 allows for remote code execution. This occurs because the startunichar function in paraparser.py evaluates untrusted user input as a Unicode character in a crafted XML document. The input includes the string “'code='” followed by arbitrary...

Reportlab vulnerable to remote code execution

Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file...

PYSEC-2026-1871 Reportlab vulnerable to remote code execution

Reportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file...

ReportLab vulnerable to remote code execution via paraparser

paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '...

PYSEC-2026-522 ReportLab vulnerable to remote code execution via paraparser

paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with 'unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626...

EUVD-2021-0223

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2019-19450

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - paraparser in ReportLab before 3.5.31 allows remote code execution because startunichar in paraparser.py evaluates untrusted user input in a unichar element in ...