CVE-2026-54071

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

babeldoc-jobpack (0.1.0), doclens (>=1.2.48, <=1.2.71) +6 more potentially affected by CVE-2026-54071 via babeldoc (>=0.1.32, <=0.6.2)

babeldoc PYPI version =0.1.32, =1.2.48, =1.9.1rc1, =2.0.0rc1, =5.2.3, =5.2.9 Source cves: CVE-2026-54071 Source advisory: MEND:CVE-2026-54071...

CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

EUVD-2026-64058

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

CVE-2026-54071

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

CVE-2026-54071 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

CVE-2026-54071

BabelDOC (a document translation tool) prior to 0.6.3 is vulnerable to arbitrary code execution via untrusted pickle deserialization in CMapDB._load_data() (babeldoc/pdfminer/cmapdb.py). A crafted PDF can embed a hex-encoded absolute path in its /Encoding or CMapName field (e.g., /#2Ftmp#2Fevil),...

CVE-2026-54071: Deserialization of Untrusted Data

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink...

PYSEC-2026-2389 BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...

babeldoc-jobpack (0.1.0), doclens (>=1.2.48, <=1.2.71) +6 more potentially affected by CVE-2026-54071 via babeldoc (>=0.1.32, <=0.6.2)

babeldoc PYPI version =0.1.32, =1.2.48, =1.9.1rc1, =2.0.0rc1, =5.2.3, =5.2.9 Source cves: CVE-2026-54071 Source advisory: OSV:PYSEC-2026-2389...

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py SummaryBabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...

babeldoc-jobpack (0.1.0), doclens (>=1.2.48, <=1.2.71) +6 more potentially affected by CVE-2026-54071 via babeldoc (>=0.1.32, <=0.6.2)

babeldoc PYPI version =0.1.32, =1.2.48, =1.9.1rc1, =2.0.0rc1, =5.2.3, =5.2.9 Source cves: CVE-2026-54071 Source advisory: OSV:GHSA-M8GF-V64P-GFMG...

GHSA-M8GF-V64P-GFMG BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...

babeldoc-jobpack (0.1.0), doclens (>=1.2.48, <=1.2.71) +6 more potentially affected by CVE-2026-54071 via babeldoc (>=0.1.32, <=0.6.2)

babeldoc PYPI version =0.1.32, =1.2.48, =1.9.1rc1, =2.0.0rc1, =5.2.3, =5.2.9 Source cves: CVE-2026-54071 Source advisory: SNYK:PYTHON-BABELDOC-17950947...

babeldoc-jobpack (0.1.0), doclens (>=1.2.48, <=1.2.71) +6 more potentially affected by CVE-2026-54071 via babeldoc (>=0.1.32, <=0.6.2)

babeldoc PYPI version =0.1.32, =1.2.48, =1.9.1rc1, =2.0.0rc1, =5.2.3, =5.2.9 Source cves: CVE-2026-54071 Source advisory: GHSA-M8GF-V64P-GFMG...

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then...

Deserialization of Untrusted Data

Overview BabelDOC is a Yet Another Document Translator Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the loaddata process. An attacker can execute arbitrary code with the privileges of the affected process by crafting a PDF that injects an absolute path...

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The loaddata method strips only NUL bytes from a PDF-controlled CMap name, then passes it directly to os.path.join and pickle.loads. Because Python's os.path.join discards all...

PT-2026-57365

Name of the Vulnerable Software and Affected Versions BabelDOC versions prior to 0.6.3 Description BabelDOC contains a flaw in its vendored PDF parser where the CMapDB. load data function deserializes untrusted pickle data when loading CMap files. An attacker can use hex-encoded absolute paths or...