xhtml2pdf vulnerabilities
CVEs whose affected-version data names the xhtml2pdf package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-110642High· 7.8xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name co…
▾ Twilightxhtml2pdf · xhtml2pdfEPSS 1.1%via NVD
CVE-2024-25885Medium· 5.3xhtml2pdf Denial of Service via crafted string
xhtml2pdf Denial of Service via crafted string
▾ Sunlitxhtml2pdf · xhtml2pdfEPSS 0.64%via OSV