Xhtml2pdf vulnerabilities
We track 2 vulnerabilities in Xhtml2pdf products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
2vulnerabilities
0critical
2high
0exploited
7.7average CVSS score
Latest Xhtml2pdf vulnerabilities
- 7.8 High severity
xhtml2pdf: Improper Neutralization of Special Elements used in an OS Command
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer() that allows attackers to execute commands by interpolating unescaped file names into os.system. Attackers can supply an input file whose name contains a double quote a
- 7.5 High severity
xhtml2pdf: Inefficient Regular Expression Complexity
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.