{"id":"CVE-2019-19450","aliases":["GHSA-pj98-2xf6-cff5","PYSEC-2026-522"],"url":"https://o3.security/vulnerability/CVE-2019-19450","summary":"ReportLab vulnerable to remote code execution via paraparser","details":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","published":"2023-09-20T14:15:12.310Z","modified":"2026-06-29T12:26:48.362635242Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"reportlab","fixedVersion":"3.5.31"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/"},{"type":"ADVISORY","url":"https://pastebin.com/5MicRrr4"},{"type":"ADVISORY","url":"https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19450"},{"type":"WEB","url":"https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019"},{"type":"PACKAGE","url":"https://hg.reportlab.com/hg-public/reportlab"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-29T12:26:48.362635242Z"}}