CVE-2015-8557: Canonical Ubuntu Linux

Critical severity, CVSS 9.0. EPSS: 6.7% chance of exploitation in the next 30 days.

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only; version 15.10 only
• Pygments Pygments: version 1.2.2 only; version 1.3 only; version 1.3.1 only; version 1.4 only; version 1.5 only; version 1.6 only; …

Published 2016-01-08. Last modified 2026-06-17.