CVE-2019-17626: Reportlab

Critical severity, CVSS 9.8. EPSS: 10.2% chance of exploitation in the next 30 days.

ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '<span color="' followed by arbitrary Python code.

Affected products

• Reportlab Reportlab: up to and including 3.5.26

Published 2019-10-16. Last modified 2026-06-17.