CVE-2019-19450: Debian Linux

Critical severity, CVSS 9.8. EPSS: 6% chance of exploitation in the next 30 days.

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.

Affected products

• Debian Debian Linux: version 10.0 only
• Reportlab Reportlab: before 3.5.31 (fixed in 3.5.31)

Published 2023-09-20. Last modified 2026-06-17.