CVE-2024-25885: XHTML2PDF

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.

Affected products

• XHTML2PDF XHTML2PDF: version 0.2.13 only

Published 2024-10-08. Last modified 2026-07-05.