CVE-2024-25885

HighCVSS 7.5

Published: 08/10/2024(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

46th percentile - higher than 46% of all known CVEs

Summary

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDoS) via supplying a crafted string.

Risk Assessment

The risk is that an attacker can perform a DoS attack on the server or application using xhtml2pdf, potentially causing service unavailability for users.

Recommendation

It is recommended to immediately update the xhtml2pdf library to the latest version that includes a fix for this vulnerability. If an update is not possible, restrict access to functions processing user input.

Other vulnerabilities in xhtml2pdf

CVE-2026-110642High
xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.startViewer(). Attackers can supply an input file whose name contains a double quote and shell metacharacters, which runs OS commands as the invoking user when the pisa tool is used with -s/--start-viewer.

Original NVD description (English source)

An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS