high7.5
CVE-2024-25885
xhtml2pdf Denial of Service via crafted string
Impact
An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | xhtml2pdf | <= 0.2.16 | none recorded |