{"id":"CVE-2019-19450","details":"paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '\u003cunichar code=\"' followed by arbitrary Python code, a similar issue to CVE-2019-17626.","aliases":["GHSA-pj98-2xf6-cff5","PYSEC-2026-522"],"modified":"2026-06-29T12:26:48.362635242Z","published":"2023-09-20T14:15:12.310Z","related":["ALSA-2023:5790","SUSE-SU-2023:3972-1","SUSE-SU-2023:4048-1"],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ/"},{"type":"ADVISORY","url":"https://pastebin.com/5MicRrr4"},{"type":"ADVISORY","url":"https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html"}],"affected":[{"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"fixed":"3.5.31"}]},{"events":[{"introduced":"0"},{"last_affected":"10.0"}]},{"events":[{"introduced":"0"},{"fixed":"3.5.31"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-19450.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}