CVE-2019-17626

What it actually does

Remote code execution via unsanitized eval() call inside toColor() when parsing user-supplied color strings from XML attributes.

Why it matters to the business

Servers that render untrusted XML or PDF documents can be fully compromised by attackers executing arbitrary Python code, potentially leading to data theft or service disruption.

How an attack unfolds

An attacker supplies a crafted XML document containing a <span color=" attribute whose value begins with a Python expression; the library passes the value directly to eval() inside colors.py, executing the attacker-controlled code with the privileges of the ReportLab process.

How to fix it

Upgrade ReportLab to a version newer than 3.5.26 that removes the eval() call; if an upgrade is not immediately possible, sanitize or reject all XML color attributes before they reach the library.

How to confirm the fix worked

Confirm the installed ReportLab version exceeds 3.5.26 and test that a sample payload containing a color attribute with Python syntax is rejected or safely handled without execution.

Typical attack path

1. Locate an application endpoint that accepts XML input processed by ReportLab
2. Craft an XML payload embedding arbitrary Python statements inside a color attribute value
3. Submit the payload to trigger toColor(eval(arg))
4. Achieve code execution and establish persistence or exfiltrate data

How to detect it

Search application and web-server logs for XML fragments containing color attributes that include parentheses, import statements, or other Python syntax; review any ReportLab error or debug logs that reference toColor or colors.py around the time of suspicious requests.

• <span color="
• toColor(eval(
• from colors import toColor

What your security team should do

• Immediately inventory all ReportLab deployments and block processing of untrusted XML until patched
• Apply the latest ReportLab release that eliminates the eval usage
• Add input validation rules to strip or reject color attributes containing parentheses or Python keywords
• Monitor for any exploitation attempts using the known XML pattern while patches are applied