Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.5

Pygments Font Manager Vulnerability Allows Remote Command Execution

CVE-2015-8557 · published 10 years ago
Summary

Pygments, a code formatting library, has a security issue that allows attackers to run arbitrary commands if they input special characters in a font name. This could let attackers take control of a system. Update to a fixed version of Pygments to protect against this vulnerability.

What to do
  • Update matthäus g. chajdas pygments to version 2.1.
Affected software
Ecosystem VendorProductAffected versions
pip matthäus g. chajdas pygments >= 1.2.2, < 2.1
Fix: upgrade to 2.1
– canonical ubuntu_linux 12.04
14.04
15.04
15.10
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
– pygments pygments 1.2.2
1.3
1.3.1
1.4
1.5
1.6
2.0
2.0.1
cpe:2.3:a:pygments:pygments:1.2.2:*:*:*:*:*:*:*
Original advisory text
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.5 Critical
Exploitation
7% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published8 Jan 2016
Updated22 Oct 2026
First seen6 Mar 2026
Sources
GHSA-fff8-4w9p-7v76 · GHSA
CVE-2015-8557 · NVD
Track software like this
Free during beta