{"action":"Upgrade reportlab to 3.5.31 or later.","affected":[{"fixed":"3.5.31","introduced":"0"}],"component":"reportlab","cve_ids":["CVE-2019-19450"],"ecosystem":"PyPI","epss":0.05978,"exploited":false,"fixed_versions":["3.5.31"],"ghsa_id":"GHSA-pj98-2xf6-cff5","id":"tcs_01M5KFT872QTFB0DFPCYTE0P0Y","modified_at":"2026-06-29T12:26:48.362635242Z","published_at":"2023-09-20T15:30:51Z","references":["https://osv.dev/vulnerability/GHSA-pj98-2xf6-cff5","https://nvd.nist.gov/vuln/detail/CVE-2019-19450","https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md","https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019","https://hg.reportlab.com/hg-public/reportlab","https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ","https://pastebin.com/5MicRrr4"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-pj98-2xf6-cff5","url":"https://osv.dev/vulnerability/GHSA-pj98-2xf6-cff5"}],"summary":"ReportLab vulnerable to remote code execution via paraparser"}