{"action":"Upgrade reportlab to 3.5.31 or later.","affected":[{"fixed":"3.5.31","introduced":"0"}],"component":"reportlab","cve_ids":["CVE-2019-19450"],"ecosystem":"PyPI","epss":0.05978,"exploited":false,"fixed_versions":["3.5.31"],"ghsa_id":"GHSA-pj98-2xf6-cff5","id":"tcs_01M5KHBX11BV34ET01CNR4E47S","modified_at":"2026-07-01T20:23:04.001605Z","published_at":"2026-06-29T11:50:43.995090Z","references":["https://osv.dev/vulnerability/PYSEC-2026-522","https://nvd.nist.gov/vuln/detail/CVE-2019-19450","https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md","https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019","https://hg.reportlab.com/hg-public/reportlab","https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHMCB2GJQKFMGVO5RWHN222NQL5XYPHZ","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HADPTB3SBU7IVRMDK7OL6WSQRU5AFWDZ","https://pastebin.com/5MicRrr4","https://pypi.org/project/reportlab","https://github.com/advisories/GHSA-pj98-2xf6-cff5"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-522","url":"https://osv.dev/vulnerability/PYSEC-2026-522"}],"summary":"ReportLab vulnerable to remote code execution via paraparser"}