GitHub Advisoryadvisory · Packagist

GHSA-77mv-mp2j-gxxh pygmentize Remote Code Execution

HIGH Published 2024-05-15 Modified 2024-05-15 Official page ↗

Ecosystem: Packagist
Packages: 3f/pygmentize
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Reviewed: 2024-05-15

Affected packages

• Packagist 3f/pygmentize: < 1.2 → fixed in 1.2

Description

pygmentize is prone to remote code execution due to an unsafe sanitazation of user input when passed to the `highlight` function.

References