Vulnerability	Vulnerable Version
H Deserialization of Untrusted Data BabelDOC is a Yet Another Document Translator Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the `_load_data` process. An attacker can execute arbitrary code with the privileges of the affected process by crafting a PDF that injects an absolute path into the CMap name, causing the application to deserialize a malicious pickle file from an attacker-controlled location. This is only exploitable if the attacker can place a `.pickle.gz` file at a predictable path on the local filesystem accessible to the victim process. How to fix Deserialization of Untrusted Data? Upgrade `BabelDOC` to version 0.6.3 or higher.	[,0.6.3)

Deserialization of Untrusted Data

BabelDOC is a Yet Another Document Translator

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the _load_data process. An attacker can execute arbitrary code with the privileges of the affected process by crafting a PDF that injects an absolute path into the CMap name, causing the application to deserialize a malicious pickle file from an attacker-controlled location. This is only exploitable if the attacker can place a .pickle.gz file at a predictable path on the local filesystem accessible to the victim process.

How to fix Deserialization of Untrusted Data?

Upgrade BabelDOC to version 0.6.3 or higher.

[,0.6.3)

Go back to all versions of this package