{"cve":"CVE-2023-45139","nvd":{"published":"2024-01-10T16:15:46.767","modified":"2026-06-17T06:28:17.890","status":"Modified","description":"fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-611"],"references":["http://www.openwall.com/lists/oss-security/2024/03/08/2","http://www.openwall.com/lists/oss-security/2024/03/09/1","https://github.com/fonttools/fonttools/commit/9f61271dc1ca82ed91f529b130fe5dc5c9bf1f4c","https://github.com/fonttools/fonttools/releases/tag/4.43.0","https://github.com/fonttools/fonttools/security/advisories/GHSA-6673-4983-2vx5"],"products":["fonttools:fonttools"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2023-45139","score":0.01228,"percentile":0.68891,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6673-4983-2vx5","url":"https://osv.dev/vulnerability/GHSA-6673-4983-2vx5","summary":"fonttools XML External Entity Injection (XXE) Vulnerability","modified":"2026-09-10T03:50:04.834179707Z","packages":[{"ecosystem":"PyPI","name":"fonttools","purl":"pkg:pypi/fonttools","ranges":[">=4.28.2 <4.43.0"],"fixed":["4.43.0"]}]},{"id":"PYSEC-2026-1388","url":"https://osv.dev/vulnerability/PYSEC-2026-1388","summary":"fonttools XML External Entity Injection (XXE) Vulnerability","modified":"2026-07-07T17:47:21.814862636Z","packages":[{"ecosystem":"PyPI","name":"fonttools","purl":"pkg:pypi/fonttools","ranges":[">=4.28.2 <4.43.0"],"fixed":["4.43.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}