Skip to main content

XML Injection (aka Blind XPath Injection)

CVE-2025-66034

High
9.8/10

Summary

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 through 4.60.1, the fonttools varLib (or python3 -m fontTools.varLib) script has an Arbitrary File Write vulnerability that leads to Remote Code Execution when a malicious ".designspace" file is processed. The vulnerability affects the 'main()' code path of "fontTools.varLib", used by the fonttools varLib CLI and any code that invokes 'fontTools.varLib.main()'.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-91 - XML Injection (aka Blind XPath Injection)

The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References

Advisory Timeline

  • Published