CVE-2023-45139 HIGH

CVE-2023-45139: fonttools XML External Entity Injection (XXE) Vulnerability

Vendor Fonttools
Product fonttools
Weakness CWE-611 · XXE
Published January 10, 2024
Last update June 3, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

fontTools is a library for manipulating fonts, written in Python. The subsetting module has a XML External Entity Injection (XXE) vulnerability which allows an attacker to resolve arbitrary entities when a candidate font (OT-SVG fonts), which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the filesystem fontTools is running on or make web requests from the host system. This vulnerability has been patched in version 4.43.0.

Key dates

02Disclosure timeline

January 10, 2024 CVE published
June 3, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-22274 ZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability CVE-2021-43990 ICSA-22-109-03 FANUC ROBOGUIDE Simulation Platform CVE-2023-47160 IBM Cognos Controller XML external entity injection CVE-2025-3241 zhangyanbo2007 youkefu XML Document CallCenterRouterController.java xml external entity reference CVE-2026-40682 Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor