VULNERABILITY INTELLIGENCE
CVE-2015-8557
CVSS score9 CRITICAL
EPSS probability6.72%
CISA KEVNot currently listed
Published2016-01-08
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Weakness classification
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')