{"id":"CVE-2023-33733","aliases":["GHSA-9q9m-c65c-37pq","PYSEC-2026-1871"],"title":"Reportlab vulnerable to remote code execution","summary":"Reportlab vulnerable to remote code execution","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"reportlab","product":"reportlab","ecosystem":"pip","affected":["reportlab < 3.6.13"],"patched":["reportlab 3.6.13"],"published":"2023-06-05","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-9q9m-c65c-37pq","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33733"},{"url":"https://github.com/c53elyas/CVE-2023-33733"},{"url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00008.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36WOY22ECJCPOXHVTNCHEWOQLL7JSWP4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ALE727IRACYBTTOFIFG57RS4OA2SHIJ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36WOY22ECJCPOXHVTNCHEWOQLL7JSWP4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ALE727IRACYBTTOFIFG57RS4OA2SHIJ"}],"tags":["osv","pip","exploit-available"],"epss":0.02123,"epssPercentile":0.80823,"ingestedAt":"2026-07-08T18:25:48.070Z","exploits":{"github":5,"githubRepos":["https://github.com/c53elyas/CVE-2023-33733","https://github.com/hoangbui24/CVE-2023-33733","https://github.com/onion2203/Lab_Reportlab"],"checkedAt":"2026-09-21T15:25:49.866Z"},"exploitAvailable":true,"slug":"CVE-2023-33733","body":"## Overview\n\nReportlab up to and including v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.\n\n## Affected packages\n\n- `reportlab < 3.6.13`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `reportlab 3.6.13`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":4647,"id":"CVE-2023-33733","ts":1788887197167,"field":"exploit_available","old":"false","new":"true"},{"seq":3530,"id":"CVE-2023-33733","ts":1788886313240,"field":"exploit_available","old":"true","new":"false"},{"seq":2384,"id":"CVE-2023-33733","ts":1788882982557,"field":"exploit_available","old":"false","new":"true"},{"seq":1413,"id":"CVE-2023-33733","ts":1788882395418,"field":"exploit_available","old":"true","new":"false"},{"seq":527,"id":"CVE-2023-33733","ts":1788881831568,"field":"exploit_available","old":"false","new":"true"}]}