AIKIDO-2026-10536

TL;DR

The axes.prop_cycle rcParam string is parsed in validate_cycler() in lib/matplotlib/rcsetup.py using eval() on a restricted but attacker-influenced string (for example through a matplotlibrc or style), which can allow arbitrary code execution. When using the PGF, LaTeX, and PostScript pipeline, texmanager, backend_pgf, and backend_ps invoke external latex, dvips, and Ghostscript; prior behavior allowed TeX shell escapes and weaker dvips / Ghostscript hardening. The release replaces the cycler eval() with a safe AST-based parser, passes -no-shell-escape to TeX, uses dvips with -R1, and adds -dSAFER to Ghostscript to remove those execution paths.