AIKIDO-2026-755272
fonttools is vulnerable to XML External Entity (XXE) Injection
59
Medium Risk
This Affects:
fonttoolsTL;DR
The fontTools.misc.etree wrapper parses XML through lxml without disabling external entity resolution on lxml versions older than 5.0. An untrusted XML document, such as a TTX, designspace, or plist file, can declare an external entity that pulls in local files when parsed. This exposes local file contents through XML external entity processing. The fix forces the lxml parser to not resolve external entities on affected lxml versions.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you parse untrusted XML (such as TTX, designspace, or plist files) with lxml older than 5.0 installed.
Background info
fonttools is vulnerable to XML External Entity (XXE) Injection in versions 3.31.0 - 4.63.0.
How to fix this
Upgrade the fonttools library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.