CVE-2026-54071

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54071

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54071.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54071

Aliases

Published

2026-08-21T18:55:42.248Z

Modified

2026-08-23T03:53:39.169525507Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Details

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB.loaddata() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while normalizecmap_name() removes only a leading slash. Absolute paths or traversal sequences can escape the trusted CMap directories through os.path.join(), select an attacker-writable .pickle.gz file, and cause pickle.loads() to execute arbitrary Python code with the privileges of the BabelDOC process. This issue is fixed in version 0.6.3.

Database specific

{
    "cwe_ids": [
        "CWE-502"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54071.json"
}

References

Affected packages

Git / github.com/funstory-ai/babeldoc

Affected ranges

Type

GIT

Repo

https://github.com/funstory-ai/babeldoc

Events

Introduced

Fixed

28f784ca6b437dbba040bfd9c67110373cd0924b

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.3"
        }
    ]
}

Affected versions

0.*

0.0.1a5

v0.*

v0.0.1a1

v0.0.1a10

v0.0.1a11

v0.0.1a12

v0.0.1a13

v0.0.1a14

v0.0.1a15

v0.0.1a16

v0.0.1a17

v0.0.1a18

v0.0.1a19

v0.0.1a2

v0.0.1a20

v0.0.1a21

v0.0.1a22

v0.0.1a23

v0.0.1a24

v0.0.1a25

v0.0.1a26

v0.0.1a27

v0.0.1a28

v0.0.1a3

v0.0.1a4

v0.0.1a5

v0.0.1a6

v0.0.1a7

v0.0.1a8

v0.0.1a9

v0.0.2

v0.1.0

v0.1.0.rc1

v0.1.0.rc2

v0.1.1

v0.1.10

v0.1.11

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.2

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.25

v0.1.26

v0.1.27

v0.1.28

v0.1.29

v0.1.3

v0.1.30

v0.1.31

v0.1.32

v0.1.4

v0.1.5

v0.1.6

v0.1.6.rc0

v0.1.7

v0.1.8

v0.1.9

v0.2.0

v0.2.1

v0.2.10

v0.2.11

v0.2.12

v0.2.13

v0.2.14

v0.2.15

v0.2.16

v0.2.17

v0.2.18

v0.2.19

v0.2.2

v0.2.20

v0.2.21

v0.2.22

v0.2.23

v0.2.24

v0.2.25

v0.2.26

v0.2.27

v0.2.28

v0.2.29

v0.2.3

v0.2.30

v0.2.31

v0.2.32

v0.2.33

v0.2.4

v0.2.5

v0.2.6

v0.2.7

v0.2.8

v0.2.9

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.14

v0.3.15

v0.3.16

v0.3.17

v0.3.18

v0.3.19

v0.3.2

v0.3.20

v0.3.21

v0.3.22

v0.3.23

v0.3.24

v0.3.25

v0.3.26

v0.3.27

v0.3.28

v0.3.29

v0.3.3

v0.3.30

v0.3.31

v0.3.32

v0.3.33

v0.3.34

v0.3.35

v0.3.36

v0.3.37

v0.3.38

v0.3.39

v0.3.4

v0.3.40

v0.3.41

v0.3.42

v0.3.45

v0.3.47

v0.3.48

v0.3.49

v0.3.5

v0.3.50

v0.3.51

v0.3.52

v0.3.53

v0.3.54

v0.3.55

v0.3.56

v0.3.57

v0.3.58

v0.3.59

v0.3.6

v0.3.60

v0.3.61

v0.3.62

v0.3.63

v0.3.64

v0.3.65

v0.3.66

v0.3.67

v0.3.68

v0.3.69

v0.3.7

v0.3.70

v0.3.71

v0.3.72

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.4.10

v0.4.11

v0.4.12

v0.4.13

v0.4.14

v0.4.15

v0.4.16

v0.4.17

v0.4.18

v0.4.19

v0.4.2

v0.4.20

v0.4.21

v0.4.22

v0.4.3

v0.4.4

v0.4.5

v0.4.6

v0.4.7

v0.4.8

v0.4.9

v0.5.0

v0.5.1

v0.5.10

v0.5.11

v0.5.12

v0.5.13

v0.5.14

v0.5.15

v0.5.16

v0.5.17

v0.5.18

v0.5.19

v0.5.2

v0.5.20

v0.5.21

v0.5.22

v0.5.23

v0.5.24

v0.5.3

v0.5.4

v0.5.5

v0.5.6

v0.5.7

v0.5.8

v0.5.9

v0.6.0

v0.6.1

v0.6.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54071.json"