fontTools, a Python library for font manipulation, has an arbitrary file write vulnerability in its varLib module affecting versions from 4.33.0 up to but not including 4.63.0. This flaw allows remote code execution when processing a malicious .designspace file via the varLib CLI or any code invoking fontTools.varLib.main(). The vulnerability has been fixed in version 4.63.0.