Threats tagged 'brew-pdfly-cve-2025-66034'

The fontTools varLib component in the pdfly product is vulnerable to arbitrary file write and XML injection via malicious .designspace files. This vulnerability allows attackers to write files to arbitrary filesystem locations using path traversal and inject malicious content through XML labelname elements. Exploitation can lead to remote code execution without elevated privileges and potential system compromise. The issue affects versions >=0.4.0 and <0.5.1_3 and has been fixed in version 0.5.1_3.