Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| fonttools | pip | >= 4.33.0, < 4.60.2 | 4.60.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the main function of the fontTools.varLib module, which is used by the fonttools varLib command-line tool. The analysis of the patch and the vulnerability description reveals two combined issues:
Path Traversal: The main function reads a .designspace file, which can specify output filenames for variable fonts. The function originally used the filename attribute directly to construct the output path. As shown in the patch, the vulnerable code filename = vf.filename was replaced with filename = os.path.basename(vf.filename). This change was necessary because a malicious .designspace file could specify a filename like ../../../../tmp/arbitrary.file, causing the program to write a file outside of the intended output directory.
XML Injection: The vulnerability description also points out an XML injection flaw where labelname elements in the .designspace file are not sanitized. This allows an attacker to inject arbitrary content, such as PHP code, into the generated font files.
The combination of these two flaws is critical. An attacker can use the path traversal to write a file with a chosen extension (e.g., .php) to a web-accessible directory, and use the XML injection to embed a webshell or other malicious code within that file. When the web server executes this file, it leads to Remote Code Execution (RCE).
The main function is the central point where the malicious .designspace file is processed and the unsafe file path is constructed, making it the primary vulnerable function that would appear in a runtime profile during exploitation.
