Hi,

The following vulnerability was published for xhtml2pdf.

CVE-2026-110642[0]:
| xhtml2pdf before 0.2.19 contains an OS command injection
| vulnerability in pisa.startViewer() that allows attackers to execute
| commands by interpolating unescaped file names into os.system.
| Attackers can supply an input file whose name contains a double
| quote and shell metacharacters, which runs OS commands as the
| invoking user when the pisa tool is used with -s/--start-viewer.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-110642
https://www.cve.org/CVERecord?id=CVE-2026-110642
[1] https://github.com/xhtml2pdf/xhtml2pdf/pull/835
[2] https://github.com/xhtml2pdf/xhtml2pdf/commit/654f0de6ff4995eb058bfdf55dfa8ae4e4e3f154

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore