fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.3 · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L

EPSS

• CVE-2025-66034: 0.59% estimated exploitation activity in the next 30 days; percentile 48.11 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary The fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malicious .designspace file is processed. The vulnerability affects the main() code path of fontTools.varLib, used by the fonttools varLib CLI and any code that invokes fontTools.varLib.main(). The vulnerability exists due to unsanitised filename handling combined with content injection. Attackers can write files to arbitrary filesystem locations via path traversal sequences, and inject malicious code (like PHP) into the output files through XML injection in labelname elements. When these files are placed in web-accessible locations and executed, this achieves remote code execution without requiring any elevated privileges. Once RCE is obtained, attackers can further escalate privileges to compromise system files (like overwriting /etc/passwd). Overall this allows attackers to: - Write font files to arbitrary locations on the…

Published by the source

1 Dec 2025, 19:07 UTC

Last modified by the source

10 Sep 2026, 03:50 UTC

Source last checked

26 Oct 2026, 13:35 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-768j-98cg-p3fv

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-768j-98cg-p3fv

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2025-66034

Advisory: fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib
IDs: CVE-2025-66034, GHSA-768j-98cg-p3fv
Record: https://patchnext.com/advisories/cve-2025-66034 (revision 2, source checked 26 Oct 2026, 13:35 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.3)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: fonttools 4.60.2. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI fonttools: affected >= 4.33.0, < 4.60.2; fixed in 4.60.2

## Suggested inspection (read-only)
- `python -m pip show fonttools`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on fonttools.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-768j-98cg-p3fv (OSV record GHSA-768j-98cg-p3fv lists affected ranges: PyPI fonttools >=4.33.0 <4.60.2 (fixed))
- Verified: https://github.com/advisories/GHSA-768j-98cg-p3fv (GitHub-reviewed advisory GHSA-768j-98cg-p3fv lists affected ranges: PyPI fonttools >=4.33.0 <4.60.2)

Commands are suggestions: review each one before running it.