BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Date Jul 10, 2026

Type Vendor advisory

Signal High-risk advisory

Vendor / Product PyPI · BabelDOC

CVE CVE-2026-54071

High-risk advisory CVE-2026-54071

Summary

BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py

Why it matters

GitHub has published a reviewed security advisory for BabelDOC. Prioritize it with other application dependency updates.

Operator check

Check whether BabelDOC is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available.

Sources

GitHub Advisory GHSA-m8gf-v64p-gfmg NVD — CVE-2026-54071 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed