Product
The xhtml2pdf library before version 0.2.19 contains an OS command injection vulnerability in the pisa.startViewer() function allowing arbitrary command execution via crafted filenames.