CVE-2025-66034 is a medium severity (CVSS 6.3) arbitrary file write in the fontTools varLib command line script and in code that calls fontTools.varLib.main(). It affects fonttools from 4.33.0 up to before 4.60.2. Upgrade to 4.60.2 or later, and avoid building fonts from untrusted designspace files.
What's affected
- Package: fonttools on PyPI (the fontTools library for manipulating fonts, written in Python).
- Affected: versions from 4.33.0 to before 4.60.2.
- Fixed: 4.60.2. The GitHub advisory lists the patched range as 4.60.2 and later.
- Entry point: the main() code path of fontTools.varLib, which backs the varLib command line script and any code that calls fontTools.varLib.main().
The record scores this 6.3 (medium) with a local attack vector and user interaction required. The GitHub advisory labels it Moderate, so the two sources agree on severity.
How to check if you're exposed
Find out whether fonttools is installed and which version.
pip show fonttools
pip list 2>/dev/null | grep -i fonttools
If the version is between 4.33.0 and 4.60.1, you are in the affected range. Also search your repositories and lock files for the package, since fonttools is often a transitive dependency of tools that build or subset fonts.
grep -ri "fonttools" requirements*.txt poetry.lock Pipfile.lock pyproject.toml 2>/dev/null
Then ask the practical question: does anything in your build or CI run varLib on designspace files that someone outside your team can supply? If not, exposure is low even on an old version.
What to do now
- Upgrade fonttools to 4.60.2 or later, for example with
pip install --upgrade "fonttools>=4.60.2", and update your lock files. - Rebuild any container images or CI caches that pin an older fonttools.
- Until you have upgraded, do not run varLib on .designspace files from outside sources, and do not run it as a privileged user.
- Run font builds in a throwaway directory or container so a stray write cannot reach application files or web roots.
- Scan your repositories for other copies of the package, including vendored and transitive ones. Paste your manifests into the free in-browser scan at gold.safeguard.sh/scan to see which of your dependencies carry this CVE, and use reachability analysis to separate the services that actually call the affected code from the ones that only list the package.
Why it matters
The advisory describes unsanitised filename handling. The output path is built by joining an output directory with a filename taken from the designspace, so path traversal sequences can steer where a file lands. The advisory also describes content injection through XML elements, which means an attacker influences what is written as well as where. Together that is how a file write turns into code execution when the written file ends up somewhere a server will run it.
The class here is CWE-91, improper neutralization of special elements in data query logic, which is how the record tags it. The practical lesson is that build tooling is part of your attack surface. A designspace file looks like data, but a tool that trusts its paths and labels will act on it. The record does not mark this as exploited in the wild, and it is not on the CISA KEV list.
Quick check
Is my web application affected if it never runs varLib?
Probably not directly. The flaw sits in the varLib main() path. Check that nothing in your pipeline calls it on files you do not control.
Which version fixes CVE-2025-66034?
fonttools 4.60.2. Versions from 4.33.0 up to before that are affected.
Sources
Last reviewed: 18 October 2026.
