Dependencies Python 3.10+ is now needed, Python 3.9 is not supported anymore tinycss2 1.5.0+ is now needed fontTools 4.59.2+ is now needed Features #2560, #640, #844, #1091, #2517: Support CMYK ...

GitHub Gist: instantly share code, notes, and snippets.

VariaType hosts a pair of websites for a font foundry, a Flask-based font generator and a PHP validation portal. I’ll recover the portal’s source from an exposed Git repository to get credentials, and then abuse a single-pass filter bypass in its download feature to read files off the host. With the Flask application’s source in hand, I’ll exploit an arbitrary file write in fontTools’ variable font generation to drop a PHP webshell and get a foothold. A cron job validates uploaded fonts with an outdated FontForge build, which I’ll exploit through command injection in a malicious archive’s filenames to pivot to the next user. Finally, I’ll abuse a sudo-allowed plugin installer that downloads files with a vulnerable version of setuptools, using a path traversal in its PackageIndex to write an SSH key to root’s home directory.

Your web font utility belt. It can subset web fonts. It can find unicode-ranges for you automatically. It makes julienne fries. - zachleat/glyphhanger

An open-source, cross-platform GUI app to generate custom font design spaces from variable fonts - source-foundry/Slice