All versions of package reportlab at time of writing are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation)
Steps to reproduce by Karan Bamal:
Download and install the latest package of reportlab
Go to demos -> odyssey -> dodyssey
In the text file odyssey.txt that needs to be converted to pdf inject <img src="http://127.0.0.1:5000" valign="top"/>
Create a nc listener nc -lp 5000
Run python3 dodyssey.py
You will get a hit on your nc showing we have successfully proceded to send a server side request
dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF