Kozea Weasyprint vulnerabilities

CVE-2026-106443 [HIGH] CWE-20 CVE-2026-106443: WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in we WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsIma

CVE-2025-68616 [HIGH] CWE-601 CVE-2025-68616: WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side reques WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a c

CVE-2024-28184 [HIGH] CWE-829 CVE-2024-28184: WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

CVE-2026-49452 [MEDIUM] CWE-74 CVE-2026-49452: WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untr

CVE-2026-55073 [MEDIUM] CWE-918 CVE-2026-55073: WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications tha WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the