WeasyPrint vulnerabilities

3 known vulnerabilities in WeasyPrint from Kozea. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  WeasyPrint helps web developers to create PDF documents.

  CVE-2026-106443Oct 6, 2026Kozea

  WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher wit

• 7.5 High severity

  WeasyPrint: Server-Side Request Forgery

  CVE-2025-68616Jan 19, 2026Kozea

  WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such a

• 7.4 High severity

  WeasyPrint: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2024-28184Mar 9, 2024Kozea

  WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs