PT-2026-60023 · Pypi · Weasyprint

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

Details

File: weasyprint/css/ init .py

The background attribute is used to construct CSS:

background-image:url({element.get("background")})

This string is parsed by tinycss2.parse blocks contents().

Because the value is not escaped, additional CSS declarations can be injected.

PoC

Impact

• CSS injection
• Server-side requests via injected url()
• Limited to cases where presentational hints=True

Suggested Fix

• Escape attribute values before embedding into CSS
• Restrict allowed values for presentational hints [VULN-05 css injection presentational hints.md](https://github.com/user-attachments/files/26370718/VULN-05 css injection presentational hints.md)

Correção

Identificadores relacionados

PYSEC-2026-3412

Produtos afetados

Weasyprint

Referências · 6

• https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5 · Nota
• https://github.com/Kozea/WeasyPrint · Nota
• https://github.com/advisories/GHSA-jhhc-3hcp-qhm5 · Nota
• https://osv.dev/vulnerability/PYSEC-2026-3412 · Aviso do Fabricante
• https://pypi.org/project/weasyprint · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-49452 · Nota de Segurança