CVE-2026-49452
Description
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
weasyprintPyPI | <= 68.1 | — |
Affected products
3- Range: <69.0
- osv-coords2 versionspkg:rpm/opensuse/python-weasyprint&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-weasyprint&distro=openSUSE%20Tumbleweed
< 65.1-bp160.3.1+ 1 more
- (no CPE)range: < 65.1-bp160.3.1
- (no CPE)range: < 69.0-1.1
Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.