GHSA-35jj-wx47-4w8rHighCVSS 7.4

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

Published
March 8, 2024
Last Modified
February 13, 2025

🔗 CVE IDs covered (1)

CVE-2024-28184 →

📋 Description

Impact

Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

  • Check that no PDF attachment is defined in source HTML.
  • Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

🎯 Affected products1

  • pip/weasyprint:>= 61.0, <= 61.1

🔗 References (5)