p PatchFirst

CVE-2026-49452

CVE-2026-49452 · WeasyPrint: CSS Injection via Presentational Hints

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.

CVSS 6.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • weasyprint

    Versions
    • < 69.0: Affected

    No fix published

  • weasyprint Debian:12

    Versions
    • 57.2-1
    • 59.0-1
    • 60.2-1
    • 61.0-1
    • 61.1-1
    • 61.2-1
    • 61.2-2
    • 62.0-1
    • 62.1-1
    • 62.2-1
    • 62.3-1
    • 67.0-1
    • 69.0-1
    • 69.0-2
    • 70.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Debian:13

    Versions
    • 62.3-1
    • 67.0-1
    • 69.0-1
    • 69.0-2
    • 70.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Debian:14

    Versions
    • 62.3-1
    • 67.0-1
    Affected ranges
    • ECOSYSTEM: < 69.0-1

    Update to 69.0-1

  • weasyprint PyPI

    Versions
    • 0.1
    • 0.10
    • 0.11
    • 0.12
    • 0.13
    • 0.14
    • 0.15
    • 0.16
    • 0.17
    • 0.17.1
    • 0.18
    • 0.19
    • 0.19.1
    • 0.19.2
    • 0.2
    • 0.2.1
    • 0.2.2
    • 0.20
    • 0.20.1
    • 0.20.2
    • 0.21
    • 0.22
    • 0.23
    • 0.24
    • 0.25
    • 0.26
    • 0.27
    • 0.28
    • 0.29
    • 0.3
    • 0.3.1
    • 0.30
    • 0.31
    • 0.32
    • 0.33
    • 0.34
    • 0.35
    • 0.36
    • 0.37
    • 0.38
    • 0.39
    • 0.4
    • 0.40
    • 0.41
    • 0.42
    • 0.42.1
    • 0.42.2
    • 0.42.3
    • 0.5
    • 0.6
    • 0.6.1
    • 0.7
    • 0.7.1
    • 0.8
    • 0.9
    • 43
    • 43rc1
    • 43rc2
    • 44
    • 45
    • 46
    • 47
    • 48
    • 49
    • 50
    • 51
    • 52
    • 52.1
    • 52.2
    • 52.3
    • 52.4
    • 52.5
    • 53.0
    • 53.0b1
    • 53.0b2
    • 53.1
    • 53.2
    • 53.3
    • 53.4
    • 54.0
    • 54.0b1
    • 54.1
    • 54.2
    • 54.3
    • 55.0
    • 55.0b1
    • 56.0
    • 56.0b1
    • 56.1
    • 57.0
    • 57.0b1
    • 57.1
    • 57.2
    • 58.0
    • 58.0b1
    • 58.1
    • 59.0
    • 59.0b1
    • 60.0
    • 60.1
    • 60.2
    • 61.0
    • 61.1
    • 61.2
    • 62.0
    • 62.1
    • 62.2
    • 62.3
    • 63.0
    • 63.1
    • 64.0
    • 64.1
    • 65.0
    • 65.1
    • 66.0
    • 67.0
    • 68.0
    • 68.1
    Affected ranges
    • ECOSYSTEM: ≤ 68.1

    No fix published

  • weasyprint Ubuntu:20.04:LTS

    Versions
    • 50-2
    • 51-1
    • 51-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:22.04:LTS

    Versions
    • 51-2
    • 51-3
    • 53.4-1
    • 54.0-1
    • 54.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:24.04:LTS

    Versions
    • 59.0-1
    • 60.2-1
    • 61.0-1
    • 61.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:25.10

    Versions
    • 62.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:26.10

    Versions
    • 67.0-1
    • 69.0-1
    • 69.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • weasyprint Ubuntu:26.04:LTS

    Versions
    • 62.3-1
    • 62.3-1build1
    • 67.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →