GitHub Advisoryadvisory · PyPI

GHSA-35jj-wx47-4w8r WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

HIGH Published 2024-03-08 Modified 2025-02-13 Official page ↗
Aliases
CVE-2024-28184
Ecosystem
PyPI
Packages
weasyprint
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weaknesses
CWE-829
Reviewed
2024-03-08

Affected packages

• PyPI weasyprint: >= 61.0, < 61.2 → fixed in 61.2

Description

Impact Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. Patches Fixed by 734ee8e that’s included in 61.2 Workarounds • Check that no PDF attachment is defined in source HTML. • Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

Related

Alias · CVE (1)

  • CVE-2024-28184 WeasyPrint helps web developers to create PDF documents. vulnerability

Weakness · CWE (1)

  • CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness

References