Catalogo CVE

CVE-2026-49452

weasyprint affected and fixed versions

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.

Gravità: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: Jul 10, 2026, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.37% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiansid	weasyprint	`69.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-49452]
Debiansid	weasyprint	`70.0-1`	Fixed	[CVE-2026-49452]
Debianforky	weasyprint	`69.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-49452]
Debianforky	weasyprint	`70.0-1`	Fixed	[CVE-2026-49452]

Showing 4 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	weasyprint	Not reported	UnknownSource applicability is not established	Provider not reported
PyPIRelease not reported	weasyprint	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	weasyprint	Not reported	AffectedDistribution reports no fix	[CVE-2026-49452]
Debianbookworm	weasyprint	`57.2-1`	Affected	[CVE-2026-49452]
Debianforky	weasyprint	`69.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-49452]
Debianforky	weasyprint	`70.0-1`	Fixed	[CVE-2026-49452]
Debiansid	weasyprint	`69.0-1`	FixedDistribution-reported fixed boundary	[CVE-2026-49452]
Debiansid	weasyprint	`70.0-1`	Fixed	[CVE-2026-49452]
Debiantrixie	weasyprint	Not reported	AffectedDistribution reports no fix	[CVE-2026-49452]
Debiantrixie	weasyprint	`62.3-1`	Affected	[CVE-2026-49452]
Opensuseleap 16.0	python-weasyprint	`65.1-bp160.3.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:21364-1]Jul 18, 2026, 6:24:04 PM UTC
Opensusetumbleweed	python-weasyprint	`69.0-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11249-1]Jul 11, 2026, 9:15:07 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "weasyprint",
      "status": "fixed",
      "release": "sid",
      "version": "70.0-1"
    },
    {
      "name": "weasyprint",
      "status": "fixed",
      "release": "forky",
      "version": "70.0-1"
    },
    {
      "name": "weasyprint",
      "status": "vulnerable",
      "release": "trixie",
      "version": "62.3-1"
    },
    {
      "name": "weasyprint",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "57.2-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "weasyprint",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "69.0-1"
    },
    {
      "bug": null,
      "name": "weasyprint",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "69.0-1"
    },
    {
      "bug": null,
      "name": "weasyprint",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "weasyprint",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "weasyprint",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "weasyprint",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "68.1"
            }
          ]
        }
      ],
      "ecosystem": "PyPI",
      "fixed_version": "",
      "applicability_unknown": true
    },
    {
      "name": "python-weasyprint",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "65.1-bp160.3.1"
            }
          ]
        }
      ],
      "release": "leap 16.0",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:21364-1",
      "fixed_version": "65.1-bp160.3.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:21364-1",
      "provider_updated_at": "2026-07-18T18:24:04.237724665Z",
      "applicability_unknown": true
    },
    {
      "name": "python-weasyprint",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "69.0-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11249-1",
      "fixed_version": "69.0-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11249-1",
      "provider_updated_at": "2026-07-11T09:15:07.620921157Z",
      "applicability_unknown": true
    }
  ]
}

Publisher notes

[trixie] weasyprint: Minor issue [bookworm] weasyprint: Minor issue; only exploitable when presentational hints are enabled, disabled by default

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[weasyprint]Sconosciuto
Dettagli (2)
- 57.2-1 · all · bookworm
  Interessata
  dsa · weasyprint · debian · bookworm; dsa · weasyprint · debian · 12
- 57.2-1 · all · bookworm
  Interessata
  dsa · weasyprint · debian · bookworm; dsa · weasyprint · debian · 12

[Debian 13 (Trixie)]

[weasyprint]Sconosciuto
Dettagli (2)
- 62.3-1 · all · trixie
  Interessata
  dsa · weasyprint · debian · 13
- 62.3-1 · all · trixie
  Interessata
  dsa · weasyprint · debian · 13

[openSUSE Tumbleweed]

[python313-weasyprint]Sconosciuto
Pacchetto sorgente: [python-weasyprint]
Dettagli (1)
- 69.0-1.1 · noarch · tumbleweed
  Sconosciuto · Corretta: 69.0-1.1
  Version impact unknown
  dsa · python-weasyprint · opensuse · tumbleweed
[python314-weasyprint]Sconosciuto
Pacchetto sorgente: [python-weasyprint]
Dettagli (1)
- 69.0-1.1 · noarch · tumbleweed
  Sconosciuto · Corretta: 69.0-1.1
  Version impact unknown
  dsa · python-weasyprint · opensuse · tumbleweed

Osservato: Oct 24, 2026, 5:36:29 AM UTC

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]