CVE catalog

CVE-2026-55073

weasyprint: CVE-2026-55073

Severity: Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: Sep 9, 2026, 6:06:38 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.22% · Oct 25, 2026

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	weasyprint	sid	`70.0-1`	fixed
Debian	weasyprint	forky	`70.0-1`	fixed
Debian	weasyprint	trixie	`62.3-1`	vulnerable
Debian	weasyprint	bookworm	`57.2-1`	vulnerable
PyPI	weasyprint	Not reported	`70.0`	fixed
Pip	weasyprint	Not reported	`70.0`	fixed
Opensuse	python-weasyprint	leap 16.0	`65.1-bp160.4.1`	fixed
Opensuse	python-weasyprint	tumbleweed	`70.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	weasyprint	source	sid	`70.0-1`	not yet assigned	Not reported	[1148178]
Debian	weasyprint	source	forky	`70.0-1`	not yet assigned	Not reported	[1148178]
Debian	weasyprint	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1148178]
Debian	weasyprint	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1148178]
PyPI	weasyprint	PyPI	Not reported	`70.0`	Not reported	PYSEC-2026-3940	Not reported
Pip	weasyprint	pip	Not reported	`70.0`	Not reported	GHSA-JF6Q-CHMF-3H3V	Not reported
Opensuse	python-weasyprint	rpm	leap 16.0	`65.1-bp160.4.1`	Not reported	OPENSUSE-SU-2026:21928-1	Not reported
Opensuse	python-weasyprint	rpm	tumbleweed	`70.0-1.1`	Not reported	OPENSUSE-SU-2026:11816-1	Not reported

[Debian bug #1148178]

Notes

[trixie] weasyprint: Minor issue [bookworm] weasyprint: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[weasyprint]Affected
Details (2)
- 57.2-1 · all · bookworm
  Affected
  dsa · weasyprint · debian · bookworm; dsa · weasyprint · debian · 12
- 57.2-1 · all · bookworm
  Affected
  dsa · weasyprint · debian · bookworm; dsa · weasyprint · debian · 12

[Debian 13 (Trixie)]

[weasyprint]Affected
Details (2)
- 62.3-1 · all · trixie
  Affected
  dsa · weasyprint · debian · 13
- 62.3-1 · all · trixie
  Affected
  dsa · weasyprint · debian · 13

[openSUSE Tumbleweed]

[python313-weasyprint]Unknown
Source package: [python-weasyprint]
Details (1)
- 69.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 70.0-1.1
  Version impact unknown
  dsa · python-weasyprint · opensuse · tumbleweed
[python314-weasyprint]Unknown
Source package: [python-weasyprint]
Details (1)
- 69.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 70.0-1.1
  Version impact unknown
  dsa · python-weasyprint · opensuse · tumbleweed

Observed: Oct 23, 2026, 9:28:27 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]