{"id":"CVE-2024-28184","aliases":["GHSA-35jj-wx47-4w8r","PYSEC-2026-2033"],"title":"WeasyPrint allows the attachment of arbitrary files and URLs to a PDF","summary":"WeasyPrint allows the attachment of arbitrary files and URLs to a PDF","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","vendor":"weasyprint","product":"weasyprint","ecosystem":"pip","affected":["weasyprint >= 61.0, < 61.2"],"patched":["weasyprint 61.2"],"published":"2024-03-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:10.011519888Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-35jj-wx47-4w8r","references":[{"url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28184"},{"url":"https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598"},{"url":"https://github.com/Kozea/WeasyPrint"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLQZMOEDY72TS43HDXOBVID2VYCTWIH6"}],"tags":["osv","pip"],"epss":0.00628,"epssPercentile":0.48429,"ingestedAt":"2026-07-08T18:25:44.676Z","slug":"CVE-2024-28184","body":"## Overview\n\n### Impact\nSince version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs.\n\n### Patches\nFixed by 734ee8e that’s included in 61.2\n\n### Workarounds\n- Check that no PDF attachment is defined in source HTML.\n- Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.\n\n## Affected packages\n\n- `weasyprint >= 61.0, < 61.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `weasyprint 61.2`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}