{"id":"CVE-2026-49452","title":"WeasyPrint helps web developers to create PDF documents","summary":"WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cwe":["CWE-74"],"vendor":"weasyprint","product":"weasyprint","affected":["weasyprint <= 68.1"],"published":"2026-08-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49452","references":[{"url":"https://github.com/Kozea/WeasyPrint/commit/e158264e33fa399b29f415d30719c1d85a55df1d","label":"security-advisories@github.com"},{"url":"https://github.com/Kozea/WeasyPrint/pull/2773","label":"security-advisories@github.com"},{"url":"https://github.com/Kozea/WeasyPrint/releases/tag/v69.0","label":"security-advisories@github.com"},{"url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5","label":"security-advisories@github.com"},{"url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-jhhc-3hcp-qhm5"}],"tags":["nvd","ghsa","pip"],"epss":0.00335,"epssPercentile":0.27032,"aliases":["GHSA-jhhc-3hcp-qhm5"],"ecosystem":"pip","ingestedAt":"2026-07-06T17:44:51.399Z","slug":"CVE-2026-49452","body":"## Overview\n\nWeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49452)\n\nAffected packages:\n\n- `weasyprint <= 68.1`\n\nSource: https://github.com/advisories/GHSA-jhhc-3hcp-qhm5","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}