---
id: CVE-2026-106443
title: WeasyPrint helps web developers to create PDF documents
summary: >-
  WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the
  image-loading path in weasyprint/images.py passes fetched image bytes from
  HTML img URLs, CSS image values, SVG image references, and data URIs to
  Pillow's gener…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-20
vendor: Kozea
product: WeasyPrint
affected:
  - WeasyPrint < 70.0
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T20:17:26.023'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106443'
references:
  - url: >-
      https://github.com/Kozea/WeasyPrint/commit/39cd37ce1610bd890388e26591c569db1cbab542
    label: security-advisories@github.com
  - url: 'https://github.com/Kozea/WeasyPrint/releases/tag/v70.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-r543-q48m-4c9j
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-06T19:27:04.747147Z'
ingestedAt: '2026-10-06T19:13:33.849Z'
---

## Overview

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-controlled PostScript, which can produce interpreter-permitted effects and can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass. Hosts without Ghostscript do not reach this rasterization path. This issue is fixed in version 70.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.