CVE-2026-55073Medium· 6.2▾ TwilightPoC availableWeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 34.1 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
weasyprint < 70.0Patched in:
weasyprint 70.0Source: https://osv.dev/vulnerability/GHSA-jf6q-chmf-3h3v
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents
CVE-2024-28184High· 7.4WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
CVE-2026-92958High· 8.5vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM
CVE-2017-7200Medium· 5.8An SSRF issue was discovered in OpenStack Glance before Newton
CVE-2026-42043High· 7.2Axios is a promise based HTTP client for the browser and Node.js
CVE-2025-62718Critical· 9.9Axios is a promise based HTTP client for the browser and Node.js