WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
Impact
Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.
Patches
Fixed by 734ee8e that’s included in 61.2
Workarounds
- Check that no PDF attachment is defined in source HTML.
- Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | weasyprint | >= 61.0, < 61.2 | 61.2 |
References
- https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r
- https://nvd.nist.gov/vuln/detail/CVE-2024-28184
- https://github.com/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598
- https://github.com/Kozea/WeasyPrint
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLQZMOEDY72TS43HDXOBVID2VYCTWIH6
- https://pypi.org/project/weasyprint
- https://github.com/advisories/GHSA-35jj-wx47-4w8r
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L- Weakness (CWE)
CWE-829- Platform
- Python (PyPI)
- Package
weasyprint- Disclosed
- 08.03.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2033 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-35jj-wx47-4w8r - CC BY 4.0
Vulnerability history: weasyprint
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 03.2024 10.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 2
Disclosures per year
- 2024: 1
- 2025: 0
- 2026: 4
-
WeasyPrint allows the attachment of arbitrary files and URLs to a PDF this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.