Description
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kozea | WeasyPrint | < 69.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | weasyprint | 69.0-1 | — |
| Debian 13 | weasyprint | No fix yet | — |
| Debian 12 | weasyprint | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | weasyprint | No fix yet | — |
| Ubuntu 26.04 LTS | weasyprint | No fix yet | — |
| Ubuntu 25.10 | weasyprint | No fix yet | — |
| Ubuntu 24.04 LTS | weasyprint | No fix yet | — |
| Ubuntu 22.04 LTS | weasyprint | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | weasyprint | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-weasyprint | 69.0-1.1 | openSUSE-SU-2026:11249-1 |
| openSUSE Leap 16.0 | python-weasyprint | 65.1-bp160.3.1 | openSUSE-SU-2026:21364-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | weasyprint | <= 68.1 | — | GHSA-jhhc-3hcp-qhm5 |
Advisories 2
- openSUSE-SU-2026:21364-1 Security update for python-weasyprint SUSE / openSUSE Security Updates · Jul 18, 2026
- openSUSE-SU-2026:11249-1 python313-weasyprint-69.0-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026