Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

weasyprint

5 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
70.0.0 (Sep 8, 2026): no advisory affects it
Newest unaffected release
70.0.0 (Sep 8, 2026), the latest release
Advisories
5 · 3 high, 2 medium
Weekly downloads
10.1M
Dependents
590
Releases
120 since 0.1.0 (Oct 28, 2011)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

    Affected: fixed in 70.0.

    Fixed in 70.0.0 (released Sep 8, 2026, 28 days before disclosure).

    The latest release, 70.0.0, is not affected.

  • CVE-2026-55073Medium 6.2

    WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF

    Affected: fixed in 70.0.

    Fixed in 70.0.0 (released Sep 8, 2026, 6 days before disclosure).

    The latest release, 70.0.0, is not affected.

  • CVE-2026-49452Medium 6.5

    WeasyPrint: CSS Injection via Presentational Hints

    Affected: through 68.1.

    Fixed in 69.0.0 (released Jun 2, 2026, 77 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 70.0.0, is not affected.

  • WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect

    Affected: fixed in 68.0.

    Fixed in 68.0.0 (released Jan 19, 2026, the day of disclosure).

    The latest release, 70.0.0, is not affected.

  • WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

    Affected: from 61.0, fixed in 61.2.

    Fixed in 61.2.0 (released Mar 8, 2024, 1 day before disclosure).

    The latest release, 70.0.0, is not affected.