https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-04T15:46:00.159546+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-weasyprint-cve-2026-49452 BREW-weasyprint-CVE-2026-49452 — WeasyPrint has CSS Injection via Presentational Hints 2026-10-04T15:46:00.168463+00:00

Affected: Homebrew: weasyprint

### Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

### Details File: weasyprint/css/__init__.py

The `background` attribute is used to construct CSS:

background-image:url({element.get("background")})

This string is parsed by `tinycss2.parse_blocks_contents()`.

Because the value is not escaped, additional CSS declarations can be injected.

### PoC <body background="x);background-image:url(http://169.254.169.254/latest/meta-data/)">

### Impact - CSS injection - Server-side requests via injected `url()` - Limited to cases where `presentational_hints=True`

### Suggested Fix - Escape attribute values before embedding into CSS - Restrict allowed values for presentational hints [VULN-05_css_injection_presentational_hints.md](https://github.com/user-attachments/files/26370718/VULN-05_css_injection_presentational_hints.md)

 https://vulnerability.circl.lu/vuln/fkie_cve-2026-49452 fkie_cve-2026-49452 2026-10-04T15:46:00.168587+00:00

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.

 https://vulnerability.circl.lu/vuln/ghsa-jhhc-3hcp-qhm5 GHSA-jhhc-3hcp-qhm5 — WeasyPrint has CSS Injection via Presentational Hints 2026-10-04T15:46:00.168641+00:00

Affected: PyPI: weasyprint

### Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

### Details File: weasyprint/css/__init__.py

The `background` attribute is used to construct CSS:

background-image:url({element.get("background")})

This string is parsed by `tinycss2.parse_blocks_contents()`.

Because the value is not escaped, additional CSS declarations can be injected.

### PoC <body background="x);background-image:url(http://169.254.169.254/latest/meta-data/)">

### Impact - CSS injection - Server-side requests via injected `url()` - Limited to cases where `presentational_hints=True`

### Suggested Fix - Escape attribute values before embedding into CSS - Restrict allowed values for presentational hints [VULN-05_css_injection_presentational_hints.md](https://github.com/user-attachments/files/26370718/VULN-05_css_injection_presentational_hints.md)

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11249-1 openSUSE-SU-2026:11249-1 — python313-weasyprint-69.0-1.1 on GA media 2026-10-04T15:46:00.168703+00:00

python313-weasyprint-69.0-1.1 on GA media

 https://vulnerability.circl.lu/vuln/pysec-2026-3412 PYSEC-2026-3412 — WeasyPrint has CSS Injection via Presentational Hints 2026-10-04T15:46:00.168733+00:00

Affected: PyPI: weasyprint

### Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

### Details File: weasyprint/css/__init__.py

The `background` attribute is used to construct CSS:

background-image:url({element.get("background")})

This string is parsed by `tinycss2.parse_blocks_contents()`.

Because the value is not escaped, additional CSS declarations can be injected.

### PoC <body background="x);background-image:url(http://169.254.169.254/latest/meta-data/)">

### Impact - CSS injection - Server-side requests via injected `url()` - Limited to cases where `presentational_hints=True`

### Suggested Fix - Escape attribute values before embedding into CSS - Restrict allowed values for presentational hints [VULN-05_css_injection_presentational_hints.md](https://github.com/user-attachments/files/26370718/VULN-05_css_injection_presentational_hints.md)

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-49452 UBUNTU-CVE-2026-49452 2026-10-04T15:46:00.168786+00:00

Affected: Ubuntu:20.04:LTS: weasyprint, Ubuntu:22.04:LTS: weasyprint, Ubuntu:24.04:LTS: weasyprint, Ubuntu:25.10: weasyprint, Ubuntu:26.04:LTS: weasyprint

WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.