GHSA-jhhc-3hcp-qhm5: WeasyPrint has CSS Injection via Presentational Hints
WeasyPrint versions up to 68.1 have a CSS injection vulnerability when HTML presentational hints are enabled. Unescaped attribute values are embedded directly into CSS, allowing attackers to inject arbitrary CSS declarations. This can lead to CSS injection and server-side requests via injected url() functions. The issue occurs specifically when the presentational_hints feature is enabled. The vulnerability is identified as CVE-2026-49452 and has a moderate severity rating.
AI Analysis
Technical Summary
WeasyPrint suffers from a CSS injection vulnerability due to unescaped attribute values being embedded into CSS when HTML presentational hints are enabled. Specifically, the background attribute is used to construct CSS without escaping, allowing injection of arbitrary CSS declarations. This is parsed by tinycss2.parse_blocks_contents(), enabling attackers to inject CSS such as additional background-image URLs that can cause server-side requests. The vulnerability affects versions up to and including 68.1 and is tracked as CVE-2026-49452.
Potential Impact
The vulnerability allows an attacker to inject arbitrary CSS declarations, which can lead to CSS injection attacks. This may cause unintended server-side requests through injected url() functions. The impact is limited to scenarios where presentational hints are enabled and untrusted HTML input is processed. There is no indication of direct code execution or data exfiltration beyond CSS injection and induced server requests.
Mitigation Recommendations
No official patch or fix is currently indicated. Mitigation involves disabling the presentational_hints feature or ensuring that attribute values are properly escaped before embedding into CSS. Restricting allowed values for presentational hints can also reduce risk. Monitor the vendor advisory for updates on official fixes or patches.
GHSA-jhhc-3hcp-qhm5: WeasyPrint has CSS Injection via Presentational Hints
Description
WeasyPrint versions up to 68.1 have a CSS injection vulnerability when HTML presentational hints are enabled. Unescaped attribute values are embedded directly into CSS, allowing attackers to inject arbitrary CSS declarations. This can lead to CSS injection and server-side requests via injected url() functions. The issue occurs specifically when the presentational_hints feature is enabled. The vulnerability is identified as CVE-2026-49452 and has a moderate severity rating.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WeasyPrint suffers from a CSS injection vulnerability due to unescaped attribute values being embedded into CSS when HTML presentational hints are enabled. Specifically, the background attribute is used to construct CSS without escaping, allowing injection of arbitrary CSS declarations. This is parsed by tinycss2.parse_blocks_contents(), enabling attackers to inject CSS such as additional background-image URLs that can cause server-side requests. The vulnerability affects versions up to and including 68.1 and is tracked as CVE-2026-49452.
Potential Impact
The vulnerability allows an attacker to inject arbitrary CSS declarations, which can lead to CSS injection attacks. This may cause unintended server-side requests through injected url() functions. The impact is limited to scenarios where presentational hints are enabled and untrusted HTML input is processed. There is no indication of direct code execution or data exfiltration beyond CSS injection and induced server requests.
Mitigation Recommendations
No official patch or fix is currently indicated. Mitigation involves disabling the presentational_hints feature or ensuring that attribute values are properly escaped before embedding into CSS. Restricting allowed values for presentational hints can also reduce risk. Monitor the vendor advisory for updates on official fixes or patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jhhc-3hcp-qhm5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49452"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4c345427e9c797195fe15b
Added to database: 07/06/2026, 23:03:48 UTC
Last enriched: 07/06/2026, 23:37:46 UTC
Last updated: 07/06/2026, 23:37:46 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.