Weasyprint: [Unknown description] (CVE-2026-49452)
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.
AI Analysis
Technical Summary
WeasyPrint contains a CSS injection vulnerability (CVE-2026-49452) in its handling of HTML presentational hints. Specifically, the background attribute value is embedded unescaped into CSS code (background-image:url({element.get("background")})), which is then parsed by tinycss2. Because the attribute value is not escaped, an attacker can inject arbitrary CSS declarations, including malicious url() references that may cause server-side requests. This affects applications processing untrusted HTML input with presentational_hints enabled.
Potential Impact
The vulnerability allows injection of arbitrary CSS declarations, which can lead to unintended CSS behavior and potentially force the server to make requests to attacker-controlled or internal URLs via injected url() functions. This could expose internal metadata or cause other side effects. The impact is limited to scenarios where presentational hints are enabled and untrusted HTML input is processed.
Mitigation Recommendations
No official patch or fix is explicitly stated in the provided data. The suggested fix is to escape attribute values before embedding them into CSS and to restrict allowed values for presentational hints. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Weasyprint: [Unknown description] (CVE-2026-49452)
Description
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WeasyPrint contains a CSS injection vulnerability (CVE-2026-49452) in its handling of HTML presentational hints. Specifically, the background attribute value is embedded unescaped into CSS code (background-image:url({element.get("background")})), which is then parsed by tinycss2. Because the attribute value is not escaped, an attacker can inject arbitrary CSS declarations, including malicious url() references that may cause server-side requests. This affects applications processing untrusted HTML input with presentational_hints enabled.
Potential Impact
The vulnerability allows injection of arbitrary CSS declarations, which can lead to unintended CSS behavior and potentially force the server to make requests to attacker-controlled or internal URLs via injected url() functions. This could expose internal metadata or cause other side effects. The impact is limited to scenarios where presentational hints are enabled and untrusted HTML input is processed.
Mitigation Recommendations
No official patch or fix is explicitly stated in the provided data. The suggested fix is to escape attribute values before embedding them into CSS and to restrict allowed values for presentational hints. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jhhc-3hcp-qhm5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-49452"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4c345427e9c797195fe15b
Added to database: 07/06/2026, 23:03:48 UTC
Last enriched: 08/19/2026, 11:15:57 UTC
Last updated: 09/14/2026, 22:01:34 UTC
Views: 185
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.