Threats affecting pkg:brew/weasyprint

A buffer overflow vulnerability exists in the Brotli decoder in Google Brotli versions 1.0.3 through 1.2.0. This flaw allows remote unauthenticated attackers to corrupt adjacent memory, potentially leading to sensitive data disclosure, denial of service, or arbitrary code execution. The vulnerability affects all platforms and requires updating to fixed versions 1.0.10, 1.1.1, or 1.2.1. The CVSS 4.0 score is 9.2, indicating critical severity.

CVE-2025-66034 is an arbitrary file write vulnerability in the fontTools.varLib component used by WeasyPrint. It arises from unsanitized filename handling and XML injection in .designspace files, allowing attackers to write files to arbitrary filesystem locations and inject malicious content. This can lead to remote code execution without elevated privileges and potential privilege escalation by overwriting critical system files. The vulnerability affects fontTools.varLib versions >=61.0 and <66.0_2 and has been fixed in version 66.0_2.

Scrapy versions up to 2.13.3 are vulnerable to a denial of service (DoS) attack due to a flaw in the brotli decompression implementation. The existing protection against decompression bombs does not mitigate the brotli variant, allowing remote servers to cause clients to crash by consuming excessive memory during decompression. This vulnerability is fixed in version 66.0_1 of Weasyprint.