Threats tagged 'brew-weasyprint-cve-2025-66034'

CVE-2025-66034 is an arbitrary file write vulnerability in the fontTools.varLib component used by WeasyPrint. It arises from unsanitized filename handling and XML injection in .designspace files, allowing attackers to write files to arbitrary filesystem locations and inject malicious content. This can lead to remote code execution without elevated privileges and potential privilege escalation by overwriting critical system files. The vulnerability affects fontTools.varLib versions >=61.0 and <66.0_2 and has been fixed in version 66.0_2.