Threats tagged 'ghsa-r543-q48m-4c9j'

CVE-2026-106443 is a high-severity remote code execution vulnerability in Kozea WeasyPrint that arises from improper input validation. WeasyPrint passes untrusted image bytes directly to Pillow's format dispatcher without restricting input formats. When Ghostscript is installed on the host, Pillow's EPS image plugin invokes Ghostscript to rasterize EPS/PS input, allowing attacker-controlled PostScript to execute. Hosts running vulnerable Ghostscript versions with known -dSAFER bypasses can be fully compromised. The vulnerability affects WeasyPrint versions prior to 70.0 and impacts any deployment rendering untrusted content on hosts with Ghostscript installed.