Threat database

CVE-2026-107378 is a high-severity vulnerability in Kozea CairoSVG versions prior to 2.9.1 caused by inefficient algorithmic complexity in SVG path rendering. The vulnerability arises from two independent O(n²) operations in the path parser and marker handling code, leading to excessive CPU usage when rendering SVGs with many path segments. An attacker can exploit this by submitting a crafted SVG with a large number of path segments, causing denial of service due to high CPU consumption during rendering.

CVE-2026-106443 is a high-severity remote code execution vulnerability in Kozea WeasyPrint that arises from improper input validation. WeasyPrint passes untrusted image bytes directly to Pillow's format dispatcher without restricting input formats. When Ghostscript is installed on the host, Pillow's EPS image plugin invokes Ghostscript to rasterize EPS/PS input, allowing attacker-controlled PostScript to execute. Hosts running vulnerable Ghostscript versions with known -dSAFER bypasses can be fully compromised. The vulnerability affects WeasyPrint versions prior to 70.0 and impacts any deployment rendering untrusted content on hosts with Ghostscript installed.

CVE-2026-55073 is a Server-Side Request Forgery (SSRF) vulnerability in Kozea WeasyPrint versions prior to 70.0. It allows an attacker to bypass restrictive URL fetcher configurations by exploiting the xmp_metadata or stylesheets options, potentially reading local files and embedding them in generated PDFs. This issue is fixed in version 70.0.

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive <use> element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input.

WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.