~ / search / GHSA-35jj-wx47-4w8r

GHSA-35jj-wx47-4w8r

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

Source: GitHub Advisory Database (reviewed) High CVE-2024-28184

Packages

EcosystemPackageAffectedFixed in
PyPI weasyprint >= 61.0, < 61.2 61.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. ### Patches Fixed by 734ee8e that’s included in 61.2 ### Workarounds - Check that no PDF attachment is defined in source HTML. - Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

References

External links from the advisory. They lead to third-party sites.