CVE-2026-49452 WeasyPrint: CSS Injection via Presentational Hints
Attackers can inject CSS via unescaped HTML attributes in WeasyPrint when presentational hints are enabled, potentially triggering server-side requests or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49452?
CVE-2026-49452 is a medium-severity code injection vulnerability in Kozea WeasyPrint, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.
Weakness: CWE-74
Which versions are affected by CVE-2026-49452?
3 open source packages ship an affected version, including weasyprint.
| Package | Affected | Fixed in |
|---|---|---|
weasyprint PyPI | All versions to 68.1 | None |
weasyprint PyPI | All versions to 68.1 | None |
weasyprint PyPI | All versions to 68.1 | None |
Linux distribution packages (2)
python-weasyprint openSUSE:Leap 16.0 | All versions | 65.1-bp160.3.1 |
python-weasyprint openSUSE:Tumbleweed | All versions | 69.0-1.1 |
How do I fix CVE-2026-49452?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-49452 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49452 exists.
Sources
Also known as DEBIAN-CVE-2026-49452, GHSA-jhhc-3hcp-qhm5, PYSEC-2026-3412, UBUNTU-CVE-2026-49452, openSUSE-SU-2026:11249-1, openSUSE-SU-2026:21364-1.