Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106443— WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Quick assessment

Affected
Kozea WeasyPrint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WeasyPrint 帮助 Web 开发人员创建 PDF 文档。在版本 70.0 之前，WeasyPrint 的 中的图像加载路径会将从 HTML 标签、CSS 图像值、SVG 图像引用以及 data URI 获取的图像字节数据传递给 Pillow 的通用图像分发器，而未排除 EPS 或 PostScript 格式。在已安装 Ghostscript 的主机上，Pillow 的 EpsImagePlugin 会调用解释器来处理由攻击者控制的 PostScript 文件，从而产生受解释器权限允许的效果；如果安装的 Gh

CVSS 8.8 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
Kozea WeasyPrint < 70.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106443

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE
Source: CVE Program / CVE List V5
Vulnerability Description
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-controlled PostScript, which can produce interpreter-permitted effects and can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass. Hosts without Ghostscript do not reach this rasterization path. This issue is fixed in version 70.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Kozea WeasyPrint < 70.0 -

II. Public POCs for CVE-2026-106443

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106443

请登录查看更多情报信息。

Vendor Pages for CVE-2026-106443 (1)

Other References for CVE-2026-106443 (2)

IV. Related Vulnerabilities

Same product: WeasyPrint
Same vendor: Kozea
Same weakness: CWE-20

V. Comments for CVE-2026-106443

No comments yet

Leave a comment