CVE-2026-49452— WeasyPrint: CSS Injection via Presentational Hints
Quick assessment
Affected
Kozea WeasyPrint
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WeasyPrint 是一款帮助 Web 开发人员生成 PDF 文档的工具。在 69.0 版本之前，当启用 时，WeasyPrint 会在 中将未转义的 HTML 表现性提示属性值嵌入到 CSS 中。 属性会被插入到 声明中，并由 进行解析，这使得不受信任的 HTML 能够注入额外的 CSS 声明。启用了表现性提示渲染不受信任 HTML 的应用程序可能会受到 CSS 注入攻击的影响，并且通过注入的 值可能引发服务器端请求漏洞。该问题已在 69.0 版本中得到修复。
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Kozea | WeasyPrint | < 69.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-49452
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WeasyPrint: CSS Injection via Presentational Hints
Source: CVE Program / CVE List V5
Vulnerability Description
WeasyPrint helps web developers to create PDF documents. Prior to 69.0, WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS in weasyprint/css/__init__.py when presentational_hints=True. The background attribute is inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents(), allowing untrusted HTML to inject additional CSS declarations. Applications that render untrusted HTML with presentational hints enabled can be affected by CSS injection and server-side requests through injected url() values. This issue is fixed in version 69.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Kozea | WeasyPrint | < 69.0 | - |
|
II. Public POCs for CVE-2026-49452
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49452
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-49452 (1)
Vendor Advisories for CVE-2026-49452 (1)
Vendor Pages for CVE-2026-49452 (1)
IV. Related Vulnerabilities
Same vendor: Kozea
-
CVE-2026-31899
CairoSVG vulnerable to Exponential DoS via recursive <use> e -
CVE-2025-68616
WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) -
CVE-2024-28184
WeasyPrint allows the attachment of arbitrary files and URLs -
CVE-2023-27586
CairoSVG improperly processes SVG files loaded from external -
CVE-2021-21236
Regular Expression Denial of Service in CairoSVG
Same weakness: CWE-74
-
CVE-2026-53572
KEDA: PostgreSQL connection string parameter injection via i -
CVE-2026-76993
GreyDGL PentestGPT Web-Page Crawling injection -
CVE-2026-55558
aiosmtplib: STARTTLS response injection -
CVE-2026-76365
Structured Query Language (SQL) Injection through Custom Lis -
CVE-2026-20231
Cisco Secure Workload Software Security Hardening Release Au
V. Comments for CVE-2026-49452
No comments yet