WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Summary This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscrip...

GHSA-R543-Q48M-4C9J WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Summary This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscrip...