CVE-2025-68616-Detecting-and-Patching-an-SSRF-in-WeasyPrint-with-Wazuh

From Detection to Remediation: Hunting and Patching a Real SSRF CVE-2025-68616 in WeasyPrint with Wazuh TL;DR During a personal practice exercise with Wazuh open source SIEM/XDR on a Kali Linux machine, the Vulnerability Detection module identified a High CVSS 7.5 severity vulnerability in the...

Security update for python-weasyprint (moderate)

openSUSE Security Update: Security update for python-weasyprint Announcement ID: openSUSE-SU-2026:0356-1 Rating: moderate References: 1279942 Cross-References: CVE-2026-55073 CVSS scores: CVE-2026-55073 SUSE: 5.9 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Affected Products:...

knowledge-repo (>=0.9.2, <=0.9.3), render50 (>=7.0.2, <=8.0.2) potentially affected by CVE-2026-106443 via weasyprint (54.3.0)

weasyprint PYPI version 54.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - knowledge-repo =0.9.2, =7.0.2, =8.0.2 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

lightnovel-crawler (>=2.7.15, <=2.10.1) potentially affected by CVE-2026-106443 via weasyprint (45.0.0)

weasyprint PYPI version 45.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - lightnovel-crawler =2.7.15, =2.10.1 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

cvgen (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-106443 via weasyprint (47.0.0)

weasyprint PYPI version 47.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - cvgen =0.1.0, =0.4.0 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

booklab (>=0.7.0, <=0.10.0a68), criscostack (1.0.0) +5 more potentially affected by CVE-2026-106443 via weasyprint (59.0.0)

weasyprint PYPI version 59.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - booklab =0.7.0, =1.0.0, =1.1.0, =0.1.3, =21.5.0, =21.7.0 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

documentsreader (1.1.5), midastrader (>=1.0.1, <=1.0.23) +1 more potentially affected by CVE-2026-106443 via weasyprint (62.1.0)

weasyprint PYPI version 62.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - documentsreader 1.1.5 - midastrader =1.0.1, =1.0.1, =1.0.7 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

blabel (0.1.5), pdf-reports (>=0.3.3, <=0.3.4) potentially affected by CVE-2026-106443 via weasyprint (52.0.0)

weasyprint PYPI version 52.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - blabel 0.1.5 - pdf-reports =0.3.3, =0.3.4 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

agenticmem (>=0.1.4.1, <=0.1.5.0), biomni-bridge (>=0.3.1, <=0.3.3) +27 more potentially affected by CVE-2026-106443 via weasyprint (66.0.0)

weasyprint PYPI version 66.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - agenticmem =0.1.4.1, =0.3.1, =1.0.1, =0.1.2, =2025.1.0b3, =2026.3.0b2, =1.2.15, =2025.1.0b3, =1.0.3, =0.1.0, =1.59.6rc0, =1.67.6 and more...

roc-punk (>=0.2.3, <=0.2.9) potentially affected by CVE-2026-106443 via weasyprint (0.28.0)

weasyprint PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - roc-punk =0.2.3, =0.2.9 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

mpi-cbs-mediforms (0.1.0a2) potentially affected by CVE-2026-106443 via weasyprint (58.0.0)

weasyprint PYPI version 58.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - mpi-cbs-mediforms 0.1.0a2 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

turandot (>=3.1.4, <=3.1.5) potentially affected by CVE-2026-106443 via weasyprint (56.0.0)

weasyprint PYPI version 56.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - turandot =3.1.4, =3.1.5 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

mpi-cbs-mediforms (>=0.1.0a3, <=0.3.1rc29) potentially affected by CVE-2026-106443 via weasyprint (53.0.0)

weasyprint PYPI version 53.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - mpi-cbs-mediforms =0.1.0a3, =0.3.1rc29 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

PYSEC-2026-4311 WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Summary This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscrip...

almos-kit (>=0.1.1, <=1.2.0), bas-air-unit-network-dataset (>=0.5.0, <=0.5.1) +15 more potentially affected by CVE-2026-106443 via weasyprint (63.1.0)

weasyprint PYPI version 63.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - almos-kit =0.1.1, =0.5.0, =0.0.3, =2.2.0, =3.3.6, =0.3.17, =0.1.2, =0.1.1, =0.10.0, =0.3.3, =2.0.0, =0.9.0, =0.14.0 - textpress 0.1.2 and...

cars (>=1.1.0rc1, <=1.1.0), htmloverpdf (0.0.3) +1 more potentially affected by CVE-2026-106443 via weasyprint (53.0.0b2)

weasyprint PYPI version 53.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - cars =1.1.0rc1, =0.7.0, =0.7.12 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

turandot (3.1.3) potentially affected by CVE-2026-106443 via weasyprint (61.1.0)

weasyprint PYPI version 61.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - turandot 3.1.3 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

terra-bonobo-nodes (>=0.1.1, <=0.1.4), terra-common (>=0.2.2, <=0.2.10) +1 more potentially affected by CVE-2026-106443 via weasyprint (57.0.0)

weasyprint PYPI version 57.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - terra-bonobo-nodes =0.1.1, =0.2.2, =0.2.10 - wagtail-meeting-guide 0.1.0.dev9 Source cves: CVE-2026-106443 Source advisory:...

django-easy-quiz (>=4.0.1, <=4.2.0), memfs (>=0.1.6, <=0.1.8) +2 more potentially affected by CVE-2026-106443 via weasyprint (60.1.0)

weasyprint PYPI version 60.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - django-easy-quiz =4.0.1, =0.1.6, =0.1.0, =0.2.1 - proj2pdf 0.1.0 Source cves: CVE-2026-106443 Source advisory: OSV:PYSEC-2026-4311...

body-organ-analysis (>=0.1.0, <=0.1.5), brena (>=0.0.1, <=0.0.2) +30 more potentially affected by CVE-2026-106443 via weasyprint (52.5.0)

weasyprint PYPI version 52.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - body-organ-analysis =0.1.0, =0.0.1, =0.1.0, =22.16.0, =1.0.0, =24.0.0, =1.1.3, =4.2.1, =0.2.1a0, =25.0.13, =1.0.2.post1, =0.0.1, =1.2.1,...