260 matches found
[SECURITY] Fedora 45 Update: docbook-style-xsl-1.79.2-29.fc45
These XSL stylesheets allow you to transform any DocBook XML document to other formats, such as HTML, FO, and XHMTL. They are highly customizable...
Linux Distros Unpatched Vulnerability : CVE-2026-55073
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass...
CVE-2026-55073
A flaw was found in WeasyPrint. Server-side applications that configure a restrictive URL fetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. This allows an attacker to read local files or perform Server-Si...
CVE-2026-55073
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
DEBIAN-CVE-2026-55073
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
CVE-2026-55073
WeasyPrint prior to 70.0 contains a url_fetcher bypass in two write_pdf() code paths. The xmp_metadata parameter in weasyprint/pdf/__init__.py calls select_source() without passing the document's fetcher, enabling arbitrary local file read with contents embedded verbatim in the output PDF. The st...
CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
CVE-2026-55073
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
EUVD-2026-77638
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
CVE-2026-55073 WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
Astra Linux – Vulnerability in Firefox and Thunderbird
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...
Astra Linux – Vulnerability in Firefox and Thunderbird
An attacker could have injected CSS into stylesheets that are accessible via internal URIs, such as resource:, thereby bypassing a page’s Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...
CVE-2026-55073: Server-Side Request Forgery (SSRF)
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
SUSE CVE-2026-55073
WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive urlfetcher and pass attacker-influenced values to HTML.writepdf can have the restriction bypassed through the xmpmetadata or stylesheets options. In weasyprint/pdf/init.py...
PYSEC-2026-3940 weasyprint Has Server-Side Request Forgery (SSRF)
Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...
weasyprint Has Server-Side Request Forgery (SSRF)
Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...
GHSA-JF6Q-CHMF-3H3V weasyprint Has Server-Side Request Forgery (SSRF)
Summary urlfetcher is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block file://, internal hosts, etc. when rendering untrusted input. Two writepdf channels ignore the document's urlfetcher and build a fresh default URLFetcher instead. A restrictive...
PT-2026-89206
Name of the Vulnerable Software and Affected Versions WeasyPrint versions prior to 70.0 Description Server-side applications using WeasyPrint to render untrusted input may experience a bypass of the url fetcher mechanism, which is designed to restrict resource loading such as blocking file:// or...