CVE-2025-68616-Detecting-and-Patching-an-SSRF-in-WeasyPrint-with-Wazuh

From Detection to Remediation: Hunting and Patching a Real SSRF CVE-2025-68616 in WeasyPrint with Wazuh TL;DR During a personal practice exercise with Wazuh open source SIEM/XDR on a Kali Linux machine, the Vulnerability Detection module identified a High CVSS 7.5 severity vulnerability in the...

PYSEC-2026-4311 WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Summary This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscrip...

GHSA-R543-Q48M-4C9J WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Summary This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscrip...

bpp-iplweb (>=202209.1088.0, <=202504.1174.0), circe-transformations-certic (0.0.3) +1 more potentially affected by CVE-2026-106443 via weasyprint (55.0.0)

weasyprint PYPI version 55.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - bpp-iplweb =202209.1088.0, =202504.1174.0 - circe-transformations-certic 0.0.3 - render50 8.0.0 Source cves: CVE-2026-106443 Source advisor...

turandot (>=3.1.4, <=3.1.5) potentially affected by CVE-2026-106443 via weasyprint (56.0.0)

weasyprint PYPI version 56.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - turandot =3.1.4, =3.1.5 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

enclose (>=1.0.4, <=1.0.9), pentest-report-generator (>=0.1.4, <=0.1.6) +4 more potentially affected by CVE-2026-106443 via weasyprint (57.2.0)

weasyprint PYPI version 57.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - enclose =1.0.4, =0.1.4, =1.43.1, =1.43.1, =1.43.1, =1.43.1, =1.50.3 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

mpi-cbs-mediforms (0.1.0a2) potentially affected by CVE-2026-106443 via weasyprint (58.0.0)

weasyprint PYPI version 58.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - mpi-cbs-mediforms 0.1.0a2 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

brs-xss (4.0.0), complio (0.1.2) +14 more potentially affected by CVE-2026-106443 via weasyprint (60.2.0)

weasyprint PYPI version 60.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - brs-xss 4.0.0 - complio 0.1.2 - gendazpack 0.1.0 - investments 0.2.0 - invocr =1.0.0, =0.1.0, =0.1.4.29, =0.1.0, =0.1.10, =21.8.0, =0.1.0,...

turandot (3.1.3) potentially affected by CVE-2026-106443 via weasyprint (61.1.0)

weasyprint PYPI version 61.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - turandot 3.1.3 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

asrbench (0.1.0), asrbench-cli (0.1.0) +22 more potentially affected by CVE-2026-106443 via weasyprint (62.3.0)

weasyprint PYPI version 62.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - asrbench 0.1.0 - asrbench-cli 0.1.0 - billingyard 1.1.0 - cardtale =0.1.0, =10.0.0, =0.3.4, =0.1.0, =0.10.0, =0.2.2, =0.1.27, =0.1.0, =0.1....

alertwise (1.0.0), md2weasypdf (>=0.0.39, <=0.0.44) +1 more potentially affected by CVE-2026-106443 via weasyprint (63.0.0)

weasyprint PYPI version 63.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - alertwise 1.0.0 - md2weasypdf =0.0.39, =0.0.44 - sampledb 0.30.0 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

almos-kit (>=0.1.1, <=1.2.0), bas-air-unit-network-dataset (>=0.5.0, <=0.5.1) +15 more potentially affected by CVE-2026-106443 via weasyprint (63.1.0)

weasyprint PYPI version 63.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - almos-kit =0.1.1, =0.5.0, =0.0.3, =2.2.0, =3.3.6, =0.3.17, =0.1.2, =0.1.1, =0.10.0, =0.3.3, =2.0.0, =0.9.0, =0.14.0 - textpress 0.1.2 and...

eml2pdf (>=0.1.0, <=2.0.2), markdowntopdf (>=0.1.2, <=0.1.3) +4 more potentially affected by CVE-2026-106443 via weasyprint (64.1.0)

weasyprint PYPI version 64.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - eml2pdf =0.1.0, =0.1.2, =0.0.45, =0.1.0, =0.1.0, =0.1.2 - strahlenexposition-uba 1.0.0 Source cves: CVE-2026-106443 Source advisory:...

mac-letterhead (>=0.6.5, <=0.14.0) potentially affected by CVE-2026-106443 via weasyprint (65.0.0)

weasyprint PYPI version 65.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - mac-letterhead =0.6.5, =0.14.0 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

coreason-scribe (>=0.1.0, <=0.3.0), django-afip (>=5.0.0, <=14.1.0) +8 more potentially affected by CVE-2026-106443 via weasyprint (67.0.0)

weasyprint PYPI version 67.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - coreason-scribe =0.1.0, =5.0.0, =6.0.0, =0.1.0, =1.3.0, =1.1.7.post1, =1.2.1, =0.1.0, =2.11.0, =2.11.1 Source cves: CVE-2026-106443 Source...

arthexis (>=0.2.4, <=0.11.0), automathics (>=0.1.2, <=0.2.5) +17 more potentially affected by CVE-2026-106443 via weasyprint (68.1.0)

weasyprint PYPI version 68.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - arthexis =0.2.4, =0.1.2, =0.0.1.dev20250508, =2026.7.4, =1.10.1, =0.3.1, =0.1.0, =1.3.40, =0.1.0, =1.2.4, =0.3.1, =0.33.0, =0.33.1 and more...

bibforgery (>=1.10.1b0, <=1.10.22), body-organ-analysis (>=1.0.0, <=1.0.3) +37 more potentially affected by CVE-2026-106443 via weasyprint (69.0.0)

weasyprint PYPI version 69.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - bibforgery =1.10.1b0, =1.0.0, =0.0.1.dev20260720, =2026.8.23, =1.10.3, =0.274.0, =0.7.1, =13.0.0b3.dev0, =0.1.0, =0.0.4, =2026.0.0, =0.13.1...

terra-bonobo-nodes (>=0.1.1, <=0.1.4), terra-common (>=0.2.2, <=0.2.10) +1 more potentially affected by CVE-2026-106443 via weasyprint (57.0.0)

weasyprint PYPI version 57.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - terra-bonobo-nodes =0.1.1, =0.2.2, =0.2.10 - wagtail-meeting-guide 0.1.0.dev9 Source cves: CVE-2026-106443 Source advisory:...

cssfinder (>=0.3.0, <=0.8.0), cssfinder-backend-numpy (>=0.1.1, <=0.5.0) +3 more potentially affected by CVE-2026-106443 via weasyprint (58.1.0)

weasyprint PYPI version 58.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - cssfinder =0.3.0, =0.1.1, =0.2.0, =0.3.0 - wh-m2p 0.0.1a0 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...

booklab (>=0.7.0, <=0.10.0a68), criscostack (1.0.0) +5 more potentially affected by CVE-2026-106443 via weasyprint (59.0.0)

weasyprint PYPI version 59.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - booklab =0.7.0, =1.0.0, =1.1.0, =0.1.3, =21.5.0, =21.7.0 Source cves: CVE-2026-106443 Source advisory: OSV:GHSA-R543-Q48M-4C9J...