CVE-2024-28184

CVE-2024-28184 — WeasyPrint is affected in versions up to 61.1, where the PDF generation may attach content from arbitrary files and URLs to the output document, even when url_fetcher is configured to block access. The issue’s root cause is in the PDF rendering logic that allows unintended inclus...

CVE-2025-68616

WeasyPrint CVE-2025-68616 describes a Server-Side Request Forgery (SSRF) protection bypass in the default_url_fetcher, allowing redirects via urllib to reach internal resources (e.g., localhost or cloud metadata) even when a developer blocks access with a custom url_fetcher. The issue affects Wea...