GHSA-35jj-wx47-4w8r

Suggest an improvement
Source
https://github.com/advisories/GHSA-35jj-wx47-4w8r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-35jj-wx47-4w8r/GHSA-35jj-wx47-4w8r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-35jj-wx47-4w8r
Aliases
Published
2024-03-08T20:42:52Z
Modified
2026-09-10T03:50:10Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
Details

Impact

Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

  • Check that no PDF attachment is defined in source HTML.
  • Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.
Database specific 
{
    "cwe_ids":  [
        "CWE-829"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-03-08T20:42:52Z",
    "nvd_published_at":  "2024-03-09T01:15:07Z",
    "severity":  "HIGH"
}
References

Affected packages

PyPI / weasyprint

Package

Name
weasyprint
View open source insights on deps.dev
Purl
pkg:pypi/weasyprint

Affected ranges

Type
ECOSYSTEM
Events
Introduced
61.0
Fixed
61.2

Affected versions

61.*
61.0
61.1

Database specific

last_known_affected_version_range 
"<= 61.1"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-35jj-wx47-4w8r/GHSA-35jj-wx47-4w8r.json"