PYSEC-2026-3412

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/weasyprint/PYSEC-2026-3412.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3412
Aliases
Published
2026-07-13T15:46:28Z
Modified
2026-07-13T16:33:27Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
WeasyPrint has CSS Injection via Presentational Hints
Details

Summary

A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

Details

File: weasyprint/css/init.py

The background attribute is used to construct CSS:

background-image:url({element.get("background")})

This string is parsed by tinycss2.parse_blocks_contents().

Because the value is not escaped, additional CSS declarations can be injected.

PoC

Impact

  • CSS injection
  • Server-side requests via injected url()
  • Limited to cases where presentational_hints=True

Suggested Fix

References

Affected packages

PyPI / weasyprint

Package

Name
weasyprint
View open source insights on deps.dev
Purl
pkg:pypi/weasyprint

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
68.1

Affected versions

0.*
0.1
0.2
0.2.1
0.2.2
0.3
0.3.1
0.4
0.5
0.6
0.6.1
0.7
0.7.1
0.8
0.9
0.10
0.11
0.12
0.13
0.14
0.15
0.16
0.17
0.17.1
0.18
0.19
0.19.1
0.19.2
0.20
0.20.1
0.20.2
0.21
0.22
0.23
0.24
0.25
0.26
0.27
0.28
0.29
0.30
0.31
0.32
0.33
0.34
0.35
0.36
0.37
0.38
0.39
0.40
0.41
0.42
0.42.1
0.42.2
0.42.3
Other
43rc1
43rc2
43
44
45
46
47
48
49
50
51
52
52.*
52.1
52.2
52.3
52.4
52.5
53.*
53.0b1
53.0b2
53.0
53.1
53.2
53.3
53.4
54.*
54.0b1
54.0
54.1
54.2
54.3
55.*
55.0b1
55.0
56.*
56.0b1
56.0
56.1
57.*
57.0b1
57.0
57.1
57.2
58.*
58.0b1
58.0
58.1
59.*
59.0b1
59.0
60.*
60.0
60.1
60.2
61.*
61.0
61.1
61.2
62.*
62.0
62.1
62.2
62.3
63.*
63.0
63.1
64.*
64.0
64.1
65.*
65.0
65.1
66.*
66.0
67.*
67.0
68.*
68.0
68.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/weasyprint/PYSEC-2026-3412.yaml"