CVE-2024-28184: Arbitrary File Attachment in WeasyPrint PDF Generation
Summary
CVE-2024-28184: WeasyPrint allows the attachment of arbitrary files and URLs to a PDF. Affects weasyprint versions >= 61.0, < 61.2. Fixed in 61.2. How to fix ↓
Also tracked for
- weasyprint · Debian:13
The same CVE-2024-28184 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WeasyPrint is a Python library that allows the generation of PDF documents from HTML and CSS. It provides a convenient way to convert web pages into PDF format. However, versions 61.0 to 61.1 of WeasyPrint are vulnerable to an arbitrary file attachment issue. This vulnerability allows an attacker to attach the content of arbitrary files and URLs to a generated PDF document, even if the 'url_fetcher' is configured to prevent access to files and URLs.
Vulnerability Detail
The vulnerability in WeasyPrint arises from a flaw in the PDF generation process. It allows an attacker to bypass security measures and attach arbitrary files or URLs to the resulting PDF document. This can lead to various security risks, such as the inclusion of malicious content or the exposure of sensitive information. The vulnerability has a CVSS score of 7.4, indicating a high severity level.
How To Fix
Latest published version: 70.0.0 as of 23 Oct 2026
pip install --upgrade "weasyprint==70.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
61.2
This is the first release that contains the fix.
pip install --upgrade "weasyprint==61.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating WeasyPrint is not immediately feasible, there are a couple of workarounds that can mitigate the risk. Firstly, it is important to check that no PDF attachment is defined in the source HTML. Additionally, launching WeasyPrint in a sandbox environment that restricts access to the filesystem and network can prevent exploitation of this vulnerability.
Conclusion
The vulnerability in WeasyPrint allows the attachment of arbitrary files and URLs to a generated PDF document, bypassing security measures. To mitigate this risk, it is crucial to update WeasyPrint to version 61.2 or later. Alternatively, implementing the suggested workarounds can provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for weasyprint →
FAQ
WeasyPrint is a Python library used for generating PDF documents from HTML and CSS. It provides a convenient way to convert web pages into PDF format.
The vulnerability allows an attacker to attach arbitrary files and URLs to a generated PDF document, bypassing security measures. This can lead to the inclusion of malicious content or the exposure of sensitive information.
To fix this vulnerability, update WeasyPrint to version 61.2 or later. This will ensure that the vulnerability is patched and no longer exploitable.
If immediate updating is not possible, ensure that no PDF attachment is defined in the source HTML. Additionally, launch WeasyPrint in a sandbox environment that restricts access to the filesystem and network.
The vulnerability has a CVSS score of 7.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weasyprint.
