CVE-2026-106443: WeasyPrint Remote Code Execution via EPS Image Processing
Summary
CVE-2026-106443: WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE. Affects weasyprint versions < 70.0. Fixed in 70.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
WeasyPrint is a popular open-source library in Python used for converting HTML and CSS documents into PDF files. It is widely utilized for generating documents in web applications due to its ability to handle complex layouts and styles. However, WeasyPrint has a vulnerability that allows untrusted EPS (Encapsulated PostScript) images to be processed without proper validation, potentially leading to severe security risks.
Vulnerability Detail
The vulnerability arises from WeasyPrint's handling of image inputs, where it directly passes fetched image bytes to Pillow's format dispatcher without validating the input format. If Ghostscript is installed on the host, this can lead to the execution of attacker-controlled PostScript code through the EPS/PS input. This flaw allows for remote code execution (RCE) on systems running vulnerable versions of Ghostscript, especially those with known -dSAFER bypasses. The lack of an allowlist for safe raster formats means that any input capable of supplying an image can exploit this vulnerability, making it critical for users to address.
How To Fix
Latest published version: 70.0.0 as of 23 Oct 2026
pip install --upgrade "weasyprint==70.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
70.0
This is the first release that contains the fix.
pip install --upgrade "weasyprint==70.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using EPS images in your WeasyPrint documents. Instead, use safer image formats such as PNG, JPEG, or WebP, which do not invoke external interpreters and are handled securely by WeasyPrint.
Conclusion
CVE-2026-106443 represents a significant security risk for WeasyPrint users, particularly those utilizing EPS images in environments with Ghostscript installed. It is crucial to update to the latest version of WeasyPrint to mitigate this vulnerability and ensure secure document rendering.
See every vulnerability recorded for weasyprint →
FAQ
CVE-2026-106443 is a vulnerability in WeasyPrint that allows remote code execution through untrusted EPS image processing when Ghostscript is installed.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Pipfile.lock without any signup.
The primary risk is remote code execution, which can allow attackers to execute arbitrary code on the server where WeasyPrint is running, potentially leading to data breaches or system compromise.
Yes, you can mitigate the risk by avoiding the use of EPS images in your documents and using safer formats like PNG or JPEG until you can update to the patched version.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for weasyprint.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
