kfickel/cv
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

chore(deps): update dependency weasyprint to v69 [security] #10

Merged
kfickel merged 1 commit from renovate/pypi-weasyprint-vulnerability into main 2026-07-30 21:20:51 +02:00
Conversation 0 Commits 1 Files changed 1 +3 -3
renovate-bot commented 2026-07-07 02:01:34 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
weasyprint (changelog) 68.1 → 69.0 age confidence

WeasyPrint has CSS Injection via Presentational Hints

CVE-2026-49452 / GHSA-jhhc-3hcp-qhm5 / PYSEC-2026-3412

More information

Details

Summary

A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

Details

File: weasyprint/css/init.py

The background attribute is used to construct CSS:

background-image:url({element.get("background")})

This string is parsed by tinycss2.parse_blocks_contents().

Because the value is not escaped, additional CSS declarations can be injected.

PoC
Impact
  • CSS injection
  • Server-side requests via injected url()
  • Limited to cases where presentational_hints=True
Suggested Fix

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

WeasyPrint has CSS Injection via Presentational Hints

CVE-2026-49452 / GHSA-jhhc-3hcp-qhm5 / PYSEC-2026-3412

More information

Details

Summary

A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

Details

File: weasyprint/css/init.py

The background attribute is used to construct CSS:

background-image:url({element.get("background")})

This string is parsed by tinycss2.parse_blocks_contents().

Because the value is not escaped, additional CSS declarations can be injected.

PoC
Impact
  • CSS injection
  • Server-side requests via injected url()
  • Limited to cases where presentational_hints=True
Suggested Fix

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by OSV and the PyPI Advisory Database (CC-BY 4.0).

Release Notes

Kozea/WeasyPrint (weasyprint)

v69.0

Compare Source

This is a security update (CVE-2026-49452).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the --presentational-hints option and render untrusted HTML with restricted CSS properties.

Read about this release on our blog.

Security

  • Avoid CSS injection with HTML presentational hints.

Command-line API

  • The --srgb option has been replaced by --output-intent=srgb. Other values are possible: device-cmyk for CMYK documents with no ICC profile, or the CSS identifier of a @color-profile rule.

Python API

  • The output_intent string entry replaces the srgb boolean in default options.

Features

Bug fixes

  • #​2697, #​2691: Avoid endless loops in grids
  • #​2709: Be less strict for gradient rasterization in tests
  • #​2683: Fix rendering of emojis in SVG
  • #​2688: Always describe font using absolute sizes
  • #​2676: Fix inheritance for svg/symbol tags referenced by use tags
  • #​2681: Add dc:description field to PDF/A metadata
  • #​2680: Force first grid row rendering on empty pages
  • #​2690: Compute units in gradients used in border background
  • #​2689: Cut flex elements with fixed height and overflowing children
  • #​2651, #​2696: Fix tests on Debian
  • #​2698, #​2699: Fix alignment of right-to-left elements with auto width and set min/max-width
  • #​2556: Apply presentational hints to svg tags
  • #​2706: Handle infinite border radii
  • #​2707, #​2708, #​2710: Get mimetypes from Python code instead of various third-party files
  • #​2717, #​2580, #​2740: Fix table break retry after padding overflow
  • #​2769: Add year in PDF/UA-2 metadata
  • #​2768: Allow SVG lists of numbers to be split on + character
  • #​2770: Add namespace to Document tag in PDF 2
  • #​2771: Never try to render SVG use tags with external sources
  • #​2774: Fix calc in logical
  • #​2791: Improve management of variables

Documentation

  • #​2703, #​2733: Document command-line option for papersize and orientation

Contributors

  • Guillaume Ayoub
  • Nils K
  • Rob
  • Daniel Fitzpatrick
  • Elango Subramani
  • Lucie Anglade
  • Markus Mohanty
  • Tomsgu
  • arjenzorgdoc

Backers and sponsors

  • Spacinov
  • Syslifters
  • Kobalt
  • Grip Angebotssoftware
  • Simonsoft
  • Menutech
  • KontextWork
  • TrainingSparkle
  • Healthchecks.io
  • Method B
  • FieldHub
  • Hammerbacher
  • Yanal-Yves Fargialla
  • Prothesis Dental Solutions
  • Morntag
  • Xavid
  • Charlie S.
  • PDFBolt
  • Kai DeLorenzo

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [weasyprint](https://github.com/Kozea/WeasyPrint) ([changelog](https://github.com/Kozea/WeasyPrint/releases)) | `68.1` → `69.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/weasyprint/69.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/weasyprint/68.1/69.0?slim=true) | --- ### WeasyPrint has CSS Injection via Presentational Hints [CVE-2026-49452](https://nvd.nist.gov/vuln/detail/CVE-2026-49452) / [GHSA-jhhc-3hcp-qhm5](https://github.com/advisories/GHSA-jhhc-3hcp-qhm5) / PYSEC-2026-3412 <details> <summary>More information</summary> #### Details ##### Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input. ##### Details File: weasyprint/css/__init__.py The `background` attribute is used to construct CSS: background-image:url({element.get("background")}) This string is parsed by `tinycss2.parse_blocks_contents()`. Because the value is not escaped, additional CSS declarations can be injected. ##### PoC <body background="x);background-image:url(http://169.254.169.254/latest/meta-data/)"> ##### Impact - CSS injection - Server-side requests via injected `url()` - Limited to cases where `presentational_hints=True` ##### Suggested Fix - Escape attribute values before embedding into CSS - Restrict allowed values for presentational hints [VULN-05_css_injection_presentational_hints.md](https://github.com/user-attachments/files/26370718/VULN-05_css_injection_presentational_hints.md) #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N` #### References - [https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5](https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5) - [https://github.com/Kozea/WeasyPrint](https://github.com/Kozea/WeasyPrint) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-jhhc-3hcp-qhm5) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### WeasyPrint has CSS Injection via Presentational Hints [CVE-2026-49452](https://nvd.nist.gov/vuln/detail/CVE-2026-49452) / [GHSA-jhhc-3hcp-qhm5](https://github.com/advisories/GHSA-jhhc-3hcp-qhm5) / PYSEC-2026-3412 <details> <summary>More information</summary> #### Details ##### Summary A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input. ##### Details File: weasyprint/css/__init__.py The `background` attribute is used to construct CSS: background-image:url({element.get("background")}) This string is parsed by `tinycss2.parse_blocks_contents()`. Because the value is not escaped, additional CSS declarations can be injected. ##### PoC <body background="x);background-image:url(http://169.254.169.254/latest/meta-data/)"> ##### Impact - CSS injection - Server-side requests via injected `url()` - Limited to cases where `presentational_hints=True` ##### Suggested Fix - Escape attribute values before embedding into CSS - Restrict allowed values for presentational hints [VULN-05_css_injection_presentational_hints.md](https://github.com/user-attachments/files/26370718/VULN-05_css_injection_presentational_hints.md) #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N` #### References - [https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5](https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5) - [https://github.com/Kozea/WeasyPrint](https://github.com/Kozea/WeasyPrint) - [https://pypi.org/project/weasyprint](https://pypi.org/project/weasyprint) - [https://github.com/advisories/GHSA-jhhc-3hcp-qhm5](https://github.com/advisories/GHSA-jhhc-3hcp-qhm5) - [https://nvd.nist.gov/vuln/detail/CVE-2026-49452](https://nvd.nist.gov/vuln/detail/CVE-2026-49452) This data is provided by [OSV](https://osv.dev/vulnerability/PYSEC-2026-3412) and the [PyPI Advisory Database](https://github.com/pypa/advisory-database) ([CC-BY 4.0](https://github.com/pypa/advisory-database/blob/main/LICENSE)). </details> --- ### Release Notes <details> <summary>Kozea/WeasyPrint (weasyprint)</summary> ### [`v69.0`](https://github.com/Kozea/WeasyPrint/releases/tag/v69.0) [Compare Source](https://github.com/Kozea/WeasyPrint/compare/v68.1...v69.0) **This is a security update (CVE-2026-49452).** We strongly recommend to upgrade WeasyPrint to the latest version if you use the `--presentational-hints` option and render untrusted HTML with restricted CSS properties. Read about this release [on our blog](https://www.courtbouillon.org/blog/00067-weasyprint-69/). #### Security - Avoid CSS injection with HTML presentational hints. #### Command-line API - The `--srgb` option has been replaced by `--output-intent=srgb`. Other values are possible: `device-cmyk` for CMYK documents with no ICC profile, or the CSS identifier of a `@color-profile` rule. #### Python API - The `output_intent` string entry replaces the `srgb` boolean in default options. #### Features - [#&#8203;2357](https://github.com/Kozea/WeasyPrint/issues/2357), [#&#8203;2700](https://github.com/Kozea/WeasyPrint/pull/2700): Support logical properties - [#&#8203;1194](https://github.com/Kozea/WeasyPrint/issues/1194), [#&#8203;2702](https://github.com/Kozea/WeasyPrint/pull/2702): Support viewport units - [#&#8203;2686](https://github.com/Kozea/WeasyPrint/issues/2686): Detect redirection loops early in URL fetcher - [#&#8203;2735](https://github.com/Kozea/WeasyPrint/issues/2735), [#&#8203;2737](https://github.com/Kozea/WeasyPrint/pull/2737): Support SVG transform angle units - [#&#8203;2636](https://github.com/Kozea/WeasyPrint/issues/2636), [#&#8203;2720](https://github.com/Kozea/WeasyPrint/pull/2720), [#&#8203;2773](https://github.com/Kozea/WeasyPrint/pull/2773): Use HTML parsers for presentational hints - [#&#8203;2631](https://github.com/Kozea/WeasyPrint/issues/2631), [#&#8203;2778](https://github.com/Kozea/WeasyPrint/pull/2778), [#&#8203;2785](https://github.com/Kozea/WeasyPrint/issues/2785), [#&#8203;2788](https://github.com/Kozea/WeasyPrint/pull/2788): Allow users to set PDF output intent #### Bug fixes - [#&#8203;2697](https://github.com/Kozea/WeasyPrint/issues/2697), [#&#8203;2691](https://github.com/Kozea/WeasyPrint/pull/2691): Avoid endless loops in grids - [#&#8203;2709](https://github.com/Kozea/WeasyPrint/pull/2709): Be less strict for gradient rasterization in tests - [#&#8203;2683](https://github.com/Kozea/WeasyPrint/issues/2683): Fix rendering of emojis in SVG - [#&#8203;2688](https://github.com/Kozea/WeasyPrint/pull/2688): Always describe font using absolute sizes - [#&#8203;2676](https://github.com/Kozea/WeasyPrint/issues/2676): Fix inheritance for svg/symbol tags referenced by use tags - [#&#8203;2681](https://github.com/Kozea/WeasyPrint/pull/2681): Add dc:description field to PDF/A metadata - [#&#8203;2680](https://github.com/Kozea/WeasyPrint/issues/2680): Force first grid row rendering on empty pages - [#&#8203;2690](https://github.com/Kozea/WeasyPrint/issues/2690): Compute units in gradients used in border background - [#&#8203;2689](https://github.com/Kozea/WeasyPrint/issues/2689): Cut flex elements with fixed height and overflowing children - [#&#8203;2651](https://github.com/Kozea/WeasyPrint/issues/2651), [#&#8203;2696](https://github.com/Kozea/WeasyPrint/pull/2696): Fix tests on Debian - [#&#8203;2698](https://github.com/Kozea/WeasyPrint/issues/2698), [#&#8203;2699](https://github.com/Kozea/WeasyPrint/pull/2699): Fix alignment of right-to-left elements with auto width and set min/max-width - [#&#8203;2556](https://github.com/Kozea/WeasyPrint/issues/2556): Apply presentational hints to svg tags - [#&#8203;2706](https://github.com/Kozea/WeasyPrint/issues/2706): Handle infinite border radii - [#&#8203;2707](https://github.com/Kozea/WeasyPrint/issues/2707), [#&#8203;2708](https://github.com/Kozea/WeasyPrint/pull/2708), [#&#8203;2710](https://github.com/Kozea/WeasyPrint/pull/2710): Get mimetypes from Python code instead of various third-party files - [#&#8203;2717](https://github.com/Kozea/WeasyPrint/issues/2717), [#&#8203;2580](https://github.com/Kozea/WeasyPrint/issues/2580), [#&#8203;2740](https://github.com/Kozea/WeasyPrint/pull/2740): Fix table break retry after padding overflow - [#&#8203;2769](https://github.com/Kozea/WeasyPrint/pull/2769): Add year in PDF/UA-2 metadata - [#&#8203;2768](https://github.com/Kozea/WeasyPrint/issues/2768): Allow SVG lists of numbers to be split on + character - [#&#8203;2770](https://github.com/Kozea/WeasyPrint/pull/2770): Add namespace to Document tag in PDF 2 - [#&#8203;2771](https://github.com/Kozea/WeasyPrint/pull/2771): Never try to render SVG use tags with external sources - [#&#8203;2774](https://github.com/Kozea/WeasyPrint/pull/2774): Fix calc in logical - [#&#8203;2791](https://github.com/Kozea/WeasyPrint/pull/2791): Improve management of variables #### Documentation - [#&#8203;2703](https://github.com/Kozea/WeasyPrint/issues/2703), [#&#8203;2733](https://github.com/Kozea/WeasyPrint/pull/2733): Document command-line option for papersize and orientation #### Contributors - Guillaume Ayoub - Nils K - Rob - Daniel Fitzpatrick - Elango Subramani - Lucie Anglade - Markus Mohanty - Tomsgu - arjenzorgdoc #### Backers and sponsors - Spacinov - Syslifters - Kobalt - Grip Angebotssoftware - Simonsoft - Menutech - KontextWork - TrainingSparkle - Healthchecks.io - Method B - FieldHub - Hammerbacher - Yanal-Yves Fargialla - Prothesis Dental Solutions - Morntag - Xavid - Charlie S. - PDFBolt - Kai DeLorenzo </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI1OS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
chore(deps): update dependency weasyprint to v69 [security]
All checks were successful
Continuous Integration / Lint, Check & Test (push) Successful in 2m17s
Details
Continuous Integration / Build Package (push) Successful in 8s
Details
8999bca681
renovate-bot force-pushed renovate/pypi-weasyprint-vulnerability from 8999bca681
All checks were successful
Continuous Integration / Lint, Check & Test (push) Successful in 2m17s
Details
Continuous Integration / Build Package (push) Successful in 8s
Details
to bfd240f59e
All checks were successful
Continuous Integration / Build Package (push) Successful in 1m18s
Details
Continuous Integration / Lint, Check & Test (push) Successful in 1m30s
Details
2026-07-22 02:01:35 +02:00 Compare
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
kfickel/cv!10
No description provided.