{"items":[{"id":"NVI-00017688","kind":"vulnerability","title":"WeasyPrint has CSS Injection via Presentational Hints","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-jhhc-3hcp-qhm5","CVE-2026-49452"],"plain_summary":"GitHub lists this reviewed advisory for weasyprint. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-47518db702d6ab65fc32c09c39a8b5fc"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-06T17:29:54.000Z","value":"6.5 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-47518db702d6ab65fc32c09c39a8b5fc"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-47518db702d6ab65fc32c09c39a8b5fc","url":"https://github.com/advisories/GHSA-jhhc-3hcp-qhm5","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-jhhc-3hcp-qhm5","publisher":"GitHub Advisory Database","observed_at":"2026-11-04T23:36:01.427Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-47518db702d6ab65fc32c09c39a8b5fc"],"technology":"weasyprint","known_exclusions":[],"conditions_summary":"### Summary\nA CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.\n\n### Details\nFile: weasyprint/css/__init__.py\n\nThe `background` attribute is used to construct CSS:\n\nbackground-image:url({element.get(\"background\")})\n\nThis string is parsed by `tinycss2.parse_blocks_contents()`.\n\nBecause the value is not escaped, additional CSS declarations can be injected.\n\n### PoC\n\n\n### Impact\n- CSS injection\n- Server-side requests via injected `url()`\n- Limited to cases where `presentational_hints=True`\n\n### Suggested Fix\n- Escape attribute values before embedding into CSS\n- Restrict allowed values for presentational hints\nVULN-05_css_injection_presentational_hints.md","public_affected_ranges":["<= 68.1"]}],"null_published_at":"2026-11-05T19:10:21.451Z","source_updated_at":"2026-07-06T17:29:54.000Z","source_disclosed_at":"2026-07-06T17:29:53.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-04T23:36:01.427Z"}],"next_cursor":null,"snapshot_revision":"42594"}