CVE-2026-106443

Name of the Vulnerable Software and Affected Versions WeasyPrint versions prior to 70.0

Description The image-loading path in weasyprint/images.py passes image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to the Pillow generic image dispatcher without excluding EPS or PostScript formats. On systems where Ghostscript is installed, the EpsImagePlugin in Pillow invokes the interpreter for attacker-controlled PostScript. This can lead to remote code execution if the installed Ghostscript version has a usable sandbox bypass. Systems without Ghostscript are not affected by this rasterization path.

Recommendations Update to version 70.0.