CVE-2026-49452

Name of the Vulnerable Software and Affected Versions WeasyPrint (affected versions not specified)

Description A CSS injection issue occurs when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing the injection of arbitrary CSS declarations. This specifically affects the background attribute used to construct CSS, which is then parsed by the tinycss2.parse blocks contents() function. An attacker can exploit this by providing crafted HTML input to trigger server-side requests via injected url() declarations.

Recommendations Escape attribute values before embedding them into CSS. Restrict allowed values for presentational hints. As a temporary mitigation, disable the presentational hints feature by setting it to False.