Quick answers
- Is CVE-2024-28184 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2024-28184 being exploited in the wild.
- How severe is CVE-2024-28184?
- Low severity, with a CVSS score of 3.1, published 7 July 2026.
- Which products and versions are affected?
- Kozea Weasyprint 61.0, 61.1; weasyprint (PyPI) ECOSYSTEM:introduced=61.0,fixed=61.2.
- Is there a fix for CVE-2024-28184?
- Yes. weasyprint (PyPI): upgrade to 61.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2024-28184 attacked?
- It is attacked over the network.
- Am I affected by CVE-2024-28184?
- Check whether you run Kozea Weasyprint or weasyprint (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- weasyprint (PyPI): upgrade to 61.2 or later
pip install "weasyprint>=61.2"
Technical details
The vulnerability exists in WeasyPrint versions 61.0–61.1 and allows arbitrary file and URL attachment to PDF documents through HTML source, even when the url_fetcher parameter is configured to restrict such access. The vulnerability class is improper resource validation (CWE-829). An authenticated user or application that processes untrusted HTML can exploit this by embedding attachment directives in HTML that reference sensitive files or external URLs. The attack requires network access to the WeasyPrint application and the ability to influence the HTML source being converted. The vulnerability was fixed in version 61.2 (commit 734ee8e).
Affected products
- Kozea WeasyPrint 61.0, 61.1
Identifiers
- CVE-2024-28184
- GHSA-35jj-wx47-4w8r
- PYSEC-2026-2033
Timeline
- 2024-03-08: disclosed: GHSA-35jj-wx47-4w8r published
- 2024-03-08: patched: Fixed in version 61.2 (commit 734ee8e)
- 2024-03-09: other: CVE-2024-28184 published