Executive brief
WeasyPrint, a library used to convert HTML and CSS into PDF documents, contains a security flaw that allows attackers to bypass network restrictions. By using specially crafted web addresses that redirect to internal systems, an attacker can trick the software into accessing private data, such as internal server information or cloud credentials, that it was supposed to be blocked from reaching. This could lead to the exposure of sensitive internal business data or unauthorized access to cloud infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in WeasyPrint's 'default_url_fetcher' component due to a Time-of-Check to Time-of-Use (TOCTOU) flaw. While developers can implement custom 'url_fetcher' functions to validate URLs, the underlying Python 'urllib.request.urlopen' library automatically follows HTTP redirects (3xx status codes) without re-invoking the validation logic for the new destination. A remote attacker can provide a benign-looking URL that passes initial checks but redirects to sensitive internal resources like localhost services or cloud metadata endpoints (169.254.169.254). This vulnerability is addressed in version 68.0.
Affected products
- Kozea WeasyPrint < 68.0
Timeline
- 2026-01-19: disclosed
- 2026-01-19: patched: Fixed in version 68.0
- 2026-01-20: advisory