CVE-2024-28184High· 7.4▾ Twilight

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 40.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 8, 2024

Updated

Sep 10, 2026

CVSS

7.4

Vendor

weasyprint

Product

weasyprint

CWE

—

Depth score

41 · Moderate

EPSS

0.74% · p54

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

0.6% → 0.7%▲ 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 935 days

Mar 8, 2024Published
Disclosed via OSV
Jul 30, 2026EPSS first tracked
0.6%
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 29, 2026EPSS peak
0.6% → 0.7%

weasyprint #osv #pip

Affected

weasyprint >= 61.0, < 61.2

Patched in

weasyprint 61.2

Full technical detail▾

Overview

Impact

Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs.

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

Check that no PDF attachment is defined in source HTML.
Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

Affected packages

weasyprint >= 61.0, < 61.2

Remediation

Upgrade to a patched release:

weasyprint 61.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip

← Back to feed

CVE-2024-28184High· 7.4▾ Twilight

WeasyPrint allows the attachment of arbitrary files and URLs to a PDF

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 40.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 8, 2024

Updated

Sep 10, 2026

CVSS

7.4

Vendor

weasyprint

Product

weasyprint

CWE

—

Depth score

41 · Moderate

EPSS

0.74% · p54

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Jul 30.

0.6% → 0.7%▲ 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 935 days

Mar 8, 2024Published
Disclosed via OSV
Jul 30, 2026EPSS first tracked
0.6%
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 29, 2026EPSS peak
0.6% → 0.7%

weasyprint #osv #pip

Affected

weasyprint >= 61.0, < 61.2

Patched in

weasyprint 61.2

Full technical detail▾

Overview

Impact

Patches

Fixed by 734ee8e that’s included in 61.2

Workarounds

Check that no PDF attachment is defined in source HTML.
Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

Affected packages

weasyprint >= 61.0, < 61.2

Remediation

Upgrade to a patched release:

weasyprint 61.2

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#pip