WeasyPrint CVE-2026-106443

Requires WeasyPrint prior to 70.0 rendering attacker-controlled content (HTML img URLs, CSS image values, SVG image references, or data URIs) AND Ghostscript installed on the host - hosts without Ghostscript never reach the EPS rasterization path. With any Ghostscript present, attacker PostScript gains interpreter-permitted effects such as arbitrary file writes (demonstrated by the fix commit's dangerous.eps writing /tmp/test-marker.txt). Full remote code execution additionally requires the installed Ghostscript to have a usable sandbox (-dSAFER) bypass. Limiting factors: no user interaction needed, but exploitation is blocked entirely on hosts lacking Ghostscript, requires the application to pass untrusted image/URL content into WeasyPrint, and escalation from file-write to code execution is contingent on a bypassable Ghostscript version.

Signals mostly align toward a genuine priority but with important conditionality. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, 8.8 High) frames this as a network-reachable, low-complexity, low-privilege path to full confidentiality/integrity/availability loss. No EPSS score, CISA KEV entry, or standalone exploit flag was supplied, so widespread or confirmed active exploitation is NOT established - exploitation status is 'no public exploit identified at time of analysis' in the formal sense. However, the fix commit's test resources include a functional malicious PostScript payload (dangerous.eps) that writes a marker file, which is effectively public proof-of-concept material demonstrating the interpreter abuse. The headline risk (full RCE) is explicitly conditional: the description states it 'can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass,' and 'Hosts without Ghostscript do not reach this rasterization path.' So the real-world footprint is gated by (a) Ghostscript being installed and (b) that Ghostscript being bypassable. Conflict to flag: the CVSS AC:L understates the environmental dependency on Ghostscript presence and a usable sandbox bypass for the RCE outcome - I assess AC:H for the code-execution impact. Also, NVD uses PR:L (authenticated), but the vulnerability is triggered purely by attacker-controlled rendered content, which in many document-generation deployments requires no authentication to the library itself - verify the privilege assumption against your specific deployment. Net: treat as high priority for any WeasyPrint <70.0 service that (1) renders untrusted HTML/CSS/SVG and (2) has Ghostscript installed; lower priority where Ghostscript is absent.

An attacker submits HTML to a WeasyPrint-backed PDF generation service containing an image reference (img src, CSS image value, SVG image, or data URI) that points to a malicious EPS/PostScript file. On a host with Ghostscript installed, Pillow's EpsImagePlugin invokes the Ghostscript interpreter on the attacker's PostScript, enabling interpreter-permitted effects such as arbitrary file writes and, where the Ghostscript version has a usable sandbox bypass, remote code execution. A working proof-of-concept EPS payload that writes a marker file is included in the vendor fix commit's test resources (tests/resources/dangerous.eps).