https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T11:52:45.970918+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/brew-weasyprint-cve-2024-28184 BREW-weasyprint-CVE-2024-28184 — WeasyPrint allows the attachment of arbitrary files and URLs to a PDF 2026-10-09T11:52:45.973069+00:00

Affected: Homebrew: weasyprint

### Impact Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs.

### Patches Fixed by 734ee8e that’s included in 61.2

### Workarounds - Check that no PDF attachment is defined in source HTML. - Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.

 https://cve.radiocsirt.org/vuln/cve-2024-28184 CVE-2024-28184 — WeasyPrint allows the attachment of arbitrary files and URLs to a PDF 2026-10-09T11:52:45.973125+00:00

Affected: Kozea WeasyPrint

WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.

 https://cve.radiocsirt.org/vuln/ghsa-35jj-wx47-4w8r GHSA-35jj-wx47-4w8r — WeasyPrint allows the attachment of arbitrary files and URLs to a PDF 2026-10-09T11:52:45.973155+00:00

Affected: PyPI: weasyprint

### Impact Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs.

### Patches Fixed by 734ee8e that’s included in 61.2

### Workarounds - Check that no PDF attachment is defined in source HTML. - Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.