MEDIUM 6.2 GitHub
CVE-2026-55073
weasyprint Has Server-Side Request Forgery (SSRF)
## Summary
`url_fetcher` is WeasyPrint's documented mechanism for restricting resource loading - applications use it to block `file://`, internal hosts, etc. when rendering untrusted input.
Two `write_pdf()` channels ignore the document's `url_fetcher` and build a fresh default `URLFetcher()` instead. A restrictive fetcher set on `HTML()` is silently bypassed for:
- **`xmp_metadata=[url]`** - the URL is fetched and the bytes are embedded verbatim in the output PDF. This is an **arbitrary loca
Affected Products
- pip/weasyprint < 70.0
References
- https://github.com/advisories/GHSA-jf6q-chmf-3h3v
- https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v
- https://github.com/Kozea/WeasyPrint/releases/tag/v70.0
- https://github.com/advisories/GHSA-jf6q-chmf-3h3v
This medium severity vulnerability with a CVSS score of 6.2 was published on 2026-09-09 via GitHub. Affected: pip/weasyprint < 70.0.
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.