Skip to content
Heist/ feed
High

WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Type: advisorySource: Official CVE List1 source record

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-controlled PostScript, which can produce interpreter-permitted effects and can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass. Hosts without Ghostscript do not reach this rasterization path. This issue is fixed in version 70.0.

Announced Source revision 1
Original source ↗

CVE-2026-106443

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-106443

WeasyPrint

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Kozea",
    "product": "WeasyPrint",
    "versions": [
      {
        "status": "affected",
        "version": "< 70.0"
      }
    ]
  }
]
Related CVEs
CVE-2026-106443

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#9540 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement