CVE-2024-28184 json
WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
published 2y ago modified 2mo ago also EUVD-2024-0798 , GHSA-35jj-wx47-4w8r , PYSEC-2026-2033
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if `url_fetcher` is configured to prevent access to files and URLs. This vulnerability has been patched in version 61.2.
Patch / fix
- pypi weasyprint 61.2
- kozea weasyprint 61.2
- weasyprint Debian 14, Debian 13 61.2-1
debian advisories DEBIAN-CVE-2024-28184
Is CVE-2024-28184 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-28184 updated cvss 7.4
weasyprint: attaching content of arbitrary files and urls
-
Red Hat All currently supported Red Hat productsnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
| GitHub | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
| OSV | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | weasyprint | >=61.0, <61.2 |
61.2 |
Affected products
- Kozea WeasyPrint
Classification
- Weakness
-
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
References
-
github.com
/Kozea/WeasyPrint/commit/734ee8e2dc84ff3090682f3abff056d0907c8598
web, patch
-
github.com
/Kozea/WeasyPrint/security/advisories/GHSA-35jj-wx47-4w8r
web, vendor-advisory, advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/ZLQZMOEDY72TS43HDXOBVID2VYCTWIH6/
mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-28184
advisory
-
github.com
/Kozea/WeasyPrint
package
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/ZLQZMOEDY72TS43HDXOBVID2VYCTWIH6
web
-
pypi.org
/project/weasyprint
package
-
github.com
/advisories/GHSA-35jj-wx47-4w8r
advisory
Sources
- CVE List CVE-2024-28184
- GitHub Advisory GHSA-35jj-wx47-4w8r
- NVD CVE-2024-28184
- OSV PYSEC-2026-2033
- Maintainer advisory GHSA-35jj-wx47-4w8r
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of Kozea/WeasyPrint published their own advisory on GitHub. Reviewed sources take precedence over it.