CVE-2026-49452 Kozea CVE debrief

Who should care

Defenders responsible for WeasyPrint deployments, especially those rendering untrusted HTML with presentational hints enabled, should assess exposure and consider upgrades or mitigations.

Why it matters

CVE-2026-49452 is a CSS injection vulnerability in WeasyPrint that allows untrusted HTML to inject additional CSS declarations, potentially leading to server-side requests and unauthorized access. Defenders should prioritize verifying exposure in WeasyPrint deployments, especially where untrusted HTML is rendered with presentational hints enabled, and assess the need for upgrades or mitigations.

• Potential CSS injection and server-side requests through injected url() values
• Possible unauthorized access or data leakage through CSS injection
• Need for verification of WeasyPrint version and exposure
• Potential for denial-of-service or other unintended behavior

Technical summary

WeasyPrint embeds unescaped HTML presentational-hint attribute values into CSS, allowing CSS injection and potential server-side requests through injected url() values. Applications rendering untrusted HTML with presentational hints enabled may be affected. The vulnerability is fixed in WeasyPrint version 69.0. Defenders should prioritize verifying exposure in WeasyPrint deployments, especially where untrusted HTML is rendered with presentational hints enabled, and assess the need for upgrades or mitigations. The issue involves the background attribute being inserted into a background-image:url() declaration and parsed by tinycss2.parse_blocks_contents().

Defensive priority

Defenders should prioritize verifying exposure in WeasyPrint deployments, especially where untrusted HTML is rendered with presentational hints enabled, and assess the need for upgrades or mitigations.

Recommended defensive actions

• Verify WeasyPrint version and assess exposure
• Evaluate the use of presentational hints in untrusted HTML rendering
• Consider upgrading to WeasyPrint version 69.0 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, specific details about exploitation or victim impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.