CVE-2026-49452: WeasyPrint has CSS Injection via Presentational Hints

July 6, 2026

A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.

References

github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5
github.com/advisories/GHSA-jhhc-3hcp-qhm5
nvd.nist.gov/vuln/detail/CVE-2026-49452

Code Behaviors & Features

Detect and mitigate CVE-2026-49452 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →