PyPI/weasyprint CVE-2026-49452: medium 6.5, EPSS 0.37%

WeasyPrint has CSS Injection via Presentational Hints

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-jhhc-3hcp-qhm5
• https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5
• https://github.com/Kozea/WeasyPrint

CVE-2026-49452 · published 2026-07-06T17:29:53Z · modified 2026-07-13T16:42:26.449768536Z · JSON