Hi,

The following vulnerability was published for weasyprint.

CVE-2026-55073[0]:
| WeasyPrint helps web developers to create PDF documents. Prior to
| 70.0, server-side applications that configure a restrictive
| url_fetcher and pass attacker-influenced values to HTML.write_pdf()
| can have the restriction bypassed through the xmp_metadata or
| stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls
| select_source() without the document url_fetcher, allowing an
| accessible local file to be read and embedded verbatim in the output
| PDF. In weasyprint/document.py, stylesheets constructs CSS() without
| the document url_fetcher, allowing local or internal resource
| loading and propagating the permissive fetcher through nested CSS
| imports and url() references. The stylesheets channel applies
| fetched resources but does not by itself disclose stylesheet
| comments verbatim. This issue is fixed in version 70.0.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-55073
https://www.cve.org/CVERecord?id=CVE-2026-55073
[1] https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v
[2] https://github.com/Kozea/WeasyPrint/commit/289e278439b017cd9263b4cd4727026987f86443

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
weasyprint, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148178@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexandre Detiste <tchet@debian.org> (supplier of updated weasyprint package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 08 Oct 2026 07:42:49 +0200
Source: weasyprint
Architecture: source
Version: 70.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Alexandre Detiste <tchet@debian.org>
Closes: 1148178 1150245
Changes:
 weasyprint (70.0-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version 70.0
     * CVE-2026-55073 input validation, secret disclosure (Closes: #1148178)
     * CVE-2026-106443 Ghostscript sandbox bypass (Closes: #1150245)
   * Build-depends on python3-flit instead of the whole 'flit' toolbox
   * Add debian/salsa-ci.yml
   * Drop 'Rules-Requires-Root: no': it is now the default
   * Rewrite d/watch in v5 format
Checksums-Sha1:
 f23e4969efbbb0a3075816b6e129237840e4d610 2316 weasyprint_70.0-1.dsc
 5ab628bf1bb4222061758a6b89a66caed8eefedd 1565482 weasyprint_70.0.orig.tar.gz
 5aad5b25f5848ed6325de9a7cb34d8a945a2d2cf 5460 weasyprint_70.0-1.debian.tar.xz
 f74d11ee37e1f8999705d8ed7ad8d3581b8018df 12080 weasyprint_70.0-1_source.buildinfo
Checksums-Sha256:
 84f9b9250a6402f94513002567260a27ad2337b6a622671c313032a4933db5a4 2316 weasyprint_70.0-1.dsc
 c263abf0e86c747b12af678b67f85f4abbfb97d18a20503031e7ba94e4b8cf8c 1565482 weasyprint_70.0.orig.tar.gz
 6a0edd51d78c85308f4e9bca891cecd127a4244123adc7d0d71587c1c2c1d85f 5460 weasyprint_70.0-1.debian.tar.xz
 83dff72e66002ce37ba76aa5c4256ac9e47eb6baca62cac7e796f83a30939b8e 12080 weasyprint_70.0-1_source.buildinfo
Files:
 79fd8d450340cf1e3fa6f7ff1a30e2fb 2316 text optional weasyprint_70.0-1.dsc
 bc6f55c033f3013f418f672991f4d754 1565482 text optional weasyprint_70.0.orig.tar.gz
 791fa320b7aec5778a15e96feba6d4a0 5460 text optional weasyprint_70.0-1.debian.tar.xz
 d77c7f13d6f28466ad932f6bba419fae 12080 text optional weasyprint_70.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmrHLh4RHHRjaGV0QGRl
Ymlhbi5vcmcACgkQMfMURUShdBpnfQ//a+2LC3moDOwEA+8cHE4NjipQi1T7pD0e
w6oA2ruaRGFOVtQDFXZl4dcmLLjjuco6yEw3kDQq+NQIAEYz58dWlMPf7T1e8UqY
lLE8lom/QCYCknUsDMJzAKUS0h7CR5Nxsw5JJTBqJieiAvA7qCclADnZUGf/xGSK
XsL93J/5cQ/4lwhSmn6YIZOpY3Oa9j2OCMharFT2ymr75tHm9K0zD7tAvFozuTZq
cFMinNClgBlocuvyZyqCjqNnbDIt02UwB+c7xw6S00aZnn4f1On8wZaYlNMTGHr8
ezqqAQD+nHYijBZoNfxlREWC/MT9ZNNWP54/bDknG4LDSUi/d0KKY29Lpi6NdT9k
2+fHun+g8fqdynorT/0rpNkh5dKkwVeEjA8M/x2U+t2nnmYwgJVfTiOfrI/NSak4
9n+aDXgSfc3S4L7XJT7eQssG+imL5AsyMAyLBvAqvqiYImb6S4YmVBBJ6bEo22+d
7L0KVM880LG951VKDgKtM7Tkd1cb2VDTf4+vYjRAdxl4vY3/59s7t6ZRgRLpZmR8
3k42oOYrgSx3gn5Ks44Cek+XzU+s8yotbHx1eflbq/+TZCYPCtK01Y8DfB2QkPz4
1cGbFEuMB2ucAJwWozm2mX14xYUdx0BvVMj+j+vbtzwPOcI09YSVUqFjYPlG0MfY
PX17qIbSs1k=
=Ejnn
-----END PGP SIGNATURE-----