CVE-2025-68616
Description
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such as `localhost` services or cloud metadata endpoints) even when a developer has implemented a custom `url_fetcher` to block such access. This occurs because the underlying `urllib` library follows HTTP redirects automatically without re-validating the new destination against the developer's security policy. Version 68.0 contains a patch for the issue.
How to fix
- kozea weasyprint68.0 or later
- weasyprint68.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kozea weasyprint | v < 68.0 | 68.0 |
| weasyprintPyPI | v < 68.0 | 68.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.