High 8.8Published Oct 6, 2026

CVE-2026-106443WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Updated under an hour ago (2026-10-19 06:30 UTC)

Does this affect you?

It affects Kozea WeasyPrint. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.69%, higher than 52% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Kozea WeasyPrint

Exploited in the last 30 days

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-controlled PostScript, which can produce interpreter-permitted effects and can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass. Hosts without Ghostscript do not reach this rasterization path. This issue is fixed in version 70.0.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-20
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.69% (percentile 52)
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Oct 6, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Kozea WeasyPrint kozea:weasyprint (from the name)	before 70.0	CNA record

References

https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-r543-q48m-4c9jx-refsource-confirm
https://github.com/Kozea/WeasyPrint/commit/39cd37ce1610bd890388e26591c569db1cbab542x-refsource-misc
https://github.com/Kozea/WeasyPrint/releases/tag/v70.0x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.