WeasyPrint has CSS Injection via Presentational Hints
A CSS injection issue exists in WeasyPrint when HTML presentational hints are enabled. Unescaped attribute values are embedded into CSS, allowing injection of arbitrary CSS declarations. This affects applications processing untrusted HTML input.
File: weasyprint/css/init.py
The background attribute is used to construct CSS:
background-image:url({element.get("background")})
This string is parsed by tinycss2.parse_blocks_contents().
Because the value is not escaped, additional CSS declarations can be injected.
url()presentational_hints=TrueWhy this VPI (explainable, experimental)
VPI breakdown
| Impact | 65.00 |
| Exploitation signal(No additional exploitation signal) | ×1.00 |
| VPI | 65.00 |
VPI formula vpi-v1