CVE-2026-106443

8.8 HIGHpublic exploit available

Published 2026-10-06 · Updated 2026-10-06

AI risk analysis

Summary: The flaw allows attackers to execute arbitrary code via PostScript files when Ghostscript is installed, due to improper handling of EPS and PostScript formats in WeasyPrint.
Exploitability: Exploitation is moderately hard and requires Ghostscript to be installed on the host.
Blast radius: If exploited, this could lead to full remote code execution on the affected system.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to WeasyPrint 70.0 or later.

rceghostscriptweasyprintpostscriptepspdf

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

WeasyPrint helps web developers to create PDF documents. Prior to 70.0, the image-loading path in weasyprint/images.py passes fetched image bytes from HTML img URLs, CSS image values, SVG image references, and data URIs to Pillow's generic image dispatcher without excluding EPS or PostScript formats. On hosts with Ghostscript installed, Pillow EpsImagePlugin invokes the interpreter for attacker-controlled PostScript, which can produce interpreter-permitted effects and can lead to remote code execution when the installed Ghostscript version has a usable sandbox bypass. Hosts without Ghostscript do not reach this rasterization path. This issue is fixed in version 70.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.