Summary
WeasyPrint may pass attacker-controlled image data to Pillow without excluding EPS or PostScript formats. When Ghostscript is installed, processing such content may invoke the interpreter and could enable remote code execution if the installed Ghostscript environment is vulnerable to a sandbox bypass.
WeasyPrint may pass attacker-controlled image data to Pillow without excluding EPS or PostScript formats. When Ghostscript is installed, processing such content may invoke the interpreter and could enable remote code execution if the installed Ghostscript environment is vulnerable to a sandbox bypass.
Affected context
The issue occurs in WeasyPrint's image-loading paths when images are supplied through HTML image URLs, CSS image values, SVG image references, or data URIs. Risk depends on whether untrusted document content can be rendered and whether Pillow can invoke Ghostscript on the host; systems without Ghostscript do not reach this interpreter-backed rasterization path.
The issue occurs in WeasyPrint's image-loading paths when images are supplied through HTML image URLs, CSS image values, SVG image references, or data URIs. Risk depends on whether untrusted document content can be rendered and whether Pillow can invoke Ghostscript on the host; systems without Ghostscript do not reach this interpreter-backed rasterization path.
Exploit preconditions
- Attack surface: Document rendering through WeasyPrint
- Required access: Ability to provide or influence HTML, CSS, SVG, or data-URI image content
- Trigger point: Image loading and format dispatch during PDF generation
- Environmental dependency: Ghostscript must be installed and available to Pillow
- Why exploitation is possible: EPS or PostScript content is not excluded before being passed to a generic image dispatcher, allowing interpreter processing under applicable host conditions
- Attack surface: Document rendering through WeasyPrint
- Required access: Ability to provide or influence HTML, CSS, SVG, or data-URI image content
- Trigger point: Image loading and format dispatch during PDF generation
- Environmental dependency: Ghostscript must be installed and available to Pillow
- Why exploitation is possible: EPS or PostScript content is not excluded before being passed to a generic image dispatcher, allowing interpreter processing under applicable host conditions
Why this happens
The underlying bug is insufficient validation of image formats at a trust boundary. WeasyPrint forwards image bytes to Pillow's generic dispatcher without restricting interpreter-backed EPS and PostScript formats. Pillow may then invoke Ghostscript, causing content that should be treated as image data to be interpreted as executable document instructions. This behavior maps to CWE-20, Improper Input Validation.
The underlying bug is insufficient validation of image formats at a trust boundary. WeasyPrint forwards image bytes to Pillow's generic dispatcher without restricting interpreter-backed EPS and PostScript formats. Pillow may then invoke Ghostscript, causing content that should be treated as image data to be interpreted as executable document instructions. This behavior maps to CWE-20, Improper Input Validation.
Potential impact
- An attacker may execute code with the privileges of the rendering process.
- A compromised renderer could expose local files or environment data.
- The affected host or service could be disrupted or used for further access.
- In shared environments, compromise could enable lateral movement or data exposure.
- An attacker may execute code with the privileges of the rendering process.
- A compromised renderer could expose local files or environment data.
- The affected host or service could be disrupted or used for further access.
- In shared environments, compromise could enable lateral movement or data exposure.
General mitigation guidance
Mitigation generally focuses on reducing trust in document-supplied media and
preventing unsafe interpreter-backed formats from reaching image processing
components.
Common defensive patterns include:
- Allowlisting supported raster image formats rather than accepting arbitrary formats.
- Rejecting EPS, PostScript, and other interpreter-backed content before dispatch.
- Validating file signatures and decoded format metadata, not only file extensions or MIME types.
- Isolating document rendering in a sandbox with minimal filesystem, network, and process privileges.
- Avoiding unnecessary Ghostscript installation in environments that do not require it.
- Applying least-privilege service accounts and restricting access to secrets and host resources.
Mitigation generally focuses on reducing trust in document-supplied media and
preventing unsafe interpreter-backed formats from reaching image processing
components.
Common defensive patterns include:
- Allowlisting supported raster image formats rather than accepting arbitrary formats.
- Rejecting EPS, PostScript, and other interpreter-backed content before dispatch.
- Validating file signatures and decoded format metadata, not only file extensions or MIME types.
- Isolating document rendering in a sandbox with minimal filesystem, network, and process privileges.
- Avoiding unnecessary Ghostscript installation in environments that do not require it.
- Applying least-privilege service accounts and restricting access to secrets and host resources.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying generic image dispatch on untrusted bytes.
- Code review checks for missing format allowlists at image and document boundaries.
- Dependency and environment reviews that identify interpreter-backed image handlers.
- Runtime monitoring for unexpected Ghostscript child processes from rendering services.
- Policy enforcement that restricts EPS and PostScript inputs in upload and document-rendering workflows.
- Automated security review tools that flag untrusted content reaching native interpreters or dynamic parsers.
Organizations can look for this class of issue through:
- Static analysis rules identifying generic image dispatch on untrusted bytes.
- Code review checks for missing format allowlists at image and document boundaries.
- Dependency and environment reviews that identify interpreter-backed image handlers.
- Runtime monitoring for unexpected Ghostscript child processes from rendering services.
- Policy enforcement that restricts EPS and PostScript inputs in upload and document-rendering workflows.
- Automated security review tools that flag untrusted content reaching native interpreters or dynamic parsers.
