WeasyPrint, a PDF generation library, persists presentational‑hint attribute values from user‑supplied HTML directly into CSS declarations. The background attribute is inserted into a background‑image:url() property, which the CSS parser then interprets. As a result, an attacker who can supply arbitrary HTML can inject additional CSS rules, and the injected url() values may trigger outbound requests from the server. The vulnerability enables malicious styles to alter rendering and potentially make server‑side requests, which could affect the integrity of the generated PDFs.

Kozea WeasyPrint library versions prior to 69.0 are vulnerable whenever the presentational hints feature is enabled. Versions 69.0 and newer contain the fix; earlier releases without an explicit upgrade remain exposed.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of 0.27% (less than 1%) indicates a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to provide malicious HTML to the WeasyPrint engine with presentational_hints enabled. Since the attack vector relies on crafted input rather than an external privilege escalation, the risk level is moderate, though the potential for server‑side requests elevates concern for systems processing untrusted content.