Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kozea/weasyprint

              main @ 156bf5a
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

SSRF: 2 prior fixes. Scrutinize any change in this area.

weasyprint/svg/__init__.py: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The default URL fetcher previously followed HTTP redirects automatically without re-validating the destination. This allowed attackers to bypass initial fetcher restrictions and access internal network resources via crafted redirect chains.

SSRF: When parsing complex assets like SVGs, individual elements (such as Patterns) did not receive the configured custom URL fetcher. They fell back to permissive default fetchers, exposing the application to unauthorized local file access or network requests.