CVE-2026-49452: openSUSE Python-Weasyprint CSS Injection — Detection and Patching Guide

A new security advisory for openSUSE (openSUSE-2026-0251) addresses a moderate severity vulnerability in python-weasyprint, tracked as CVE-2026-49452. This update resolves a CSS Injection flaw that could be exploited by attackers to manipulate document rendering or potentially access sensitive data via the document generation pipeline.

Introduction

Python-Weasyprint is a widely used visual rendering engine for HTML and CSS that converts documents into PDF. It is frequently integrated into web applications for invoicing, report generation, and archiving. CVE-2026-49452 highlights a critical weakness in how the library handles untrusted Cascading Style Sheets (CSS).

For defenders, the risk is clear: if your application relies on Weasyprint to process user-supplied content, an attacker can inject malicious CSS. While "CSS Injection" may initially sound low-impact, in the context of a PDF renderer, it can be a vector for data exfiltration (reading local files via CSS url() constructs) or Server-Side Request Forgery (SSRF). openSUSE has released an update to close this gap, and immediate patching is required to maintain the integrity of your document generation services.

Technical Analysis

• Affected Products: openSUSE distributions (including openSUSE Tumbleweed and likely Leap variants) hosting python-weasyprint packages (e.g., python39-weasyprint, python310-weasyprint).
• CVE Identifier: CVE-2026-49452
• Severity: Moderate (Vendor rating)
• Vulnerability Mechanism: The application fails to properly sanitize or isolate CSS input. By injecting specific CSS rules, an attacker may manipulate the rendering engine to perform actions beyond simple styling, such as accessing internal resources or altering document layout to obscure information.
• Exploitation Status: Currently categorized as a fixed vulnerability. While active exploitation in the wild has not been confirmed at this stage, the prevalence of this library in web services makes it a high-value target for automated scanning.

Detection and Response

Identifying the presence of vulnerable libraries in Linux environments is notoriously difficult for SOCs relying solely on process logs. The most effective detection strategy involves hunting the package management system to confirm the installation of python-weasyprint and verifying the version against the patched release.

Sigma Rules

The following Sigma rule monitors for package management interactions involving python-weasyprint. This helps identify hosts where the software is installed, updated, or where an administrator is manually intervening, aiding in asset inventory.

---
title: openSUSE Python-Weasyprint Package Management Activity
id: 8f4e2a10-6b3c-4c1d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects installation, update, or removal of python-weasyprint packages via zypper or rpm on openSUSE systems.
references:
  - https://linuxsecurity.com/advisories/opensuse/opensuse-2026-0251-1-python-weasyprint
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_package:
    Image|endswith:
      - '/zypper'
      - '/rpm'
      - '/dnf'
  selection_keywords:
    CommandLine|contains:
      - 'python-weasyprint'
      - 'python39-weasyprint'
      - 'python310-weasyprint'
  condition: all of selection_*
falsepositives:
  - Legitimate administrative patching or software installation
level: low
---
title: Suspicious Python Process Loading Weasyprint
id: 9e5f1b29-7c4d-4e2e-0f1a-2b3c4d5e6f7a
status: experimental
description: Detects Python processes potentially importing the vulnerable weasyprint library. Note: Requires auditd or Python logging instrumentation.
references:
  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49452
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/python'
      - '/python3'
    CommandLine|contains:
      - 'weasyprint'
  condition: selection
falsepositives:
  - Legitimate use of the weasyprint CLI tool (rare) or automated scripts
level: medium

KQL (Microsoft Sentinel / Defender)

Hunt for Syslog events indicating package installation or verification attempts. This requires Linux Syslog ingestion.

// Hunt for python-weasyprint package management on Linux
Syslog
| where ProcessName contains "zypper" or ProcessName contains "rpm"
| where SyslogMessage has "python-weasyprint"
| project TimeGenerated, Computer, ProcessName, SyslogMessage, Facility, SeverityLevel
| sort by TimeGenerated desc

Velociraptor VQL

This artifact queries the local RPM database to find hosts that have weasyprint installed. This is the most reliable method to confirm exposure.

-- Hunt for python-weasyprint installations via RPM database
SELECT 
    Name, 
    Version, 
    Release, 
    Architecture, 
    Installtime, 
    Vendor
FROM rpm()
WHERE Name =~ "weasyprint"
ORDER BY Installtime ASC

Remediation Script (Bash)

Use the following script to identify if the vulnerable package is present and apply the necessary security update provided by openSUSE.

#!/bin/bash
# openSUSE CVE-2026-49452 Remediation Script
# Check for python-weasyprint and apply update

PACKAGE_NAMES="python-weasyprint python39-weasyprint python310-weasyprint python311-weasyprint"
VULNERABLE_FOUND=0

echo "[*] Checking for python-weasyprint installations..."
for pkg in $PACKAGE_NAMES; do
  if rpm -q $pkg > /dev/null 2>&1; then
    echo "[!] Found installed package: $pkg"
    rpm -q $pkg --info
    VULNERABLE_FOUND=1
  fi
done

if [ $VULNERABLE_FOUND -eq 1 ]; then
  echo "[*] Attempting to refresh repositories and update python-weasyprint..."
  # Refresh repository metadata
  zypper refresh > /dev/null 2>&1
  
  # Apply the security update (openSUSE-2026-0251)
  zypper update --type package python-weasyprint
  
  echo "[*] Verifying update..."
  for pkg in $PACKAGE_NAMES; do
    if rpm -q $pkg > /dev/null 2>&1; then
      echo "[+] Current status of $pkg:"
      rpm -q $pkg --info | grep -E '(Name|Version|Release|Build Date)'
    fi
  done
  echo "[*] Remediation complete. Please verify logs for errors."
else
  echo "[+] No python-weasyprint packages found. System not vulnerable via this vector."
fi

Remediation

To mitigate CVE-2026-49452, security teams must apply the patch released by openSUSE immediately. Do not rely solely on runtime detections; the vulnerability lies in the library's code logic.

1. Update Systems: Execute the standard openSUSE update command to ensure the advisory openSUSE-2026-0251 is applied. bash sudo zypper refresh sudo zypper patch

2. Verify Application Logic: After patching, review applications utilizing python-weasyprint. Ensure that user-supplied CSS is strictly sanitized or sandboxed, regardless of the patch status, as a defense-in-depth measure.

3. Official Advisory: Refer to the openSUSE Security Advisory for specific package versioning details and architecture-specific fixes.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub