WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
Impact Since version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if url_fetcher is configured to prevent access to files and URLs. Patches Fixed by 734ee8e that’s included in 61.2 Workarounds Check that no PDF attachment is defined in source HTML. Launch WeasyPrint in a sandbox that prevents access to the filesystem and the network.