What happened
The AI agent tool that converts HTML to PDF accepts arbitrary htmlContent and feeds it to WeasyPrint without the HTML sanitizer used by the non-agent conversion endpoint, so crafted HTML/scripts reach the renderer untrusted.
Why it matters
For a locally hosted document tool this narrows to HTML-injection into a PDF renderer (markup/script injection into generated documents). It is a real but low-blast-radius AI-surface flaw with no known exploit, set at Tier C.
Attack vector
POST /api/v1/ai/tools/create-pdf-from-html-agent copies attacker-controlled htmlContent straight into WeasyPrint, bypassing the CustomHtmlSanitizer that the equivalent /api/v1/convert/html path applies.
Affected systems
Stirling-PDF prior to 3.0.0
Mitigation
Upgrade to Stirling-PDF 3.0.0+. Fix commit: https://github.com/Stirling-Tools/Stirling-PDF/commit/0570c4c4d9e7bf4786a02ab770ef75f116ac3719