How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos (research.kudelskisecurity.com)

Hi everyone, I built PlutoPrint because I needed a simple way to generate beautiful PDFs and images directly from HTML with Python. Most of the tools I tried felt heavy, tricky to set up, or produced results that didn’t look great, so I wanted something lightweight, modern, and fast. PlutoPrint is built on top of PlutoBook’s rendering engine, which is designed for paged media, and then wrapped with a Python API that makes it easy to turn HTML or XML into crisp PDFs and PNGs. I’ve used it for things like invoices, reports, tickets, and even snapshots, and it can also integrate with Matplotlib to render charts directly into documents.

I’d be glad to hear what you think. If you’ve ever had to wrestle with generating PDFs or images from HTML, I hope this feels like a smoother option. Feedback, ideas, or even just impressions are all very welcome, and I’d love to learn how PlutoPrint could be more useful for you.

Comments (18)

hbcondo714 · 2m ago

> book.load_url("input.html")

Shouldn’t this be a URL like https://example.com

phonon · 4h ago

It would be great if you could run it against the tests at https://www.print-css.rocks/

They would give a much better idea of its complex printing capabilities.

pac0 · 2h ago

It should be required to run these tests for these libraries. It's really frustrating to have to discover it trying to make it work.

okm · 4h ago

This is so efficient, i just tested it ,far better than weasyprint, and it has both python and c++ repo, bro am amazed, Are you open for sponsorship?

eterps · 5h ago

How does it differ from https://weasyprint.org ?

sammycage · 5h ago

WeasyPrint is great, but PlutoPrint takes a different angle: the engine is all C++, so it’s faster and lighter on memory. It can render directly to PNG as well as PDF, and has stronger SVG support.

masfuerte · 4h ago

PlutoBook looks very impressive. Is it based on another renderer?

socalgal2 · 4h ago

Maybe this isn't the same but it's a relatively few lines of code to use puppeteer to use an actual browser to render pages to PDFs/PNGs. Advantages would be everything is supported. Every new feature in CSS, HTML, SVG, Canvas2D, WebGL, WebGPU, etc... (though for WebGL/WebGPU you might need to pass in some flags to use llvmpipe/mesa/warp etc...

Asking your favorite LLM will give you da codez

PS: I'm not trying to discount this tool. I'm only pointing out an alternative that might be useful

sammycage · 4h ago

That’s a good point. Using Puppeteer or a headless browser gives you essentially full web platform support. The tradeoff is that it comes with a heavier runtime and more moving parts (Chromium, Node, etc.). PlutoPrint aims to be much lighter: no browser dependency, just a compact C++ engine with a Python wrapper. It does not cover the entire browser feature set but it is fast, portable, and easy to drop into projects without the overhead of a full browser.

nicoburns · 4h ago

Interesting. I was not aware of PlutoBook!

We're doing a very similar thing (custom lightweight engine) over at https://github.com/DioxusLabs/blitz. We have more of a focus on UI, but there's definitely overlap (we support rendering to image, but don't have pagination/fragmentation implemented).

Have you run the WPT tests against your engine to test spec conformance?

slig · 4h ago

Exactly what I was wondering. I use puppeteer to render these [1] printable puzzles pages, and I use SVG, JavaScript to dynamically resize the text to fit a page, etc. Just works.

[1]: https://ahapdf.nyc3.cdn.digitaloceanspaces.com/samplers/logi... (PDF)

iamgopal · 1h ago

Comparing it to typst ?

Humphrey · 3h ago

Does anybody have any experience migrating to PlutoPrint from WeasyPrint? Is it seamless? Faster? Any teething issues? Are their reasons to stay with WeasyPrint?

pac0 · 2h ago

Does this support full flexbox styling?

What are the known issues or the unsupported css this library has?

ge96 · 3h ago

Might need this wkhtmltopdf being bound to bookworm

klaxce · 3h ago

I’m also looking at this as a replacement for wkhtmltopdf as well. I had reimplemented with Puppeteer, but it’s very ram heavy for the 200-500 page PDFs I generate. I’m hoping this renders what I need properly.

richfreedman · 4h ago

Nice! I think that it would be great if this could take markdown as input, without having to convert to HTML first

moelf · 5h ago

for a second I thought it's this Pluto (note)book https://plutojl.org/

GPT-5 (openai.com)

Fight Chat Control (fightchatcontrol.eu)

GitHub is no longer independent at Microsoft after CEO resignation (theverge.com)

I tried every todo app and ended up with a .txt file (al3rez.com)

Claude Sonnet 4 now supports 1M tokens of context (anthropic.com)

I want everything local – Building my offline AI workspace (instavm.io)

Ultrathin business card runs a fluid simulation (github.com)

Streaming services are driving viewers back to piracy (theguardian.com)

Wikipedia loses challenge against Online Safety Act (bbc.com)

Anna's Archive: An Update from the Team (annas-archive.org)

FFmpeg 8.0 adds Whisper support (code.ffmpeg.org)

Emailing a one-time code is worse than passwords (blog.danielh.cc)

Debian 13 “Trixie” (debian.org)

Steve Wozniak: Life to me was never about accomplishment, but about happiness (yro.slashdot.org)

Good system design (seangoedecke.com)

Vibechart (vibechart.net)

Why LLMs can't really build software (zed.dev)

VC-backed company just killed my EU trademark for a small OSS project

Claude Code is all you need (dwyer.co.za)

Gemma 3 270M: Compact model for hyper-efficient AI (developers.googleblog.com)

Nginx introduces native support for ACME protocol (blog.nginx.org)

Show HN: The current sky at your approximate location, as a CSS gradient (sky.dlazaro.ca)

AGENTS.md – Open format for guiding coding agents (agents.md)

Claude says “You're absolutely right!” about everything (github.com)

Copilot broke audit logs, but Microsoft won't tell customers (pistachioapp.com)

PYX: The next step in Python packaging (astral.sh)

Open hardware desktop 3D printing is dead? (josefprusa.com)

How I code with AI on a budget/free (wuu73.org)

Show HN: Building a web search engine from scratch with 3B neural embeddings (blog.wilsonl.in)

Obsidian Bases (help.obsidian.md)

Show HN: I built an app to block Shorts and Reels (scrollguard.app)

How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos (research.kudelskisecurity.com)

Try and (ygdp.yale.edu)

This website is for humans (localghost.dev)

I accidentally became PureGym’s unofficial Apple Wallet developer (drobinin.com)

GPT-5: Key characteristics, pricing and system card (simonwillison.net)

Wikimedia Foundation Challenges UK Online Safety Act Regulations (wikimediafoundation.org)

Web apps in a single, portable, self-updating, vanilla HTML file (hyperclay.com)

Show HN: I was curious about spherical helix, ended up making this visualization (visualrambling.space)

OpenFreeMap survived 100k requests per second (blog.hyperknot.com)

Jim Lovell, Apollo 13 commander, has died (nasa.gov)

OpenMower – An open source lawn mower (github.com)

Search all text in New York City (alltext.nyc)

Lazy-brush – smooth drawing with mouse or finger (lazybrush.dulnan.net)

Ask HN: How can ChatGPT serve 700M users when I can't run one GPT-4 locally?

Show HN: Whispering – Open-source, local-first dictation you can trust (github.com)

What's the strongest AI model you can train on a laptop in five minutes? (seangoedecke.com)

The future of large files in Git is Git (tylercipriani.com)

Historical Tech Tree (historicaltechtree.com)

Why are there so many rationalist cults? (asteriskmag.com)

Show HN: PlutoPrint – Generate PDFs and PNGs from HTML with Python

Comments (18)