Executive brief
Docling, a tool used to convert various document formats for AI applications, contains a vulnerability in its HTML processing component. If a user has enabled the optional HTML rendering feature, an attacker can provide a malicious HTML file that executes unauthorized code or makes hidden network requests. This could lead to the theft of sensitive internal data or unauthorized access to private network services.
Technical details
A vulnerability exists in Docling's HTML backend (versions 2.82.0 to 2.90.x) when the optional Playwright-based rendering feature is explicitly enabled (render_page=True). The rendering context failed to disable JavaScript execution and lacked network isolation, allowing untrusted HTML documents to execute arbitrary JavaScript or perform unauthorized network requests. This can result in Server-Side Request Forgery (SSRF), data exfiltration, or code execution within the rendering environment. The issue is fixed in version 2.91.0 by disabling JavaScript in the browser context and implementing offline mode when remote fetching is disabled.
Affected products
- docling-project docling >= 2.82.0, < 2.91.0
Timeline
- 2026-06-24: advisory: NVD publication date
- 2026-06-24: patched: Version 2.91.0 released with fixes