CVE-2026-44016

Name of the Vulnerable Software and Affected Versions Docling versions 2.82.0 through 2.90.x

Description When the HTML backend is explicitly configured for rendering, the Playwright-based rendering feature allows JavaScript execution and unrestricted network access during the processing of untrusted HTML documents. This can enable an attacker to execute arbitrary JavaScript in the rendering context or perform unauthorized network requests to internal services, potentially resulting in Server-Side Request Forgery (SSRF), data exfiltration, or remote code execution in the rendering environment.

Recommendations Update to version 2.91.0. As a temporary workaround, refrain from using render page=True when processing untrusted HTML documents.