TI-2026-74159 CVE-2026-110718 · GHSA-wh99-p86q-m852
TurboDocx html-to-docx SSRF via img src fetches internal URLs
Priority HIGH 69
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes.