Docling: Unsafe Playwright-based HTML Rendering
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment. This vulnerability is fixed in 2.91.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| docling-project | docling | 2.82.0 to before 2.91.0 | 2.91.0 | Patch available | CNA |
| — | docling (PyPI) | 2.82.0 to before 2.91.0 | 2.91.0 | Patch available | GHSA-pj2v-ggqh-cmq2 |
- docling Vendordocling-project Affected 2.82.0 to before 2.91.0 Fixed in 2.91.0 Patch available CNA
- docling (PyPI) Vendor— Affected 2.82.0 to before 2.91.0 Fixed in 2.91.0 Patch available GHSA-pj2v-ggqh-cmq2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:docling:docling:*:*:*:*:*:python:*:* | 2.82.0 to before 2.91.0 | Vulnerable | docling-project |
- cpe:2.3:a:docling:docling:*:*:*:*:*:python:*:* Versions 2.82.0 to before 2.91.0 Vulnerable ·docling-project
Remediation
- Fix · CNA docling (docling-project) Fixed in 2.91.0
- Fix · GHSA-pj2v-ggqh-cmq2 docling (PyPI) Fixed in 2.91.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-44016
- 2026-10-03 Alias added: GHSA-pj2v-ggqh-cmq2
References
Other 6
- https://github.com/docling-project/docling/releases/tag/v2.91.0
- https://access.redhat.com/security/cve/CVE-2026-44016
- https://bugzilla.redhat.com/show_bug.cgi?id=2492339
- https://github.com/docling-project/docling
- https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2142.yaml
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44016.json
More docling-project Docling vulnerabilities
- TI-2026-68355 Docling Tectonic TikZ rendering enables arbitrary file read/write CVSS 3.1HIGH 8.8
- TI-2026-68362 Arbitrary local file read in Docling OpenDocument backend CVSS 4.0MEDIUM 6.9
- TI-2026-68360 Docling table span parsing causes CPU and memory exhaustion CVSS 3.1MEDIUM 6.5
- TI-2026-68353 Docling sends configured HTTP headers to any remote image host CVSS 3.1MEDIUM 5.3
- TI-2026-68359 Docling embeds local image files from crafted JSON documents CVSS 3.1MEDIUM 4.3
- TI-2026-32061 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVSS 3.1HIGH 7.5
Sources
- CVE-2026-44016 · CVE Program
- CVE-2026-44016 · NVD
- FIRST EPSS
- GHSA-pj2v-ggqh-cmq2 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-44016 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences