Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment. This vulnerability is fixed in 2.91.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Docling, Unsafe Playwright-based #HTML Rendering, #CVE-2026-44016 (High) -DC-Jun2026-193 https://dailycve.com/docling-unsafe-playwright-based-html-rendering-cve-2026-44016-high-dc-jun2026-193/
Post summary
The post announces CVE-2026-44016, a high‑severity vulnerability in Docling’s Playwright‑based HTML rendering, without providing proof‑of‑concept, exploit code, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | docling | docling | - | python | - |