CVE-2026-44016

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment. This vulnerability is fixed in 2.91.0.

• CWE-94
• CWE-918
• CWE-918

• https://github.com/docling-project/docling/releases/tag/v2.91.0Product, Release Notes
• https://github.com/docling-project/docling/security/advisories/GHSA-pj2v-ggqh-cmq2Mitigation, Patch, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2026-44016
• https://bugzilla.redhat.com/show_bug.cgi?id=2492339
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44016.json

Published

Jun 24, 2026

Last Modified

Jul 15, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44009vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.…9.8
• CVE-2026-4401The Download Monitor plugin for WordPress is vulnerable to C…5.4
• CVE-2026-44010Craft CMS is a content management system (CMS). From 4.0.0 t…7.1
• CVE-2026-44011Craft CMS is a content management system (CMS). From 4.0.0 t…8.6
• CVE-2026-44012Craft CMS is a content management system (CMS). From 5.0.0-R…7.1
• CVE-2026-44015Nginx UI is a web user interface for the Nginx web server. I…9.9
• CVE-2026-44017Docling simplifies document processing by parsing diverse fo…7.5
• CVE-2026-44018Docling simplifies document processing by parsing diverse fo…7.1
• CVE-2026-44019Docling Core defines core data types and transformations for…8.1
• CVE-2026-4402Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-44020Docling simplifies document processing by parsing diverse fo…7.5
• CVE-2026-44022Docling simplifies document processing by parsing diverse fo…5.5