CVE-2026-44520

Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge graph with explicit semantic relationships. Prior to 1.5.1, the URLInputHandler class in docling_graph/core/input/handlers.py makes HTTP requests to user-supplied URLs without validating whether the target resolves to a private, loopback, or link-local IP address. The URLValidator only checks for a valid scheme and non-empty netloc, performing no IP-level validation. Additionally, requests.head() was called with allow_redirects=True, allowing an attacker to redirect requests to internal endpoints via an intermediary URL. An attacker who can control the --source CLI argument or PipelineConfig.source API parameter can trigger Server-Side Request Forgery (SSRF). This vulnerability is fixed in 1.5.1.

• CWE-601
• CWE-918

• https://github.com/docling-project/docling-graph/security/advisories/GHSA-fqph-j6v6-jvgx

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44513Diffusers is the a library for pretrained diffusion models.…8.8
• CVE-2026-44514Kubetail is a real-time logging dashboard for Kubernetes. Pr…6.5
• CVE-2026-44515Nextcloud News is an RSS/Atom feed reader. Prior to 28.3.0-b…2.3
• CVE-2026-44516Valtimo is an open-source business process automation platfo…7.6
• CVE-2026-44518liboqs is a C-language cryptographic library that provides i…5.3
• CVE-2026-4452Integer overflow in ANGLE in Google Chrome on Windows prior …8.8
• CVE-2026-44521elFinder is an open-source file manager for web, written in …8.8
• CVE-2026-44522Note Mark is an open-source note-taking application. From 0.…8.6
• CVE-2026-44523Note Mark is an open-source note-taking application. Prior t…10
• CVE-2026-4453Integer overflow in Dawn in Google Chrome on Mac prior to 14…4.3
• CVE-2026-4454Use after free in Network in Google Chrome prior to 146.0.76…8.8
• CVE-2026-44541Fides is an open-source privacy engineering platform. From v…7