{"items":[{"id":"NVI-00016081","kind":"vulnerability","title":"Docling: Unsafe Playwright-based HTML Rendering","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-pj2v-ggqh-cmq2","CVE-2026-44016"],"plain_summary":"GitHub lists this reviewed advisory for docling. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1a4f351189cb4bc6dd4d7ae49bf800bb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-20T21:33:27.000Z","value":"8.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1a4f351189cb4bc6dd4d7ae49bf800bb"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1a4f351189cb4bc6dd4d7ae49bf800bb","url":"https://github.com/advisories/GHSA-pj2v-ggqh-cmq2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-pj2v-ggqh-cmq2","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T22:35:18.117Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1a4f351189cb4bc6dd4d7ae49bf800bb"],"technology":"docling","known_exclusions":[],"conditions_summary":"### Impact\nIn versions `>= 2.82.0, < 2.91.0`, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment.\n\n### Patches\nFixed in version 2.91.0. The rendering context now explicitly disables JavaScript execution (`java_script_enabled=False`) and implements network isolation controls. When `enable_remote_fetch` is disabled, the browser operates in offline mode, preventing all network requests.\n\n### Workarounds\nRefrain from using `render_page=True` when processing untrusted HTML documents.\n\n### References\n- Fix release: v2.91.0","public_affected_ranges":[">= 2.82.0, < 2.91.0"]}],"null_published_at":"2026-11-04T10:04:27.881Z","source_updated_at":"2026-07-20T21:33:27.000Z","source_disclosed_at":"2026-06-03T21:09:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T22:35:18.117Z"}],"next_cursor":null,"snapshot_revision":"42594"}