8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44016

CVE-2026-44016: Docling: Unsafe Playwright-based HTML Rendering

Impact

In versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment.

Patches

Fixed in version 2.91.0. The rendering context now explicitly disables JavaScript execution (java_script_enabled=False) and implements network isolation controls. When enable_remote_fetch is disabled, the browser operates in offline mode, preventing all network requests.

Workarounds

Refrain from using render_page=True when processing untrusted HTML documents.

References

Fix release: v2.91.0

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44016

CVE-2026-44016:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
docling	pip	>= 2.82.0, < 2.91.0	2.91.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability in Docling is a code injection and Server-Side Request Forgery (SSRF) issue within its HTML rendering feature. The root cause is the unsafe use of the Playwright library for rendering HTML content. The analysis of the patch between version 2.90.1 and the fixed version 2.91.0 revealed that the core of the vulnerability is in the _render_with_browser method of the HTMLDocumentBackend class in docling/backend/html_backend.py.

Prior to the fix, this function would create a Playwright browser context that, by default, had JavaScript execution enabled and no network restrictions. When a user-provided HTML was rendered, any embedded JavaScript would be executed within the context of the server, and any network requests (e.g., via fetch or <img> tags) would be made from the server's network interface. This could be exploited by an attacker to execute arbitrary JavaScript, exfiltrate local data, or perform SSRF attacks against internal services.

The patch applied in commit 9813190ab4126c1ff2fde1e3e72322821530390b directly addresses this by modifying the browser.new_context() call inside _render_with_browser. It introduces two key security controls:

java_script_enabled=False: This explicitly disables JavaScript execution in the rendering context, preventing code injection.
offline=offline_mode: This puts the browser in an offline mode based on the enable_remote_fetch option, preventing all network requests when remote fetching is disabled, thus mitigating the SSRF risk.

Therefore, the HTMLDocumentBackend._render_with_browser function is the exact location where the vulnerability existed and is the function that would appear in a runtime profile during the exploitation of this vulnerability.

Vulnerable functions

HTMLDocumentBackend._render_with_browser

docling/backend/html_backend.py

The vulnerability lies within the `_render_with_browser` function, which is responsible for rendering HTML content using Playwright. Before the patch, this function initialized a browser context without disabling JavaScript or restricting network access. This allowed malicious HTML documents to execute arbitrary JavaScript and make unauthorized network requests. The patch mitigates this by explicitly setting `java_script_enabled=False` and enabling an `offline` mode for the browser context, thus preventing the exploitation of this vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.