CVE-2026-44016: Docling HTML Rendering Code Execution Vulnerability (2.82.0–2.90.x)

Technical summary

CVE-2026-44016 affects the Playwright-based HTML rendering backend in Docling when explicitly enabled. The vulnerability stems from insufficient sandboxing of the rendering context, allowing JavaScript execution and network access that should be restricted when processing untrusted content. The attack vector is network-based; an attacker supplies a crafted HTML document that, when processed by an affected Docling instance with rendering enabled, executes malicious JavaScript or establishes connections to internal or external services. The CVSS 3.1 score of 8.2 (HIGH) reflects the high confidentiality and integrity impact, though availability impact is lower and the attack complexity is high due to the requirement that rendering must be explicitly configured and a user must process the malicious document.

Business impact

Organizations using Docling for document processing—particularly those ingesting user-submitted or externally sourced HTML content—face risk of data theft, unauthorized system reconnaissance, or lateral movement through SSRF attacks. If Docling runs on servers with access to internal services (databases, APIs, cloud metadata endpoints), an attacker could exploit this vulnerability to reach those services without direct network access. The impact is amplified if Docling processes documents from untrusted sources without strict validation, and if the HTML rendering feature is enabled, either unknowingly or as a deliberate choice for document feature preservation.

Affected systems

Docling versions 2.82.0 through 2.90.x are vulnerable when the HTML rendering feature is explicitly configured. The default configuration does not enable rendering, so organizations using Docling with default settings are not at risk from this specific issue. Only deployments that have actively enabled the HTML rendering option are exposed. Verify your Docling version and configuration to determine if you are affected.

Exploitability

Exploitation requires that an attacker either submit a malicious HTML document directly to a Docling instance or compromise a data source feeding HTML into the processing pipeline. The attack complexity is rated as high because rendering must be explicitly enabled, reducing the baseline risk. However, once the preconditions are met (rendering enabled + malicious HTML processed), the attacker gains arbitrary code execution within the rendering environment. No CVE Exploitability eXchange (KEV) entry exists for this vulnerability, indicating it is not yet observed in active exploitation campaigns, though this does not eliminate risk.

Remediation

Upgrade Docling to version 2.91.0 or later immediately. If immediate upgrade is not possible, disable the HTML rendering feature by ensuring the rendering option remains deactivated in your configuration. Additionally, implement strict input validation and sanitization on all HTML documents before passing them to Docling, and restrict network access from the Docling process to only essential external services.

Patch guidance

Apply version 2.91.0 or later. Verify the patch availability through the official Docling repository and release notes. Test the updated version in a staging environment to ensure compatibility with your document processing workflows. If you have customizations or integrations dependent on the rendering feature, review the 2.91.0 release notes for any behavioral changes and update your code accordingly.

Detection guidance

Monitor for Docling version information in your environment using software inventory tools. Check configuration files and instantiation code for explicit enabling of the HTML rendering option. Log or alert on any Docling processing of HTML documents, especially from untrusted sources. If you cannot immediately patch, implement network-level controls to restrict outbound connections from servers running Docling, limiting communication to known-good internal services only. Review recent document processing logs to identify any suspicious HTML files that may have been processed before patching.

Why prioritize this

Prioritize this vulnerability if you have enabled HTML rendering in Docling and process any documents from external or untrusted sources. Even with the high CVSS score, the explicit configuration requirement means that many deployments are not affected. However, if rendering is enabled, the potential for code execution and lateral movement through SSRF makes this a critical priority. Patch within your standard high-severity SLA.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) is justified by high confidentiality and integrity impact (C:H, I:H), reflecting the ability to exfiltrate data and execute code. Availability impact is rated as low (A:L) because the vulnerability does not inherently bring down the rendering service. The attack vector is network-based (AV:N), but attack complexity is high (AC:H) due to the requirement that rendering be explicitly enabled and a user must process the malicious document. User interaction is required (UI:R), which further elevates complexity. The scope change (S:C) acknowledges that compromise of the rendering context can affect other components or services accessible from that environment.

Frequently asked questions