CVE-2026-44016: Docling HTML Backend RCE Vulnerability

CVE-2026-44016 Overview

CVE-2026-44016 affects Docling, an open-source document processing library that parses diverse formats and integrates with generative AI pipelines. Versions >= 2.82.0 and < 2.91.0 ship a Playwright-based HTML rendering backend that fails to sandbox untrusted input. When an operator explicitly enables the rendering option, attacker-controlled HTML can execute arbitrary JavaScript and issue unrestricted outbound network requests. The flaw maps to CWE-94: Improper Control of Generation of Code and carries a CVSS score of 8.2. The maintainers fixed the issue in Docling 2.91.0.

Critical Impact
Malicious HTML processed through the Docling rendering backend can trigger Server-Side Request Forgery (SSRF), exfiltrate data from internal services, or achieve code execution within the rendering environment.

Affected Products

Docling versions >= 2.82.0 and < 2.91.0 with the HTML rendering backend explicitly enabled
Downstream applications embedding Docling for HTML ingestion in generative AI workflows
Pipelines that pass untrusted or user-supplied HTML through the Playwright renderer

Discovery Timeline

2026-06-24 - CVE-2026-44016 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-44016

Vulnerability Analysis

Docling exposes an optional HTML rendering backend that uses Playwright, a headless browser automation framework, to convert HTML documents into structured output. The renderer launches a browser context that executes JavaScript and performs network I/O without isolation controls. When an integrator turns on the rendering option, the Playwright context inherits broad access to the host network stack and to the JavaScript engine.

This configuration becomes dangerous when the HTML originates from untrusted sources. The renderer treats the document as a fully privileged web page, so any embedded <script> block, inline event handler, or remote resource reference runs with the privileges of the rendering process. The vulnerability falls under [CWE-94] because attacker-supplied markup is interpreted as executable code.

Root Cause

The rendering backend does not disable JavaScript execution, restrict outbound network requests, or sandbox the Playwright context against internal network ranges. Documents are loaded and rendered as if they were trusted web pages. The rendering option ships disabled by default, which limits exposure to deployments that explicitly opt in.

Attack Vector

An attacker submits a crafted HTML document to a Docling pipeline that has rendering enabled. The malicious payload can perform several actions inside the renderer. It can issue HTTP requests to cloud metadata endpoints such as 169.254.169.254 or to internal services reachable from the rendering host, yielding SSRF. It can exfiltrate captured data to an attacker-controlled domain through fetch or XMLHttpRequest. It can also abuse browser primitives to attempt remote code execution in the rendering environment.

Exploitation requires user interaction in the sense that an operator or upstream system must submit the document for processing. The vulnerability description and security advisory provide the authoritative technical context. See the GitHub Security Advisory GHSA-pj2v-ggqh-cmq2 for details.

Detection Methods for CVE-2026-44016

Indicators of Compromise

Outbound HTTP requests from Docling worker hosts to cloud metadata endpoints such as 169.254.169.254 or to internal RFC1918 addresses not previously contacted by the service
Playwright browser processes spawned by Docling making DNS lookups for attacker-controlled domains
HTML documents in ingestion queues containing inline <script> blocks, fetch() calls, or references to internal hostnames

Detection Strategies

Audit Docling configuration files and environment variables for the rendering option being enabled in production deployments
Inventory installed Docling versions across Python environments using pip show docling and flag any release in the 2.82.0 to 2.90.x range
Correlate process telemetry for playwright or chromium child processes spawned by Docling against expected workload baselines

Monitoring Recommendations

Log and alert on egress traffic from document processing hosts to non-allowlisted destinations, with priority on metadata and internal management endpoints
Capture DNS query logs from rendering workers and review for newly observed domains tied to ingested documents
Enable EDR process tree visibility on Docling hosts to surface unexpected child processes or network activity from the rendering subprocess

How to Mitigate CVE-2026-44016

Immediate Actions Required

Upgrade Docling to version 2.91.0 or later across all environments that process HTML
Disable the HTML rendering backend in any deployment that does not strictly require it until the upgrade is complete
Restrict egress network access from Docling worker hosts to an explicit allowlist, blocking metadata and internal management ranges

Patch Information

The Docling maintainers fixed CVE-2026-44016 in release 2.91.0. Upgrade guidance and release notes are available in the Docling v2.91.0 release and the GitHub Security Advisory GHSA-pj2v-ggqh-cmq2. Operators should pin the new version in dependency manifests and rebuild container images.

Workarounds

Leave the rendering option disabled, which is the default configuration, so untrusted HTML is parsed without invoking Playwright
Process untrusted HTML only inside an isolated network namespace with no route to internal services or cloud metadata endpoints
Pre-sanitize incoming HTML to strip <script> tags, event handlers, and external resource references before passing it to Docling

bash

# Upgrade Docling to the patched release
pip install --upgrade 'docling>=2.91.0'

# Verify the installed version
pip show docling | grep -i version