CVE-2026-44016

{"id": "CVE-2026-44016", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44016", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T19:01:27.606801Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "docling-project", "product": "docling", "versions": [{"status": "affected", "version": ">= 2.82.0, < 2.91.0"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-autorag-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-06-24T18:17:16.353", "references": [{"url": "https://github.com/docling-project/docling/releases/tag/v2.91.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/docling-project/docling/security/advisories/GHSA-pj2v-ggqh-cmq2", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-44016", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492339", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44016.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-918"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment. This vulnerability is fixed in 2.91.0."}, {"lang": "es", "value": "Docling simplifica el procesamiento de documentos al analizar diversos formatos y al proporcionar integraciones con el ecosistema de IA generativa. En las versiones >= 2.82.0, anterior a 2.91.0, si el backend HTML estaba configurado expl\u00edcitamente para la renderizaci\u00f3n (opci\u00f3n de renderizaci\u00f3n desactivada por defecto), entonces la funci\u00f3n de renderizaci\u00f3n basada en Playwright podr\u00eda permitir la ejecuci\u00f3n de JavaScript y el acceso irrestricto a la red al procesar documentos HTML no confiables. Un atacante podr\u00eda crear HTML malicioso que ejecute JavaScript arbitrario en el contexto de renderizaci\u00f3n o realice solicitudes de red no autorizadas a servicios internos, lo que podr\u00eda conducir a ataques SSRF, exfiltraci\u00f3n de datos o ejecuci\u00f3n remota de c\u00f3digo en el entorno de renderizaci\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 2.91.0."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:docling:docling:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "B2F58285-E930-4C06-B5A4-E0176904032F", "versionEndExcluding": "2.91.0", "versionStartIncluding": "2.82.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}