CVE-2026-44016
Published: 24 June 2026
Summary
CVE-2026-44016 is a high-severity Code Injection (CWE-94) vulnerability in Docling Docling. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-39003
Vulnerability details
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering…
more
feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code execution in the rendering environment. This vulnerability is fixed in 2.91.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables arbitrary JS execution and SSRF via untrusted HTML input to a document processing service (Playwright renderer), directly mapping to public app exploitation and JS interpreter abuse.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates inputs used in dynamic code generation to block injected directives.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Directly prevents execution of attacker-supplied code written into data memory regions.
Detects server-side request forgery through monitoring of unexpected outbound connections.