CVE-2026-110718
TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
| CWE | CWE-918 |
| Vendor | turbodocx |
| Product | html-to-docx |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for turbodocx html-to-docx
Be the first to know when new medium vulnerabilities affecting turbodocx html-to-docx are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
TurboDocx / html-to-docx
0 ≤ 1.23.1
References
hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/H1t1Bbpjfx github.com: https://github.com/TurboDocx/html-to-docx/blob/ff08e5687a2c87bcdc182a2e3e130c3493b9fb7e/src/utils/image.js#L286 github.com: https://github.com/TurboDocx/html-to-docx vulncheck.com: https://www.vulncheck.com/advisories/turbodocx-html-to-docx-through-1.23.1-ssrf-via-img-src-remote-image-download
Credits
hieuPenguinnn