CVE-2026-110718: TurboDocx html-to-docx through 1.23.1 SSRF via img src Remote Image Download
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/html-to-docx through version 1.23.1 are exposed if they allow an attacker to supply HTML that is converted to DOCX. The attacker does not need prior privileges or user interaction.
What access does an attacker need to exploit it?
An attacker needs the ability to provide HTML containing an img src attribute to the document-generation workflow. Exploitation is network-reachable but has high attack complexity according to the supplied vector.
What internal targets can be requested?
The vulnerable remote image download behavior can be directed at loopback addresses, private-network addresses, and cloud metadata addresses. Responses fetched by the server may be embedded in the generated DOCX under word/media.
How can I determine whether an instance may be affected?
Check whether the application uses html-to-docx version 1.23.1 or earlier and converts attacker-controlled HTML. Review generated DOCX files for unexpected content in the word/media folder, especially where submitted HTML included external image sources.