TurboDocx html-to-docx: Server-side request forgery via img src

Summary

html-to-docx, a JavaScript library that converts HTML to DOCX, is affected up to and including version 1.23.1 (npm package @turbodocx/html-to-docx). During conversion, the library fetches remote images referenced by img src attributes. An attacker who can submit HTML to a service using the library can make the server request internal addresses, loopback addresses or cloud metadata endpoints, because the isValidUrl() check is too loose. The responses are embedded in the generated DOCX file, where the attacker can read them. According to the CVSS vector, only confidentiality is affected.

Affected

• TurboDocx html-to-docx (npm: @turbodocx/html-to-docx), all versions up to and including 1.23.1
• Last affected commit: ff08e5687a2c87bcdc182a2e3e130c3493b9fb7e (src/utils/image.js)

Fixed in

Unknown. No fixed version, commit or vendor advisory was found. The latest npm version at the time of research is 1.23.1.

Workaround

No vendor workaround confirmed. Interim measures:

• Do not pass untrusted HTML to the converter; remove img elements or allow only self-hosted images.
• Block outbound requests from the converting service to internal networks and cloud metadata addresses such as 169.254.169.254.
• Run the converter in a network segment without access to internal systems.
• Do not return generated DOCX media contents to untrusted users.

Exploitation

• CISA SSVC: exploitation state 'poc' (public proof of concept), automatable: no, technical impact: partial.
• Not listed in CISA KEV; no known exploitation in the wild was found. EPSS is below 1%.

Our recommendation

• Check whether you run a self-built service that converts HTML to DOCX with this library, especially if users or external systems supply the HTML. If not, close this item.
• Apply the workarounds above now and restrict outbound traffic from the converter.
• Watch the GitHub repository and npm for a fixed release and upgrade as soon as one is available.
• Monitor outbound requests and logs for access to internal or metadata addresses.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• TurboDocx html-to-docx repository github.com
• Vulnerable code: src/utils/image.js at ff08e56 github.com
• VulnCheck advisory www.vulncheck.com
• HackMD write-up referenced in the CVE hackmd.io
• OSV entry CVE-2026-110718 osv.dev
• OpenCVE entry CVE-2026-110718 app.opencve.io
• html-to-docx releases github.com
• npm package @turbodocx/html-to-docx www.npmjs.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:24.