Html To Docx
Monthly
TurboDocx html-to-docx through 1.23.1 is vulnerable to server-side request forgery (CWE-918): when an application converts attacker-supplied HTML to DOCX with remote image handling enabled, the library dereferences <img src> URLs server-side, and a loose isValidUrl() check allows loopback, RFC1918 private, and cloud metadata addresses (e.g. 169.254.169.254) to be requested and their responses embedded into the generated document's word/media folder. The flaw is remotely reachable without authentication or user interaction (CVSS:4.0 PR:N/UI:N, 8.2; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis. Real-world risk is conditional rather than universal: the attacker must supply a live, responsive internal target, the fetched response must be readable from the returned DOCX, and deployments that disable remote image fetching, filter outbound traffic, or restrict HTML input are not exploitable.
TurboDocx html-to-docx through 1.23.1 is vulnerable to server-side request forgery (CWE-918): when an application converts attacker-supplied HTML to DOCX with remote image handling enabled, the library dereferences <img src> URLs server-side, and a loose isValidUrl() check allows loopback, RFC1918 private, and cloud metadata addresses (e.g. 169.254.169.254) to be requested and their responses embedded into the generated document's word/media folder. The flaw is remotely reachable without authentication or user interaction (CVSS:4.0 PR:N/UI:N, 8.2; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis. Real-world risk is conditional rather than universal: the attacker must supply a live, responsive internal target, the fetched response must be readable from the returned DOCX, and deployments that disable remote image fetching, filter outbound traffic, or restrict HTML input are not exploitable.