{"uid":"cap_G_HJU6Tf6Xi1GRqnYah30","slug":"tenjin-security-brief-docling-html-backend-cve-2026-47214-781dd783","name":"Tenjin Security Brief: Docling HTML Backend CVE-2026-47214","description":"GitHub Advisory Database updated Docling's CVE-2026-47214 entry on August 2; docling before 2.94.0 is listed as affected by unsafe URI and path handling in the HTML backend, with the safe workaround still being to leave local and remote fetch disabled for untrusted HTML.","url":"https://tenjin.blog/api/read/security-briefs/security-briefs-daily-docling-s-html-backend-needed-a-fetch-boundary?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"pathParams":{"type":"object","required":["handle","slug"],"properties":{"slug":{"type":"string","description":"The article's URL slug, unique per creator. The reserved slug `latest` resolves to the creator's newest published piece; its stable scheduled-read form is the wallet-address URL /api/read/<0x-address>/latest (a handle `latest` is not payable)."},"handle":{"type":"string","description":"The creator's handle, or their wallet address. The address form is REQUIRED for a durable `latest` alias (a handle `latest` is not payable), and is the only form for an unclaimed creator."}}},"queryParams":{"type":"object","required":[],"properties":{},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.1","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.1/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.1","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_-DgAXbJHdjNYMJuj8_vwi","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.1","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns the full text of a security brief about Docling's CVE-2026-47214 unsafe URI and path handling vulnerability in its HTML backend.","exampleAgentPrompt":"Pull up the Tenjin security brief on Docling's HTML backend CVE-2026-47214 — I want to read about the unsafe URI and path handling vulnerability and what workaround is recommended.","exampleUseCases":[{"title":"Researching docling vulnerability before upgrading","prompt":"Can you get me the security brief about that docling CVE-2026-47214 vulnerability? I need to understand whether our version is affected and what we should do before upgrading to 2.94.0."},{"title":"Security audit of HTML parsing dependencies","prompt":"I'm auditing our dependencies and heard docling had an unsafe fetch boundary issue in its HTML backend — can you pull the full Tenjin brief on that so I can assess our exposure?"},{"title":"Summarizing CVE for a team standup","prompt":"Grab the Tenjin brief on the docling HTML backend security issue from August 2nd so I can summarize the CVE details and the recommended safe workaround for my team."}],"resultDescription":"The full text of a security brief article covering Docling's CVE-2026-47214 entry, including details about the affected versions (docling before 2.94.0), the nature of the vulnerability (unsafe URI and path handling in the HTML backend), the GitHub Advisory Database update timestamp, and the recommended safe workaround (disabling local and remote fetch for untrusted HTML).","failureModes":["404 if the slug or handle does not match a published article","402 Payment Required if the x402 payment is missing or insufficient (0.1 USDC required)","Payment processing failure if wallet has insufficient funds","Article may be unavailable if not yet published or unpublished by creator"],"whenToPreferThis":"Use this endpoint when you specifically need the Tenjin-authored security brief on Docling's CVE-2026-47214 HTML backend vulnerability, particularly when you want a curated, human-readable narrative summary rather than raw GitHub Advisory Database JSON. Prefer this over raw CVE feeds when you want editorial context and actionable workaround guidance in article form.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-15T12:33:01.701Z","isFirstParty":false,"canonicalSlug":"tenjin-security-brief-docling-html-backend-cve-2026-47214-781dd783"}