[GHSA-q29v-xc37-wh5m] Docling: Unsafe URI and Path Handling in HTML Backend

[ranjiGT]

Updates

• References

Comments

Reason for Change

Adds two upstream Docling pull requests as references for
GHSA-q29v-xc37-wh5m (CVE-2026-47214):

• fix(html): add redirect validation to image fetching docling-project/docling#3407
  • Adds redirect validation to HTML image fetching.
• fix(html): improve local file path handling docling-project/docling#3400
  • Improves local file path handling in the HTML backend.

Both pull requests are merged and included in the v2.94.0
release, which the advisory already identifies as containing
additional security improvements.

These references improve traceability between the advisory
and the upstream remediation.

This is a references-only update. No changes are intended
to the vulnerability description, affected versions, CVSS
severity, or CWE classification.

[github]

Hi there @dolfim-ibm! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟢 Approval recommended

The references accurately identify fixes included in Docling v2.94.0, with no unrelated advisory changes.

0 open findings

What changed in this PR

Adds upstream remediation references to improve advisory traceability.

Changes:

• Adds links to merged Docling PRs #3400 and #3407.
• Updates the advisory modification timestamp.

File	Description
GHSA-q29v-xc37-wh5m.json	Adds verified remediation references and updates metadata.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dolfim-ibm]

Hi all, yes adding the extra reference is perfectly ok with us.

[ranjiGT]

Thank you, @dolfim-ibm, for confirming!

I appreciate the upstream team's feedback and support. The additional references help improve the advisory's traceability by linking the vulnerability to the relevant fixes included in Docling v2.94.0.

Thanks again for taking the time to review this contribution!

[advisory-database]

Hi @ranjiGT! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!