TurboDocx html‑to‑docx up to version 1.23.1 contains a server‑side request forgery flaw that allows an attacker to provide crafted HTML containing <img> tags whose src attributes reference internal or cloud‑metadata URLs. When the library processes the conversion, it fetches those resources and embeds the retrieved content in the resulting DOCX file’s media folder, exposing the data from the requested endpoint to the attacker. This flaw can lead to disclosure of sensitive internal information and can be used for reconnaissance or further lateral movement.

The vulnerability affects the TurboDocx html‑to‑docx library up to and including version 1.23.1. No other product or version is listed as impacted.

The CVSS score of 8.2 indicates high severity. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based request to a publicly reachable TurboDocx instance that performs the conversion, because the attacker only needs to supply malicious HTML. Once triggered, the server resolves the attacker‑supplied URL, fetches its content, and embeds it in the DOCX output, allowing the attacker to read the response. This grants internal information disclosure and may facilitate subsequent attacks.