Docling‑Graph builds a directed knowledge graph by turning document data into validated Pydantic objects, which are processed by the URLInputHandler class. Prior to version 1.5.1 the handler makes HTTP requests to URLs supplied by the user without validating whether they resolve to private, loopback, or link‑local addresses, and it performs an unconditional HEAD request with redirects enabled. This omission permits an attacker to supply a URL that resolves to an internal service or an external intermediary that redirects to an internal endpoint, thereby exfiltrating data or causing a denial of service. The vulnerability is rooted in improper input validation of network addresses (CWE‑601) and the failure to restrict outbound requests (CWE‑918).

The fault exists in the docling‑project/docling‑graph Python package. All deployments using versions earlier than 1.5.1 are susceptible. The vulnerability is triggered through the CLI argument --source or the PipelineConfig.source API parameter, which is part of the public interface of the library.

The CVSS score of 5.7 indicates a moderate severity flaw. The EPSS score is unavailable, and the flaw is not listed in CISA’s KEV catalog, suggesting that publicly available exploit code may not have appeared. Nonetheless, an attacker with the ability to supply the source URL can practically perform an SSRF to internal resources, provided network segmentation is not enforced externally. The attack vector is remote and does not require privileged local access, making it easily exploitable in environments where untrusted users can influence the source parameter.