VULNERABILITY INTELLIGENCE
CVE-2026-85675
CVSS score7.5 HIGH
EPSS probability0.48%
CISA KEVNot currently listed
Published2026-09-04
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.
Weakness classification
- disclosure@vulncheck.com: CWE-918