Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N H P N N H N N 8.2 .0044 37.0 —
AFFECTED Product Versions Fixed html-to-docx unspecified —
TIMELINE Oct 14 EXPLOIT PUBLISHED — CVE-2026-110718 (TurboDocx html-to-docx). Public exploit reference added. Oct 14 Reserved by VulnCheck Oct 14 Published (CNA: VulnCheck)
TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs via img src attributes. Attackers can reference loopback, private, or cloud metadata addresses that bypass the loose isValidUrl() check, and read responses embedded in the generated DOCX word/media folder.
| Date | Event | Detail |
|---|---|---|
| October 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-110718 (TurboDocx html-to-docx). Public exploit reference added. |
| October 14, 2026 | Reserved | Reserved by VulnCheck |
| October 14, 2026 | Published | Published (CNA: VulnCheck) |
Authoritative record: CVE-2026-110718 at cve.org
Vendors: turbodocx
Weaknesses: CWE-918
Ecosystems: npm
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-110718 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
