What’s Vulnerable › Vulnerabilities

CVE-2026-85675: OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-24
• Weakness: CWE-918

Description

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.

References

• https://github.com/camel-ai/owl
• https://github.com/camel-ai/owl/blob/fba1dd5b3a9e8cc15f16221bb002cca7e3de2d9d/owl/utils/document_toolkit.py
• https://github.com/camel-ai/owl/issues/615
• https://www.vulncheck.com/advisories/owl-documentprocessingtoolkit-server-side-request-forgery-via-url-fetching

Get alerted when CVE-2026-85675 or the next vulnerability affects your stack