PYSEC-2026-4212 Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...