CVE-2026-85675: OWL's document tool fetches any URL a prompt injection hands it, and returns the body to the agent

NVD·medium signalXBlueskyLinkedInCopy link

NVD published CVE-2026-85675 on 2026-09-04 against OWL's DocumentProcessingToolkit: the extract_document_content tool fetches caller-supplied URLs with no scheme, host or IP filtering. An attacker plants a URL through prompt injection, the server fetches the internal resource, and the response lands back in the agent's context where the model will act on it. The context-return step is what turns a normal SSRF into an agent-controllable one, so filtering the fetch is not optional even when the tool looks read-only.