CVE-2026-85675: OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content too

OWL's DocumentProcessingToolkit has a server-side request forgery (SSRF, a vulnerability where an attacker tricks a server into fetching URLs it shouldn't access) vulnerability in its extract_document_content tool. Attackers can use prompt injection (tricking an AI by hiding instructions in its input) to supply malicious URLs that make the server fetch internal resources, and the results are sent back to the AI agent where the attacker can see them.