| Docling: Unsafe URI and Path Handling in HTML BackendCVE-2026-47214 · GHSA-Q29V-XC37-WH5MVersion ranges need review. |
docling |
PyPI |
High
|
Fix reported |
|
| Docling: `enable_local_fetch` is not enforced in HTML browser-rendering modeCVE-2026-105750 · GHSA-Q43M-VHCP-MHVMVersion ranges need review. |
docling-slimdocling |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backendCVE-2026-105751 · GHSA-4XHP-XG4W-8PPMVersion ranges need review. |
doclingLightspeed Core/lightspeed-core/rag-tool-cpu-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)CVE-2026-105743 · GHSA-PC36-QWJQ-X68CVersion ranges need review. |
docling-slimdocling |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)CVE-2026-105747 · GHSA-3CR3-8M4C-FPXWVersion ranges need review. |
docling-slimdocling |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustionCVE-2026-105749 · GHSA-CGC7-9QP3-86M3Version ranges need review. |
docling-slimdocling |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling: Crafted DoclingDocument JSON embeds local image files into converted outputCVE-2026-105748 · GHSA-P944-4XH2-X776Version ranges need review. |
docling-slimdocling |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling: Configured HTTP headers sent to every remote image host named by a documentCVE-2026-105742 · GHSA-P3FW-7699-7926Version ranges need review. |
docling-slimdocling |
PyPIRed Hat |
Low
|
Fix reported |
|
| Docling imports plugin entry points before the allow_external_plugins checkCVE-2026-105745 · GHSA-9JXX-VJRV-H2RQVersion ranges need review. |
docling-slimdocling |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engineCVE-2026-105744 · GHSA-X3Q2-H9HX-4R4JVersion ranges need review. |
docling-slimdocling |
PyPIRed Hat |
High
|
Fix reported |
|
| PYSEC-2026-4193CVE-2026-105746 · GHSA-H42J-9HCC-3CWC |
doclingLightspeed Core/lightspeed-core/rag-tool-cpu-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling: Unsafe Zip Extraction in EasyOCR Model DownloadCVE-2026-44017 · GHSA-CJQG-RQ2H-2FVJVersion ranges need review. |
docling |
PyPI |
High
|
Fix reported |
|
| Docling: Unsafe XML Entity Expansion in USPTO Patent BackendCVE-2026-44020 · GHSA-M88R-RG27-5XFGVersion ranges need review. |
docling |
PyPI |
High
|
Fix reported |
|
| Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS BackendCVE-2026-44018 · GHSA-R3XG-RG9J-67FVVersion ranges need review. |
docling |
PyPI |
Medium
|
Fix reported |
|
| Docling: Potential Path Traversal via LaTeX \includegraphics and \input CommandsCVE-2026-44022 · GHSA-2J5P-7P5M-CVQRVersion ranges need review. |
doclingRed Hat OpenShift AI (RHOAI)/rhoai/odh-autorag-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Docling: Unsafe Playwright-based HTML RenderingCVE-2026-44016 · GHSA-PJ2V-GGQH-CMQ2Version ranges need review. |
docling |
PyPI |
High
|
Fix reported |
|
| Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacksCVE-2026-31248 · GHSA-9F4Q-Q82Q-4359Version ranges need review. |
docling |
PyPI |
High
|
No fix reported |
|
| Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacksCVE-2026-31247 · GHSA-CR42-RG2M-MQ4QVersion ranges need review. |
docling |
PyPI |
High
|
No fix reported |
|
