Security
فارسی
All products

docling-slim

PyPI · Package
8 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering modeCVE-2026-105750 · GHSA-Q43M-VHCP-MHVMVersion ranges need review. docling-slimdocling PyPIRed Hat Medium Fix reported
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)CVE-2026-105743 · GHSA-PC36-QWJQ-X68CVersion ranges need review. docling-slimdocling PyPIRed Hat Medium Fix reported
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)CVE-2026-105747 · GHSA-3CR3-8M4C-FPXWVersion ranges need review. docling-slimdocling PyPIRed Hat Medium Fix reported
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustionCVE-2026-105749 · GHSA-CGC7-9QP3-86M3Version ranges need review. docling-slimdocling PyPIRed Hat Medium Fix reported
Docling: Crafted DoclingDocument JSON embeds local image files into converted outputCVE-2026-105748 · GHSA-P944-4XH2-X776Version ranges need review. docling-slimdocling PyPIRed Hat Medium Fix reported
Docling: Configured HTTP headers sent to every remote image host named by a documentCVE-2026-105742 · GHSA-P3FW-7699-7926Version ranges need review. docling-slimdocling PyPIRed Hat Low Fix reported
Docling imports plugin entry points before the allow_external_plugins checkCVE-2026-105745 · GHSA-9JXX-VJRV-H2RQVersion ranges need review. docling-slimdocling PyPIRed Hat Medium Fix reported
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engineCVE-2026-105744 · GHSA-X3Q2-H9HX-4R4JVersion ranges need review. docling-slimdocling PyPIRed Hat High Fix reported