{"kind": "product", "path": "vulns/pypi/docling", "name": "docling", "product": "docling", "ecosystem": "PyPI", "items": [{"id": "CVE-2026-105751", "noindex": false, "published": "2026-10-05T21:40:45.997Z", "modified": "2026-10-06T16:36:34.080Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N", "severity": "medium", "epss": 0.00418, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105751", "title": "Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distin", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm", "https://github.com/docling-project/docling/pull/4015", "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311"], "fixes": ["2.120.3"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105750", "noindex": false, "published": "2026-10-05T21:38:28.098Z", "modified": "2026-10-06T18:17:27.884Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00397, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105750", "title": "Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, doclin", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm", "https://github.com/docling-project/docling/pull/3948", "https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a"], "fixes": ["2.118.1"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105749", "noindex": false, "published": "2026-10-05T21:36:53.431Z", "modified": "2026-10-08T02:29:09.184Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00291, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105749", "title": "Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.0.0 until 2.131.0, the HTML, JATS, OpenDocument spreadsheet, and BoxNote backends, including docling/backend/html_backend.py, docling/backend/jats_backend.py, and docling/backend/boxnote_backend.py, accept the rowspan and colspan attribute values without an upper bound and execute loops or allocate a table grid proportional to the declared span. A very small document can therefore cause sustained CPU use or multi-gigabyte memory allocation, and the document_timeout setting does not interrupt the single backend ", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-cgc7-9qp3-86m3", "https://github.com/docling-project/docling/pull/4414", "https://github.com/docling-project/docling/commit/c5b4429cc6500a344c13edeb22e67610c2159b09"], "fixes": ["2.131.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105748", "noindex": false, "published": "2026-10-05T21:34:25.628Z", "modified": "2026-10-06T14:17:25.343Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00304, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105748", "title": "Docling: Crafted DoclingDocument JSON embeds local image files into converted output", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as imag", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776", "https://github.com/docling-project/docling/pull/4417", "https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4"], "fixes": ["2.131.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105747", "noindex": false, "published": "2026-10-05T21:32:34.438Z", "modified": "2026-10-06T14:48:33.056Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00299, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105747", "title": "Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.131.0, METS-GBS format detection in docling/datamodel/document.py and the backend in docling/backend/mets_gbs_backend.py call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can therefore consume memory proportional to the declared member count, including during format detection before the allowed_formats r", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-3cr3-8m4c-fpxw", "https://github.com/docling-project/docling/pull/4412", "https://github.com/docling-project/docling/commit/ebae65cd71c37c88b36185b406a449b92d8f7ffa"], "fixes": ["2.131.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105746", "noindex": false, "published": "2026-10-05T21:31:12.354Z", "modified": "2026-10-06T16:40:40.755Z", "cvss": 2.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00223, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105746", "title": "Docling: KServe v2 OCR engine does not enforce enable_remote_services", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rat", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-h42j-9hcc-3cwc", "https://github.com/docling-project/docling/pull/4418", "https://github.com/docling-project/docling/commit/7d6d0c4810dff4885017c53890be6dc5a22ca68b"], "fixes": ["2.131.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105745", "noindex": false, "published": "2026-10-05T21:29:23.561Z", "modified": "2026-10-06T14:48:57.716Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "severity": "medium", "epss": 0.00121, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105745", "title": "Docling: Plugin entry points are imported before the allow_external_plugins check", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq", "https://github.com/docling-project/docling/pull/4413", "https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c"], "fixes": ["2.131.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105744", "noindex": false, "published": "2026-10-05T21:26:56.685Z", "modified": "2026-10-06T18:16:10.544Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00368, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105744", "title": "Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine=\"tectonic\") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \\openin and \\openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tect", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j", "https://github.com/docling-project/docling/pull/4419", "https://github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342"], "fixes": ["2.132.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105743", "noindex": false, "published": "2026-10-05T21:23:45.527Z", "modified": "2026-10-08T02:28:12.458Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N", "severity": "medium", "epss": 0.00201, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105743", "title": "Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetc", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-pc36-qwjq-x68c", "https://github.com/docling-project/docling/pull/4420", "https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb"], "fixes": ["2.132.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-105742", "noindex": false, "published": "2026-10-05T21:21:43.538Z", "modified": "2026-10-06T13:55:17.719Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00254, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-105742", "title": "Docling: Configured HTTP headers sent to every remote image host named by a document", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentia", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926", "https://github.com/docling-project/docling/pull/4420", "https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb"], "fixes": ["2.132.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-47214", "noindex": false, "published": "2026-06-26T15:45:04.659Z", "modified": "2026-06-26T18:41:52.977Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L", "severity": "high", "epss": 0.00373, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-47214", "title": "Docling: Unsafe URI and Path Handling in HTML Backend", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-q29v-xc37-wh5m", "https://github.com/docling-project/docling/releases/tag/v2.94.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-47214"], "fixes": ["2.94.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44018", "noindex": false, "published": "2026-06-26T15:40:42.422Z", "modified": "2026-06-26T19:13:39.619Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00161, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44018", "title": "Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv", "https://github.com/docling-project/docling/releases/tag/v2.91.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-44018"], "fixes": ["2.91.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44017", "noindex": false, "published": "2026-06-24T17:48:46.833Z", "modified": "2026-08-28T12:04:30.580Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00706, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44017", "title": "Docling: Unsafe Zip Extraction in EasyOCR Model Download", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.91.0, the EasyOCR model download functionality extracted ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker could compromise the model download source (via supply chain attack, DNS spoofing, or MITM), they could write arbitrary files to any location writable by the process, potentially achieving remote code execution by overwriting Python files or system binaries, persistent backdoors by modifying startup scripts or SSH keys, and data corruption or system compromise. Thi", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-cjqg-rq2h-2fvj", "https://github.com/docling-project/docling/releases/tag/v2.91.0", "https://access.redhat.com/security/cve/CVE-2026-44017"], "fixes": ["2.91.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44022", "noindex": false, "published": "2026-06-24T17:47:25.553Z", "modified": "2026-06-25T13:17:57.563Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00207, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44022", "title": "Docling: Potential Path Traversal via LaTeX \\includegraphics and \\input Commands", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handling of \\includegraphics, \\input, and \\include commands lacked path containment validation. Attackers could craft malicious LaTeX documents with path traversal sequences to read arbitrary files from the file system accessible to the process, include sensitive files in the converted document output, or potentially access configuration files, credentials, or other sensitive data This vulnerability is fixed in 2.91.0.", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-2j5p-7p5m-cvqr", "https://github.com/docling-project/docling/releases/tag/v2.91.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-44022"], "fixes": ["2.91.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44020", "noindex": false, "published": "2026-06-24T17:45:46.644Z", "modified": "2026-08-28T12:04:31.876Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00601, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44020", "title": "Docling: Unsafe XML Entity Expansion in USPTO Patent Backend", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks, or cause denial of service through entity expansion (Billion Laughs attack). The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and ", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-m88r-rg27-5xfg", "https://access.redhat.com/security/cve/CVE-2026-44020", "https://bugzilla.redhat.com/show_bug.cgi?id=2492456"], "fixes": ["2.74.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-44016", "noindex": false, "published": "2026-06-24T17:42:42.434Z", "modified": "2026-07-15T00:55:00.452Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "severity": "high", "epss": 0.00593, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-44016", "title": "Docling: Unsafe Playwright-based HTML Rendering", "description": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. FIn versions >= 2.82.0, < 2.91.0, if the HTML backend was explicitly configured for rendering (rendering option by default deactivated), then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An attacker could craft malicious HTML that executes arbitrary JavaScript in the rendering context or makes unauthorized network requests to internal services, potentially leading to SSRF attacks, data exfiltration, or remote code exec", "references": ["https://github.com/docling-project/docling/security/advisories/GHSA-pj2v-ggqh-cmq2", "https://github.com/docling-project/docling/releases/tag/v2.91.0", "https://access.redhat.com/security/cve/CVE-2026-44016"], "fixes": ["2.91.0"], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-31248", "noindex": false, "published": "2026-05-11T00:00:00.000Z", "modified": "2026-05-12T18:44:28.080Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00278, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-31248", "title": "CVE-2026-31248", "description": "Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML files from .tar.gz archives using etree.fromstring() without disabling entity resolution. An attacker can craft a malicious XML file with nested entity definitions (XML Bomb) and package it into a .tar.gz archive. When processed by Docling, the exponential expansion of entities during XML parsing leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.", "references": ["https://github.com/docling-project/docling", "https://www.notion.so/CVE-2026-31248-35d1e1393188818585b2ce3b9ce24686", "https://nvd.nist.gov/vuln/detail/CVE-2026-31248"], "fixes": [], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}, {"id": "CVE-2026-31247", "noindex": false, "published": "2026-05-11T00:00:00.000Z", "modified": "2026-05-12T18:42:55.864Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00351, "kev": false, "exploits": [], "stacks": [{"name": "python", "path": "vulns/stack/python", "slug": "python"}], "path": "vulns/cve-2026-31247", "title": "CVE-2026-31247", "description": "Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend uses etree.parse() to parse XML files without disabling entity resolution. An attacker can craft a malicious XML file containing a nested entity expansion payload (XML Bomb). When processed by Docling, the exponential expansion of entities leads to excessive resource consumption, resulting in a denial of service (DoS) condition on the system running the Docling parser.", "references": ["https://github.com/docling-project/docling", "https://www.notion.so/CVE-2026-31247-35d1e1393188818fa654c116c6a470bb", "https://nvd.nist.gov/vuln/detail/CVE-2026-31247"], "fixes": [], "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}]}], "total": 18, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "docling", "path": "vulns/pypi/docling", "ecosystem": "PyPI"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 10, "kev": 0}, "lastmod": "2026-10-08T02:29:09.184Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}