p PatchFirst

CVE-2026-24009

CVE-2026-24009 · Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution. Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater.

CVSS 8.1 · High · EPSS 1.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • docling-core

    Versions
    • >= 2.21.0, < 2.48.4: Affected

    No fix published

  • docling-core PyPI

    Versions
    • 2.21.0
    • 2.21.1
    • 2.21.2
    • 2.22.0
    • 2.23.0
    • 2.23.1
    • 2.23.2
    • 2.23.3
    • 2.24.0
    • 2.24.1
    • 2.25.0
    • 2.26.0
    • 2.26.1
    • 2.26.2
    • 2.26.3
    • 2.26.4
    • 2.27.0
    • 2.28.0
    • 2.28.1
    • 2.29.0
    • 2.30.0
    • 2.30.1
    • 2.31.0
    • 2.31.1
    • 2.31.2
    • 2.32.0
    • 2.33.0
    • 2.33.1
    • 2.34.0
    • 2.34.1
    • 2.34.2
    • 2.35.0
    • 2.36.0
    • 2.37.0
    • 2.38.0
    • 2.38.1
    • 2.38.2
    • 2.39.0
    • 2.40.0
    • 2.41.0
    • 2.42.0
    • 2.43.0
    • 2.43.1
    • 2.44.0
    • 2.44.1
    • 2.44.2
    • 2.45.0
    • 2.46.0
    • 2.47.0
    • 2.48.0
    • 2.48.1
    • 2.48.2
    • 2.48.3
    Affected ranges
    • ECOSYSTEM: ≥ 2.21.0, < 2.48.4

    Update to 2.48.4

Original sources

Check your server →