CVE-2026-24009
Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution. Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.5% · top 25% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
Affected products
docling-project · docling-core
- affected >= 2.21.0, < 2.48.4
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIdocling-coreGHSA-vqxf-v2gg-x3hc (opens in a new tab)
References (5)
- https://github.com/docling-project/docling-core/security/advisories/GHSA-vqxf-v2gg-x3hc (opens in a new tab)x_refsource_CONFIRM
- https://github.com/docling-project/docling-core/issues/482 (opens in a new tab)x_refsource_MISC
- https://github.com/docling-project/docling-core/commit/3e8d628eeeae50f0f8f239c8c7fea773d065d80c (opens in a new tab)x_refsource_MISC
- https://github.com/advisories/GHSA-8q59-q68h-6hv4 (opens in a new tab)x_refsource_MISC
- https://github.com/docling-project/docling-core/releases/tag/v2.48.4 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-vqxf-v2gg-x3hc (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-24009)Record last updated .