docling-project docling vulnerabilities

Newest CVEs

• CVE-2026-105751

  Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

  docling-project · docling

  Medium6.9
• CVE-2026-105750

  Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

  docling-project · docling

  Medium5.9
• CVE-2026-105749

  Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

  docling-project · docling

  Medium6.5
• CVE-2026-105748

  Docling: Crafted DoclingDocument JSON embeds local image files into converted output

  docling-project · docling

  Medium4.3
• CVE-2026-105747

  Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

  docling-project · docling

  Medium4.3
• CVE-2026-105746

  Docling: KServe v2 OCR engine does not enforce enable_remote_services

  docling-project · docling

  Low2.2
• CVE-2026-105745

  Docling: Plugin entry points are imported before the allow_external_plugins check

  docling-project · docling

  Medium6.7
• CVE-2026-105744

  Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

  docling-project · docling

  High7.5
• CVE-2026-105743

  Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

  docling-project · docling

  Medium4.0
• CVE-2026-105742

  Docling: Configured HTTP headers sent to every remote image host named by a document

  docling-project · docling

  Low3.7