CVE-2026-44020 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString without protection against XML External Entity XXE attacks. An attacker could...

haiku-rag (>=0.19.2 <=0.33.0), iatoolkit (>=1.40.0 <=1.42.0) +19 more potentially affected by CVE-2026-44020 via docling (>=2.17.0 <=2.73.1)

docling PYPI version =2.17.0, =0.19.2, =1.40.0, =0.1.0, =0.2.1, =0.6.1, =0.4.0, =1.0.0, =0.1.29, =0.3.1, =0.10.0, =0.2.1, =0.2.6 and more Source cves: CVE-2026-44020 Source advisory: SNYK:PYTHON-DOCLING-17151850...