481 matches found
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
SummaryWhen the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can rea...
Docling imports plugin entry points before the allow_external_plugins check
Summaryallowexternalplugins=False the default, and the CLI default is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's loadsetuptoolsentrypoints, which imports every module registered under docling's plugin entry-point group. Only afterwards do...
PYSEC-2026-4210 Docling imports plugin entry points before the allow_external_plugins check
Summary allowexternalplugins=False the default, and the CLI default is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's loadsetuptoolsentrypoints, which imports every module registered under docling's plugin entry-point group. Only afterwards...
PYSEC-2026-4216 Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...
PYSEC-2026-4213 Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...
PYSEC-2026-4208 Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...
PYSEC-2026-4212 Docling: Configured HTTP headers sent to every remote image host named by a document
Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...
PYSEC-2026-4214 Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Summary When remote fetching is enabled enableremotefetch=True, together with fetchimages=True or HTML renderpage=True, docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request...
PYSEC-2026-4211 Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Summary The HTML, JATS, ODS OpenDocument spreadsheet and BoxNote backends accept table rowspan / colspan values without an upper bound. A few bytes of input, such as , make docling run loops proportional to the declared span and allocate a table grid of the declared size. The result is CPU and...
PYSEC-2026-4215 Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
Summary When the HTML backend renders pages in a headless browser HTMLBackendOptionsrenderpage=True, the enablelocalfetch option is not enforced. A crafted HTML file can embed an arbitrary local file for example with , and that file's contents appear in the page image attached to the returned...
PYSEC-2026-4209 Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Summary When docling detects the input format of a gzip-compressed tar archive METS-GBS, and later when the METS-GBS backend opens it, it calls tarfile.TarFile.getmembers. That builds the full member list in memory before the maxmembercount limit is checked. A small archive with a very large numb...
PYSEC-2026-4207 Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the...
CVE-2026-108749
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-108749
A flaw was found in docling-serve. An unauthenticated remote attacker can access sensitive process memory metrics and trigger internal garbage collection routines by querying memory monitoring endpoints that fail to enforce authentication controls. Successful exploitation allows an attacker to...
CVE-2026-108749 docling-serve 1.14.0 through 1.36.0 Missing Authentication via Memory Management Endpoints
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108749
A missing authentication vulnerability in docling-serve versions 1.14.0 through 1.36.0 allows unauthenticated remote attackers to access the /v1/memory/stats and /v1/memory/counts endpoints. The root cause is the omission of the require_auth dependency, enabling attackers to bypass the DOCLING_SE...
EUVD-2026-96914
docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access /v1/memory/stats and /v1/memory/counts because they omit the requireauth dependency. Attackers can bypass the configured DOCLINGSERVEAPIKEY to read process and cgrou...
CVE-2026-108749: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Arbitrary File Access
Docling is vulnerable to arbitrary file read and write. The vulnerability is due to the Tectonic engine compiling untrusted TikZ input without restricting file access, which allows an attacker to read accessible files and create or overwrite writable files, with potential command execution if she...