data-prep-toolkit-transforms (>=0.2.1.dev0, <=0.2.1.dev2), data-prep-toolkit-transforms-ray (>=0.2.1.dev0, <=0.2.1.dev2) potentially affected by CVE-2026-47214 via docling (1.1.2)

docling PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - data-prep-toolkit-transforms =0.2.1.dev0, =0.2.1.dev0, =0.2.1.dev2 Source cves: CVE-2026-47214 Source advisory: OSV:PYSEC-2026-2146...

agentfoundry (1.2.9.1), ai4rag (>=0.8.0, <=0.8.1) +30 more potentially affected by CVE-2026-47214 via docling (>=2.8.1, <=2.93.0)

docling PYPI version =2.8.1, =0.8.0, =1.0.0, =0.1.0, =0.1.0, =0.19.2, =1.40.0, =0.6.2, =2.0.0, =0.0.1, =0.1.0, =0.2.1, =0.6.1, =0.6.3 - knowledgefeed 0.1.0 and more Source cves: CVE-2026-47214 Source advisory: OSV:PYSEC-2026-2146...

llama-index-readers-docling (0.1.0), quackling (>=0.0.1, <=0.4.1) potentially affected by CVE-2026-47214 via docling (1.20.0)

docling PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - llama-index-readers-docling 0.1.0 - quackling =0.0.1, =0.4.1 Source cves: CVE-2026-47214 Source advisory: OSV:PYSEC-2026-2146...

ai4rag (>=0.8.0, <=0.8.1), auto-survey (>=0.1.0, <=0.3.1) +15 more potentially affected by CVE-2026-44018 via docling (>=2.51.0, <=2.90.0)

docling PYPI version =2.51.0, =0.8.0, =0.1.0, =0.1.0, =0.19.2, =1.40.0, =0.0.1, =0.3.0, =1.0.0, =2026.2.27, =1.6.2, =1.6.2, =0.2.5rc5, =0.3.0 - smart-pdf-for-business 1.0.0 and more Source cves: CVE-2026-44018 Source advisory: OSV:PYSEC-2026-2144...

CVE-2026-47214

CVE-2026-47214 affects Docling’s HTML backend, where unsafe URI and path handling existed prior to version 2.94.0. The vulnerability enables potential local file access via file:// URIs, directory traversal through ../ sequences or absolute paths, and access to internal network resources when ena...

CVE-2026-47214 Docling: Unsafe URI and Path Handling in HTML Backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0...

CVE-2026-47214

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0...

agentfoundry (1.2.9.1), ai4rag (>=0.8.0, <=0.8.1) +34 more potentially affected by CVE-2026-47214 via docling (>=1.1.2, <=2.93.0)

docling PYPI version =1.1.2, =0.8.0, =1.0.0, =0.1.0, =0.1.0, =0.2.1.dev0, =0.2.1.dev0, =0.19.2, =1.40.0, =0.6.2, =2.0.0, =0.0.1, =0.1.0, =0.2.1, =0.3.3 and more Source cves: CVE-2026-47214 Source advisory: MEND:CVE-2026-47214...

CVE-2026-47214 Docling: Unsafe URI and Path Handling in HTML Backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0...

CVE-2026-47214 Docling: Unsafe URI and Path Handling in HTML Backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0...

ai4rag (>=0.8.0, <=0.8.1), auto-survey (>=0.1.0, <=0.3.1) +15 more potentially affected by CVE-2026-44018 via docling (>=2.51.0, <=2.90.0)

docling PYPI version =2.51.0, =0.8.0, =0.1.0, =0.1.0, =0.19.2, =1.40.0, =0.0.1, =0.3.0, =1.0.0, =2026.2.27, =1.6.2, =1.6.2, =0.2.5rc5, =0.3.0 - smart-pdf-for-business 1.0.0 and more Source cves: CVE-2026-44018 Source advisory: MEND:CVE-2026-44018...

CVE-2026-47214: External Control of File Name or Path

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0...

CVE-2026-44018: Improper Handling of Highly Compressed Data (Data Amplification)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS...

CVE-2026-44016

A flaw was found in Docling. If the HTML backend is explicitly configured for rendering, a remote attacker could exploit a vulnerability in the Playwright-based rendering feature by crafting malicious HTML documents. This could allow the attacker to execute arbitrary JavaScript or make unauthoriz...

CVE-2026-44020

A flaw was found in docling. An attacker could exploit an XML External Entity XXE vulnerability in the USPTO patent XML parser by crafting malicious XML files. This could allow the attacker to read arbitrary files from the server's filesystem, perform Server-Side Request Forgery SSRF attacks, or...

CVE-2026-44017

A flaw was found in Docling. The EasyOCR model download functionality improperly extracts ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker compromises the model download source e.g., via a supply chain or Man-in-the-Middle MITM attack, they could write...

data-prep-toolkit-transforms (>=0.2.1.dev0, <=0.2.1.dev2), data-prep-toolkit-transforms-ray (>=0.2.1.dev0, <=0.2.1.dev2) potentially affected by CVE-2026-44017 via docling (1.1.2)

docling PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - data-prep-toolkit-transforms =0.2.1.dev0, =0.2.1.dev0, =0.2.1.dev2 Source cves: CVE-2026-44017 Source advisory: OSV:PYSEC-2026-2143...

data-prep-toolkit-transforms (>=0.2.1.dev3, <=0.2.1) potentially affected by CVE-2026-44017 via docling (1.11.0)

docling PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - data-prep-toolkit-transforms =0.2.1.dev3, =0.2.1 Source cves: CVE-2026-44017 Source advisory: OSV:PYSEC-2026-2143...

llama-index-readers-docling (0.1.0), quackling (>=0.0.1, <=0.4.1) potentially affected by CVE-2026-44017 via docling (1.20.0)

docling PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - llama-index-readers-docling 0.1.0 - quackling =0.0.1, =0.4.1 Source cves: CVE-2026-44017 Source advisory: OSV:PYSEC-2026-2143...

agentfoundry (1.2.9.1), ai4rag (>=0.8.0, <=0.8.1) +29 more potentially affected by CVE-2026-44017 via docling (>=2.8.1, <=2.90.0)

docling PYPI version =2.8.1, =0.8.0, =0.1.0, =0.1.0, =0.19.2, =1.40.0, =0.6.2, =2.0.0, =0.0.1, =0.1.0, =0.2.1, =0.6.1, =1.0.1, =1.0.17 and more Source cves: CVE-2026-44017 Source advisory: OSV:PYSEC-2026-2143...