Sensitive Information Disclosure

Docling is vulnerable to sensitive information disclosure. The vulnerability is due to the HTML image resource loader forwarding configured headers to remote image URLs without restricting them to the source document’s origin, which allows an attacker to expose configured credentials, such as API...

EUVD-2026-92802

Docling: Configured HTTP headers sent to every remote image host named by a document...

ai4rag (>=0.9.0, <=0.24.0), conexus (>=7.29.0, <=7.82.0) +16 more potentially affected by CVE-2026-105742 via docling-slim (>=2.95.0, <=2.131.0)

docling-slim PYPI version =2.95.0, =0.9.0, =7.29.0, =2.95.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.17.0, =0.7.0, =0.1.6, =0.3.0 and more Source cves: CVE-2026-105742 Source advisory: OSV:GHSA-P3FW-7699-7926...

Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

GHSA-P3FW-7699-7926 Docling: Configured HTTP headers sent to every remote image host named by a document

Summary HTMLBackendOptions.headers is documented for passing authentication headers API keys, bearer tokens when fetching remote images. docling sends these headers on every remote image request, to whichever host the document names. An untrusted document that references an attacker-controlled...

ai4rag (>=0.9.0, <=0.24.0), conexus (>=7.29.0, <=7.82.0) +16 more potentially affected by CVE-2026-105742 via docling-slim (>=2.95.0, <=2.131.0)

docling-slim PYPI version =2.95.0, =0.9.0, =7.29.0, =2.95.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.17.0, =0.7.0, =0.1.6, =0.3.0 and more Source cves: CVE-2026-105742 Source advisory: GHSA-P3FW-7699-7926...

ai4rag (>=0.9.0, <=0.24.0), askbase (>=1.0.0, <=1.0.2) +19 more potentially affected by CVE-2026-105743 via docling-slim (>=2.92.0, <=2.131.0)

docling-slim PYPI version =2.92.0, =0.9.0, =1.0.0, =7.29.0, =2.92.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.0.49, =1.0.0rc1, =0.17.0, =0.29.0 and more Source cves: CVE-2026-105743 Source advisory: OSV:GHSA-PC36-QWJQ-X68C...

GHSA-PC36-QWJQ-X68C Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Summary When remote fetching is enabled enableremotefetch=True, together with fetchimages=True or HTML renderpage=True, docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request...

EUVD-2026-92803

Docling has SSRF guard bypass in remote resource fetching DNS rebinding / multi-record resolution; no IP validation in HTML render mode...

Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

Summary When remote fetching is enabled enableremotefetch=True, together with fetchimages=True or HTML renderpage=True, docling's protection against requests to private and loopback addresses can be bypassed. - The URL check resolves the host name once, to a single IPv4 address. The HTTP request...

ai4rag (>=0.9.0, <=0.24.0), askbase (>=1.0.0, <=1.0.2) +19 more potentially affected by CVE-2026-105743 via docling-slim (>=2.92.0, <=2.131.0)

docling-slim PYPI version =2.92.0, =0.9.0, =1.0.0, =7.29.0, =2.92.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.0.49, =1.0.0rc1, =0.17.0, =0.29.0 and more Source cves: CVE-2026-105743 Source advisory: GHSA-PC36-QWJQ-X68C...

EUVD-2026-92804

Docling has arbitrary file read/write and command execution when shell-escape is enabled when rendering untrusted TikZ with the opt-in Tectonic engine...

ai4rag (>=0.9.0, <=0.24.0), conexus (>=7.29.0, <=7.82.0) +18 more potentially affected by CVE-2026-105744 via docling-slim (>=2.94.0, <=2.131.0)

docling-slim PYPI version =2.94.0, =0.9.0, =7.29.0, =2.94.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.0.49, =1.0.0rc1, =0.17.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-105744 Source advisory: GHSA-X3Q2-H9HX-4R4J...

GHSA-X3Q2-H9HX-4R4J Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

ai4rag (>=0.9.0, <=0.24.0), conexus (>=7.29.0, <=7.82.0) +18 more potentially affected by CVE-2026-105744 via docling-slim (>=2.94.0, <=2.131.0)

docling-slim PYPI version =2.94.0, =0.9.0, =7.29.0, =2.94.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.0.49, =1.0.0rc1, =0.17.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-105744 Source advisory: OSV:GHSA-X3Q2-H9HX-4R4J...

Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine LatexBackendOptionstikzengine="tectonic", the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can re...

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

GHSA-P944-4XH2-X776 Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary docling accepts serialized DoclingDocument JSON as an input format InputFormat.JSONDOCLING, enabled by default. A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images ImageRefMode.EMBEDDED, the CLI default for...

EUVD-2026-92810

Docling: Crafted DoclingDocument JSON embeds local image files into converted output...

ai4rag (>=0.9.0, <=0.24.0), askbase (>=1.0.0, <=1.0.2) +19 more potentially affected by CVE-2026-105748 via docling-slim (>=2.92.0, <=2.130.0)

docling-slim PYPI version =2.92.0, =0.9.0, =1.0.0, =7.29.0, =2.92.0, =2.120.1, =0.1.0, =0.3.19, =0.1.2, =0.3.0, =0.14.0, =0.0.49, =1.0.0rc1, =0.17.0, =0.29.0 and more Source cves: CVE-2026-105748 Source advisory: GHSA-P944-4XH2-X776...