CVE-2026-105745

The Docling library (versions 2.27.0 through 2.131.0 ) is vulnerable because plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before checking the allow_external_plugins setting. This sequence causes every module registered in the Docling entry-point ...