Deserialization of Untrusted Data

🗓️ 22 Jan 2026 18:02:45Reported by Snyk Security DatabaseType

Deserialization of untrusted YAML in docling-core load_from_yaml may execute arbitrary code with PyYAML below 5.4.

Reporter	Title	Published	Views	Family All 272
ibm	Security Bulletin: Critical Vulnerabilities in libraries used by libraries that IBM Spectrum discover is using (libraries of libraries)	28 Mar 202216:33	–	ibm
ibm	Security Bulletin: Vulnerability in PyYAML affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2020-14343]	11 Mar 202412:51	–	ibm
ibm	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.4 fixes multiple security vulnerabilities	15 Dec 202314:31	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
ibm	Security Bulletin: Cloud Pak for Security contains packages that have multiple vulnerabilities	1 Apr 202216:38	–	ibm
ibm	Security Bulletin: Vulnerability in PyYAML affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2020-14343]	26 Apr 202520:00	–	ibm
githubexploit	Exploit for CVE-2026-24009	26 Feb 202609:49	–	githubexploit
githubexploit	Exploit for Improper Input Validation in Pyyaml	13 Jul 202616:53	–	githubexploit
attackerkb	CVE-2026-24009	22 Jan 202615:04	–	attackerkb
attackerkb	CVE-2020-14343	9 Feb 202100:00	–	attackerkb

Vulners

Node

docling docling-coreRange2.21.0–2.48.4

Source	Link
security	www.security.snyk.io/vuln/SNYK-PYTHON-DOCLINGCORE-15091522
cwe	www.cwe.mitre.org/data/definitions/CWE-502.html

10 Apr 2026 01:14Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.18.1 - 9.8

CVSS 49.2

CVSS 210

EPSS0.05984

SSVC