# docling (PyPI) vulnerabilities 18 known vulnerabilities (7 high, 9 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.149.0 (Nov 8, 2026): no advisory affects it - Newest unaffected release: 2.149.0 (Nov 8, 2026), the latest release - Weekly downloads: 904.2K - Dependents: 256 - Releases: 239 since 0.1.0 (Jul 15, 2024) - Registry: https://pypi.org/project/docling/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-105751: 2.107.0 to 2.120.2 (2.120.3 is outside it) - CVE-2026-105750: 2.82.0 to 2.118.0 (2.118.1 is outside it) - CVE-2026-105749: 2.0.0 to 2.130.0 (2.131.0 is outside it) - CVE-2026-105748: 2.16.0 to 2.130.0 (2.131.0 is outside it) - CVE-2026-105747: 2.45.0 to 2.130.0 (2.131.0 is outside it) - CVE-2026-105746: 2.83.0 to 2.130.0 (2.131.0 is outside it) - CVE-2026-105745: 2.27.0 to 2.130.0 (2.131.0 is outside it) - CVE-2026-105744: 2.94.0 to 2.131.0 (2.132.0 is outside it) - CVE-2026-105743: 2.91.0 to 2.131.0 (2.132.0 is outside it) - CVE-2026-105742: 2.95.0 to 2.131.0 (2.132.0 is outside it) - CVE-2026-47214: 0.1.0 to 2.93.0 (2.94.0 is outside it) - CVE-2026-44018: 2.45.0 to 2.90.0 (2.91.0 is outside it) - CVE-2026-44017: 0.1.0 to 2.90.0 (2.91.0 is outside it) - CVE-2026-44022: 2.73.0 to 2.90.0 (2.91.0 is outside it) - CVE-2026-44020: 2.13.0 to 2.73.1 (2.74.0 is outside it) - CVE-2026-44016: 2.82.0 to 2.90.0 (2.91.0 is outside it) - CVE-2026-31248: 0.1.0 to 2.61.0 (2.61.1 is outside it) - CVE-2026-31247: 0.1.0 to 2.61.0 (2.61.1 is outside it) ## Advisories (18) ### [CVE-2026-105751](https://cve.now/CVE-2026-105751): Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend - Severity: Medium 6.9 - Published: Oct 5, 2026 - Affected: from 2.107.0, fixed in 2.120.3. - Fixed in 2.120.3 (released Aug 18, 2026, 48 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105750](https://cve.now/CVE-2026-105750): Docling: \`enable\_local\_fetch\` is not enforced in HTML browser-rendering mode - Severity: Medium 5.9 - Published: Oct 5, 2026 - Affected: from 2.82.0, fixed in 2.118.1. - Fixed in 2.118.1 (released Aug 7, 2026, 59 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105749](https://cve.now/CVE-2026-105749): Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion - Severity: Medium 6.5 - Published: Oct 5, 2026 - Affected: from 2.0.0, fixed in 2.131.0. - Fixed in 2.131.0 (released Sep 29, 2026, 6 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105748](https://cve.now/CVE-2026-105748): Docling: Crafted DoclingDocument JSON embeds local image files into converted output - Severity: Medium 4.3 - Published: Oct 5, 2026 - Affected: from 2.16.0, fixed in 2.131.0. - Fixed in 2.131.0 (released Sep 29, 2026, 6 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105747](https://cve.now/CVE-2026-105747): Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) - Severity: Medium 4.3 - Published: Oct 5, 2026 - Affected: from 2.45.0, fixed in 2.131.0. - Fixed in 2.131.0 (released Sep 29, 2026, 6 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105746](https://cve.now/CVE-2026-105746): Docling: KServe v2 OCR engine does not enforce enable\_remote\_services - Severity: Low 2.2 - Published: Oct 5, 2026 - Affected: from 2.83.0, fixed in 2.131.0. - Fixed in 2.131.0 (released Sep 29, 2026, 6 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105745](https://cve.now/CVE-2026-105745): Docling: Plugin entry points are imported before the allow\_external\_plugins check - Severity: Medium 6.7 - Published: Oct 5, 2026 - Affected: from 2.27.0, fixed in 2.131.0. - Fixed in 2.131.0 (released Sep 29, 2026, 6 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105744](https://cve.now/CVE-2026-105744): Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine - Severity: High 7.5 - Published: Oct 5, 2026 - Affected: from 2.94.0, fixed in 2.132.0. - Fixed in 2.132.0 (released Oct 1, 2026, 4 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105743](https://cve.now/CVE-2026-105743): Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) - Severity: Medium 4.0 - Published: Oct 5, 2026 - Affected: from 2.91.0, fixed in 2.132.0. - Fixed in 2.132.0 (released Oct 1, 2026, 4 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-105742](https://cve.now/CVE-2026-105742): Docling: Configured HTTP headers sent to every remote image host named by a document - Severity: Low 3.7 - Published: Oct 5, 2026 - Affected: from 2.95.0, fixed in 2.132.0. - Fixed in 2.132.0 (released Oct 1, 2026, 4 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-47214](https://cve.now/CVE-2026-47214): Docling: Unsafe URI and Path Handling in HTML Backend - Severity: High 7.1 - Published: Jun 26, 2026 - Affected: fixed in 2.94.0. - Fixed in 2.94.0 (released May 18, 2026, 39 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-44018](https://cve.now/CVE-2026-44018): Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend - Severity: Medium 5.5 - Published: Jun 26, 2026 - Affected: from 2.45.0, fixed in 2.91.0. - Fixed in 2.91.0 (released Apr 23, 2026, 64 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-44017](https://cve.now/CVE-2026-44017): Docling: Unsafe Zip Extraction in EasyOCR Model Download - Severity: High 7.5 - Published: Jun 24, 2026 - Affected: fixed in 2.91.0. - Fixed in 2.91.0 (released Apr 23, 2026, 62 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-44022](https://cve.now/CVE-2026-44022): Docling: Potential Path Traversal via LaTeX \\includegraphics and \\input Commands - Severity: Medium 5.5 - Published: Jun 24, 2026 - Affected: from 2.73.0, fixed in 2.91.0. - Fixed in 2.91.0 (released Apr 23, 2026, 62 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-44020](https://cve.now/CVE-2026-44020): Docling: Unsafe XML Entity Expansion in USPTO Patent Backend - Severity: High 7.5 - Published: Jun 24, 2026 - Affected: from 2.13.0, fixed in 2.74.0. - Fixed in 2.74.0 (released Feb 17, 2026, 127 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-44016](https://cve.now/CVE-2026-44016): Docling: Unsafe Playwright-based HTML Rendering - Severity: High 8.2 - Published: Jun 24, 2026 - Affected: from 2.82.0, fixed in 2.91.0. - Fixed in 2.91.0 (released Apr 23, 2026, 62 days before disclosure). - The latest release, 2.149.0, is not affected. ### [CVE-2026-31248](https://cve.now/CVE-2026-31248): Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. - Severity: High 7.5 - Published: May 11, 2026 - Affected: through 2.61.0. - Fixed in 2.61.1 (released Nov 6, 2025, 186 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.149.0, is not affected. ### [CVE-2026-31247](https://cve.now/CVE-2026-31247): Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. - Severity: High 7.5 - Published: May 11, 2026 - Affected: through 2.61.0. - Fixed in 2.61.1 (released Nov 6, 2025, 186 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.149.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/docling Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.