CVE-2026-105742 · GHSA-p3fw-7699-7926
Docling: Configured HTTP headers sent to every remote image host named by a document
- Risk score
- 44/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every …
- Affected
- docling (pip) >= 2.95.0, < 2.132.0; docling-slim (pip) >= 2.95.0, < 2.132.0
- Fix
- Upgrade docling to 2.132.0; docling-slim to 2.132.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
docling: Amber, patch this week. Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
The flaws
- CVE-2026-105742: Docling: Configured HTTP headers sent to every remote image host named by a document (CVSS 5.3 · EPSS 0%)
- CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 8.8 · EPSS 0%)
- CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 7.5 · EPSS 0%)
- CVE-2026-105750: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (CVSS 7.5 · EPSS 0%)
The fix
Upgrade docling: 2.132.0 · 2.120.3 · 2.118.1 or later on your release line
Who is exposed: docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-201 (CWE-201). 39 other warnings in 30 days
- Same product: Earlier docling warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 5.3 medium
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| docling | pip | >= 2.95.0, < 2.132.0 | 2.132.0 |
| docling-slim | pip | >= 2.95.0, < 2.132.0 | 2.132.0 |
References
- https://github.com/advisories/GHSA-p3fw-7699-7926
- https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926
- https://nvd.nist.gov/vuln/detail/CVE-2026-105742
- https://github.com/docling-project/docling/pull/4420
- https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb
- https://github.com/docling-project/docling/releases/tag/v2.132.0
- https://github.com/advisories/GHSA-p3fw-7699-7926
Original description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.