CVE-2026-105743 · GHSA-pc36-qwjq-x68c
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
- Risk score
- 41/100
- CVSS
- 5.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and p…
- Affected
- docling (pip) >= 2.91.0, < 2.132.0; docling-slim (pip) >= 2.92.0, < 2.132.0
- Fix
- Upgrade docling to 2.132.0; docling-slim to 2.132.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
docling: Amber, patch this week. Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
The flaws
- CVE-2026-105743: Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) (CVSS 5.8 · EPSS 0%)
- CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 8.8 · EPSS 0%)
- CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 7.5 · EPSS 0%)
- CVE-2026-105750: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (CVSS 7.5 · EPSS 0%)
The fix
Upgrade docling: 2.132.0 · 2.120.3 · 2.118.1 or later on your release line
Who is exposed: docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-367 (CWE-367). 47 other warnings in 30 days
- Same product: Earlier docling warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 5.8 medium
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| docling | pip | >= 2.91.0, < 2.132.0 | 2.132.0 |
| docling-slim | pip | >= 2.92.0, < 2.132.0 | 2.132.0 |
References
- https://github.com/advisories/GHSA-pc36-qwjq-x68c
- https://github.com/docling-project/docling/security/advisories/GHSA-pc36-qwjq-x68c
- https://nvd.nist.gov/vuln/detail/CVE-2026-105743
- https://github.com/docling-project/docling/pull/4420
- https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb
- https://github.com/docling-project/docling/releases/tag/v2.132.0
- https://github.com/advisories/GHSA-pc36-qwjq-x68c
Original description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.91.0 until 2.132.0, validate_url_safety in docling/backend/utils/image_resource_loader.py validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination. Exploitation requires remote fetching to be enabled, and response content is exposed only when it is decoded as an image or passively rendered in a page screenshot. This issue is fixed in 2.132.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.