CVE-2026-105745 · GHSA-9jxx-vjrv-h2rq
Docling imports plugin entry points before the allow_external_plugins check
- Risk score
- 52/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every …
- Affected
- docling (pip) >= 2.27.0, < 2.131.0; docling-slim (pip) >= 2.92.0, < 2.131.0
- Fix
- Upgrade docling to 2.131.0; docling-slim to 2.131.0 or later.
- Exploitation
- No known exploitation
Story map
At a glance
docling: Amber, patch this week. Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
The flaws
- CVE-2026-105745: Docling imports plugin entry points before the allow_external_plugins check (CVSS 7.8 · EPSS 0%)
- CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 8.8 · EPSS 0%)
- CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 7.5 · EPSS 0%)
- CVE-2026-105750: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (CVSS 7.5 · EPSS 0%)
The fix
Upgrade docling: 2.131.0 · 2.132.0 · 2.120.3 · 2.118.1 or later on your release line
Who is exposed: docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-696 (CWE-696). 6 other warnings in 30 days
- Same product: Earlier docling warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 7.8 high
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| docling | pip | >= 2.27.0, < 2.131.0 | 2.131.0 |
| docling-slim | pip | >= 2.92.0, < 2.131.0 | 2.131.0 |
References
- https://github.com/advisories/GHSA-9jxx-vjrv-h2rq
- https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq
- https://nvd.nist.gov/vuln/detail/CVE-2026-105745
- https://github.com/docling-project/docling/pull/4413
- https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c
- https://github.com/docling-project/docling/releases/tag/v2.131.0
- https://github.com/advisories/GHSA-9jxx-vjrv-h2rq
Original description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.