CVE-2026-105748 · GHSA-p944-4xh2-x776
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
- Risk score
- 40/100
- CVSS
- 4.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image refer…
- Affected
- docling (pip) >= 2.16.0, < 2.131.0; docling-slim (pip) >= 2.92.0, < 2.131.0
- Fix
- Upgrade docling to 2.131.0; docling-slim to 2.131.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
docling: Amber, patch this week. Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
The flaws
- CVE-2026-105748: Docling: Crafted DoclingDocument JSON embeds local image files into converted output (CVSS 4.3 · EPSS 0%)
- CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 8.8 · EPSS 0%)
- CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 7.5 · EPSS 0%)
- CVE-2026-105750: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (CVSS 7.5 · EPSS 0%)
The fix
Upgrade docling: 2.131.0 · 2.132.0 · 2.120.3 · 2.118.1 or later on your release line
Who is exposed: docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-73 (CWE-73). 57 other warnings in 30 days
- Same product: Earlier docling warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 4.3 medium
- Public exploit or proof of concept referenced
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| docling | pip | >= 2.16.0, < 2.131.0 | 2.131.0 |
| docling-slim | pip | >= 2.92.0, < 2.131.0 | 2.131.0 |
References
- https://github.com/advisories/GHSA-p944-4xh2-x776
- https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776
- https://nvd.nist.gov/vuln/detail/CVE-2026-105748
- https://github.com/docling-project/docling/pull/4417
- https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4
- https://github.com/docling-project/docling/releases/tag/v2.131.0
- https://github.com/advisories/GHSA-p944-4xh2-x776
Original description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.