CVE-2026-105750 · GHSA-q43m-vhcp-mhvm
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
- Risk score
- 59/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting …
- Affected
- docling (pip) >= 2.82.0, < 2.118.1; docling-slim (pip) >= 2.92.0, < 2.118.1
- Fix
- Upgrade docling to 2.118.1; docling-slim to 2.118.1 or later.
- Exploitation
- No known exploitation
Story map
At a glance
docling: Amber, patch this week. Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
The flaws
- CVE-2026-105750: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (CVSS 7.5 · EPSS 0%)
- CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 8.8 · EPSS 0%)
- CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 7.5 · EPSS 0%)
- CVE-2026-105749: Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion (CVSS 6.5 · EPSS 0%)
The fix
Upgrade docling: 2.118.1 · 2.132.0 · 2.120.3 · 2.131.0 or later on your release line
Who is exposed: docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-552 (CWE-552). 17 other warnings in 30 days
- Same product: Earlier docling warnings. 6 in the last 90 days
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| docling | pip | >= 2.82.0, < 2.118.1 | 2.118.1 |
| docling-slim | pip | >= 2.92.0, < 2.118.1 | 2.118.1 |
References
- https://github.com/advisories/GHSA-q43m-vhcp-mhvm
- https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm
- https://github.com/docling-project/docling/pull/3948
- https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a
- https://github.com/docling-project/docling/releases/tag/v2.118.1
- https://github.com/advisories/GHSA-q43m-vhcp-mhvm
Original description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.
Last activity 5 Oct 2026. Patch Forecast updates every hour.