PyPI/docling CVE-2026-105751: medium, EPSS 0.42%

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Action: Upgrade docling to 2.120.3 or later.

pip install docling==2.120.3

Affected

Fixed versions

Sources

• osv: GHSA-4xhp-xg4w-8ppm
• https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm
• https://github.com/docling-project/docling/pull/4015
• https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311
• https://github.com/docling-project/docling
• https://github.com/docling-project/docling/releases/tag/v2.120.3

CVE-2026-105751 · published 2026-10-05T22:33:52Z · modified 2026-10-15T14:56:09.853280668Z · JSON