PyPI/docling CVE-2026-105745: medium 6.7, EPSS 0.12%

Docling imports plugin entry points before the allow_external_plugins check

Action: Upgrade docling to 2.131.0 or later.

pip install docling==2.131.0

Affected

Fixed versions

Sources

• osv: GHSA-9jxx-vjrv-h2rq
• https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq
• https://nvd.nist.gov/vuln/detail/CVE-2026-105745
• https://github.com/docling-project/docling/pull/4413
• https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c
• https://github.com/docling-project/docling
• https://github.com/docling-project/docling/releases/tag/v2.131.0

CVE-2026-105745 · published 2026-10-07T20:40:56Z · modified 2026-10-15T14:55:41.958960612Z · JSON