PyPI/docling CVE-2026-105748: medium 4.3, EPSS 0.22%

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Action: Upgrade docling to 2.131.0 or later.

pip install docling==2.131.0

Affected

Fixed versions

Sources

• osv: GHSA-p944-4xh2-x776
• https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776
• https://nvd.nist.gov/vuln/detail/CVE-2026-105748
• https://github.com/docling-project/docling/pull/4417
• https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4
• https://github.com/docling-project/docling
• https://github.com/docling-project/docling/releases/tag/v2.131.0

CVE-2026-105748 · published 2026-10-07T20:41:08Z · modified 2026-10-15T14:55:52.070332506Z · JSON