PyPI/docling CVE-2026-105750: medium 5.9, EPSS 0.40%

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Action: Upgrade docling to 2.118.1 or later.

pip install docling==2.118.1

Affected

Fixed versions

Sources

• osv: GHSA-q43m-vhcp-mhvm
• https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm
• https://github.com/docling-project/docling/pull/3948
• https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a
• https://github.com/docling-project/docling
• https://github.com/docling-project/docling/releases/tag/v2.118.1

CVE-2026-105750 · published 2026-10-06T00:02:27Z · modified 2026-10-15T14:56:09.321370624Z · JSON