PyPI/docling CVE-2026-105751: unknown, EPSS 0.38%

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Action: Upgrade docling to 2.120.3 or later.

pip install docling==2.120.3

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4207
• https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm
• https://github.com/docling-project/docling/pull/4015
• https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311
• https://github.com/docling-project/docling
• https://github.com/docling-project/docling/releases/tag/v2.120.3
• https://pypi.org/project/docling
• https://github.com/advisories/GHSA-4xhp-xg4w-8ppm
• https://nvd.nist.gov/vuln/detail/CVE-2026-105751

CVE-2026-105751 · published 2026-10-15T10:22:44.379449Z · modified 2026-10-15T14:45:04.351743500Z · JSON