PyPI/docling-slim CVE-2026-105748: medium 4.3, EPSS 0.22%

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Action: Upgrade docling-slim to 2.131.0 or later.

pip install docling-slim==2.131.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4213
• https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776
• https://nvd.nist.gov/vuln/detail/CVE-2026-105748
• https://github.com/docling-project/docling/pull/4417
• https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4
• https://github.com/docling-project/docling
• https://github.com/docling-project/docling/releases/tag/v2.131.0
• https://pypi.org/project/docling-slim
• https://github.com/advisories/GHSA-p944-4xh2-x776

CVE-2026-105748 · published 2026-10-15T10:22:49.274424Z · modified 2026-10-15T14:55:52.070332506Z · JSON