PyPI/docling-slim CVE-2026-105750: medium 5.9, EPSS 0.40%

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Action: Upgrade docling-slim to 2.118.1 or later.

pip install docling-slim==2.118.1

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4215
• https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm
• https://github.com/docling-project/docling/pull/3948
• https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a
• https://github.com/docling-project/docling
• https://github.com/docling-project/docling/releases/tag/v2.118.1
• https://pypi.org/project/docling-slim
• https://github.com/advisories/GHSA-q43m-vhcp-mhvm
• https://nvd.nist.gov/vuln/detail/CVE-2026-105750

CVE-2026-105750 · published 2026-10-15T10:22:46.471738Z · modified 2026-10-15T14:56:09.321370624Z · JSON