{"action":"Upgrade docling to 2.94.0 or later.","affected":[{"fixed":"2.94.0","introduced":"0"}],"component":"docling","cve_ids":["CVE-2026-47214"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["2.94.0"],"ghsa_id":"GHSA-q29v-xc37-wh5m","id":"tcs_01M5JJ2W91TSFHKSR4TQCS0TB2","modified_at":"2026-10-19T20:00:04.717120532Z","published_at":"2026-06-03T21:15:02Z","references":["https://osv.dev/vulnerability/GHSA-q29v-xc37-wh5m","https://github.com/docling-project/docling/security/advisories/GHSA-q29v-xc37-wh5m","https://nvd.nist.gov/vuln/detail/CVE-2026-47214","https://github.com/docling-project/docling/pull/3400","https://github.com/docling-project/docling/pull/3407","https://github.com/docling-project/docling","https://github.com/docling-project/docling/releases/tag/v2.91.0","https://github.com/docling-project/docling/releases/tag/v2.94.0","https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2146.yaml"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-q29v-xc37-wh5m","url":"https://osv.dev/vulnerability/GHSA-q29v-xc37-wh5m"}],"summary":"Docling: Unsafe URI and Path Handling in HTML Backend"}