Read the docs
TI-2026-68359 Aliases CVE-2026-105748GHSA-p944-4xh2-x776

Docling embeds local image files from crafted JSON documents

Priority MEDIUM 53CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Docling versions from 2.16.0 before 2.131.0 and docling-slim from 2.92.0 before 2.131.0 are affected. The JSON backend accepts picture image references that contain local paths or file URIs without rejecting them (CWE-73). An attacker who gets a user to process a crafted DoclingDocument JSON file can embed readable local image files into Markdown or HTML output. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial docling (docling-project): 2.131.0docling-slim (docling-project): 2.131.0+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
docling-projectdocling2.16.0 to before 2.131.02.131.0Patch availableCNA
docling-projectdocling-slim2.16.0 to before 2.131.02.131.0Patch availableCNA
—docling (PyPI)2.16.0 to before 2.131.02.131.0Patch availableGHSA-p944-4xh2-x776
—docling-slim (PyPI)2.92.0 to before 2.131.02.131.0Patch availableGHSA-p944-4xh2-x776
  • docling Vendordocling-project Affected 2.16.0 to before 2.131.0 Fixed in 2.131.0 Patch available CNA
  • docling-slim Vendordocling-project Affected 2.16.0 to before 2.131.0 Fixed in 2.131.0 Patch available CNA
  • docling (PyPI) Vendor— Affected 2.16.0 to before 2.131.0 Fixed in 2.131.0 Patch available GHSA-p944-4xh2-x776
  • docling-slim (PyPI) Vendor— Affected 2.92.0 to before 2.131.0 Fixed in 2.131.0 Patch available GHSA-p944-4xh2-x776

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*2.16.0 to before 2.131.0Vulnerabledocling-project
  • cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:* Versions 2.16.0 to before 2.131.0 Vulnerable ·docling-project

Remediation

Upgrade docling and docling-slim to 2.131.0, which fixes the flaw. Red Hat lists Lightspeed Core and Red Hat OpenShift AI (RHOAI) as affected with no available fix plan.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA docling (docling-project) Fixed in 2.131.0
  • Fix · CNA docling-slim (docling-project) Fixed in 2.131.0
  • Fix · GHSA-p944-4xh2-x776 docling (PyPI) Fixed in 2.131.0 Advisory →
  • Fix · GHSA-p944-4xh2-x776 docling-slim (PyPI) Fixed in 2.131.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105748
  2. 2026-10-06 Affected versions changed · Red Hat
  3. 2026-10-06 CVSS score added · Red Hat
  4. 2026-10-06 CISA SSVC decision points changed
  5. 2026-10-06 Priority changed: LOW → MEDIUM
  6. 2026-10-07 Alias added: GHSA-p944-4xh2-x776
  7. 2026-10-07 Fix available: PyPI/[email protected], PyPI/[email protected] · GHSA-p944-4xh2-x776
  8. 2026-10-07 CVSS score added · GHSA-p944-4xh2-x776
  9. 2026-10-07 Weakness changed · GHSA-p944-4xh2-x776
  10. 2026-10-07 6 new references · GHSA-p944-4xh2-x776

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-68355 Docling Tectonic TikZ rendering enables arbitrary file read/write CVSS 3.1HIGH 8.8
  • TI-2026-68362 Arbitrary local file read in Docling OpenDocument backend CVSS 4.0MEDIUM 6.9
  • TI-2026-68360 Docling table span parsing causes CPU and memory exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2026-68353 Docling sends configured HTTP headers to any remote image host CVSS 3.1MEDIUM 5.3
  • TI-2026-32061 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVSS 3.1HIGH 7.5
  • TI-2026-32058 Docling: Unsafe Zip Extraction in EasyOCR Model Download CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences