Read the docs
TI-2026-68361 Aliases CVE-2026-105750GHSA-q43m-vhcp-mhvm

Docling ignores enable_local_fetch in HTML browser rendering mode

Priority LOW 33CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-552 and CWE-863.

Summary

Docling from 2.82.0 before 2.118.1 and docling-slim from 2.92.0 before 2.118.1 do not enforce the enable_local_fetch setting in HTML browser-rendering mode. The HTML backend permits file URLs, so local requests are not confined to the source document directory (CWE-552). An attacker who supplies crafted HTML as a filesystem path can embed a readable local text file in the rendered page image when Playwright is installed. Stream inputs, the default configuration and non-rendering backends are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Partial docling (docling-project): 2.118.1docling-slim (docling-project): 2.118.1+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
docling-projectdocling2.82.0 to before 2.118.12.118.1Patch availableCNA
docling-projectdocling-slim2.92.0 to before 2.118.12.118.1Patch availableCNA
—docling (PyPI)2.82.0 to before 2.118.12.118.1Patch availableGHSA-q43m-vhcp-mhvm
—docling-slim (PyPI)2.92.0 to before 2.118.12.118.1Patch availableGHSA-q43m-vhcp-mhvm
  • docling Vendordocling-project Affected 2.82.0 to before 2.118.1 Fixed in 2.118.1 Patch available CNA
  • docling-slim Vendordocling-project Affected 2.92.0 to before 2.118.1 Fixed in 2.118.1 Patch available CNA
  • docling (PyPI) Vendor— Affected 2.82.0 to before 2.118.1 Fixed in 2.118.1 Patch available GHSA-q43m-vhcp-mhvm
  • docling-slim (PyPI) Vendor— Affected 2.92.0 to before 2.118.1 Fixed in 2.118.1 Patch available GHSA-q43m-vhcp-mhvm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*2.82.0 to before 2.118.1Vulnerabledocling-project
  • cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:* Versions 2.82.0 to before 2.118.1 Vulnerable ·docling-project

Remediation

Upgrade docling and docling-slim to 2.118.1. Red Hat rates the issue Moderate and lists Lightspeed Core and Red Hat OpenShift AI (RHOAI) as affected without a fix, with the plan none available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA docling (docling-project) Fixed in 2.118.1
  • Fix · CNA docling-slim (docling-project) Fixed in 2.118.1
  • Fix · GHSA-q43m-vhcp-mhvm docling (PyPI) Fixed in 2.118.1 Advisory →
  • Fix · GHSA-q43m-vhcp-mhvm docling-slim (PyPI) Fixed in 2.118.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Lightspeed CoreAffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105750
  2. 2026-10-06 Alias added: GHSA-q43m-vhcp-mhvm
  3. 2026-10-06 Fix available: PyPI/[email protected], PyPI/[email protected] · GHSA-q43m-vhcp-mhvm
  4. 2026-10-06 CVSS score added · GHSA-q43m-vhcp-mhvm
  5. 2026-10-06 Weakness changed · GHSA-q43m-vhcp-mhvm
  6. 2026-10-06 5 new references · GHSA-q43m-vhcp-mhvm
  7. 2026-10-06 Affected versions changed · Red Hat
  8. 2026-10-06 CVSS score added · Red Hat
  9. 2026-10-06 CISA SSVC decision points changed
  10. 2026-10-06 Priority changed: MEDIUM → LOW
  11. 2026-10-07 CVSS score added · NVD

References

Patch 3

Other 2

  • TI-2026-68355 Docling Tectonic TikZ rendering enables arbitrary file read/write CVSS 3.1HIGH 8.8
  • TI-2026-68362 Arbitrary local file read in Docling OpenDocument backend CVSS 4.0MEDIUM 6.9
  • TI-2026-68360 Docling table span parsing causes CPU and memory exhaustion CVSS 3.1MEDIUM 6.5
  • TI-2026-68353 Docling sends configured HTTP headers to any remote image host CVSS 3.1MEDIUM 5.3
  • TI-2026-68359 Docling embeds local image files from crafted JSON documents CVSS 3.1MEDIUM 4.3
  • TI-2026-32061 Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences