EUVD-2026-92802
GHSA-p3fw-7699-7926
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AV:N and PR:N since an unauthenticated document author triggers it remotely; AC:H for the required non-default config plus staged cross-origin redirect; C:H because leaked API keys/cookies are a direct, serious disclosure; I/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
4Blast Radius
ecosystem impact- 2 pypi packages depend on docling (2 direct, 0 indirect)
- 3 pypi packages depend on docling-slim (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 2.95.0 and other introduced versions.
DescriptionNVD
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0.
AnalysisAI
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendOptions.headers - to every remote image URL named by an untrusted HTML document, including after a cross-origin redirect, leaking the caller's credentials to whoever authored the document. The flaw lives in docling/backend/utils/image_resource_loader.py in versions 2.95.0 through 2.131.x and is only reachable in a deliberately non-default configuration where both enable_remote_fetch and fetch_images are enabled and sensitive headers have been configured; the default configuration carries no exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specifically-configured, non-default deployment: HTMLBackendOptions must have both enable_remote_fetch=True and fetch_images=True, AND the operator must have set HTMLBackendOptions.headers to include sensitive values (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue for most operators despite being a real credential-disclosure bug (CWE-201). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Docling 2.132.0 or later (release tag v2.132.0), which scopes HTMLBackendOptions.headers to the source document's origin by default and exposes headers_allowed_origins for explicitly naming additional trusted origins; the fix is also visible in PR #4420 and commit 5e469137f275ffc443306a30d12a3a45bceb80fb, with the advisory at https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Docling Slim
View allLocal file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOp
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaus
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker e
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today