EUVD-2026-92808Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Triggering requires operator control of pipeline configuration (PR:H) and a specific non-default combination of remote OCR plus disabled remote services (AC:H); it is config-driven rather than network-attacker-driven (AV:L) with only low confidentiality impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker. This issue is fixed in 2.131.0.
AnalysisAI
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOptions, so page-image crops are still transmitted to the caller-configured KServe v2/Triton inference endpoint during PDF processing. The defect is a security-control bypass rather than attacker-driven exfiltration: the remote destination is chosen by the operator, the vulnerable code path is inert unless a second, non-default remote OCR engine is explicitly configured, and satisfying the assessed vector (AV:L/AC:H/PR:H) requires local access with high privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete conditions must all hold: (1) the caller configures OCR with KserveV2OcrOptions (a KServe v2 / Triton remote inference server, e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Docling 2.131.0 or later, which is the vendor-released patch that makes KserveV2OcrModel reject use without an explicit enable_remote_services=True by raising OperationNotAllowed before any client is created and correctly forwards the flag from StandardPdfPipeline._make_ocr_model; the release is published at https://github.com/docling-project/docling/releases/tag/v2.131.0 and details are in advisory GHSA-h42j-9hcc-3cwc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Docling Slim
View allLocal file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendO
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaus
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker e
Same weakness CWE-668 – Exposure of Resource to Wrong Sphere
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today