EUVD-2026-92810
GHSA-p944-4xh2-x776
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Malicious JSON is network-deliverable (AV:N) and needs no attacker auth (PR:N), but the victim must re-convert and embed it (UI:R); disclosure is limited to Pillow-decodable images, so C:L with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 2 pypi packages depend on docling-slim (1 direct, 1 indirect)
Ecosystem-wide dependent count for version 2.92.0.
DescriptionCVE.org
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0.
AnalysisAI
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker embed local file paths or file: URIs inside a crafted DoclingDocument JSON that, when re-converted and enriched or exported with ImageRefMode.EMBEDDED, causes Docling to open and embed the referenced file's bytes into Markdown or HTML output. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3), no privileges are needed but the victim must actively load the malicious JSON, and exposure is constrained to files Pillow can decode as images, with differing decode behavior potentially revealing whether a path exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a victim to load an attacker-controlled DoclingDocument JSON through the InputFormat.JSON_DOCLING backend (docling/backend/json/docling_json_backend.py) in docling/docling-slim versions 2.16.0 through 2.130.x, AND to enrich or export it with ImageRefMode.EMBEDDED, which triggers DoclingDocument._with_embedded_pictures / ImageRef.pil_image to open the referenced path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-severity (CVSS 4.3) information-disclosure issue, not a top priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 2.131.0 - upgrade Docling (and docling-slim) to 2.131.0 or later, as documented in the GHSA advisory (https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776) and release tag v2.131.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Docling Slim
View allLocal file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOp
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendO
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaus
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today