docling vulnerabilities (PyPI)
18 vulnerabilities.
-
doclingPyPI Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend 6.9 Medium -
doclingPyPI Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode 5.9 Medium -
doclingPyPI Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion 6.5 Medium -
doclingPyPI Docling: Crafted DoclingDocument JSON embeds local image files into converted output 4.3 Medium -
doclingPyPI Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) 4.3 Medium -
doclingPyPI Docling: KServe v2 OCR engine does not enforce enable_remote_services 2.2 Low -
doclingPyPI Docling: Plugin entry points are imported before the allow_external_plugins check 6.7 Medium -
doclingPyPI Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine 7.5 High -
doclingPyPI Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) 4.0 Medium -
doclingPyPI Docling: Configured HTTP headers sent to every remote image host named by a document 3.7 Low -
doclingPyPI Docling: Unsafe URI and Path Handling in HTML Backend 7.1 High -
doclingPyPI Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands 5.5 Medium -
doclingPyPI Docling: Unsafe XML Entity Expansion in USPTO Patent Backend 7.5 High -
doclingPyPI Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend 5.5 Medium -
doclingPyPI Docling: Unsafe Playwright-based HTML Rendering 8.2 High -
doclingPyPI Docling: Unsafe Zip Extraction in EasyOCR Model Download 7.5 High -
doclingPyPI Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks 7.5 High -
doclingPyPI Docling's JATS XML backend is vulnerable to XML Entity Expansion (XXE) attacks 7.5 High