docling-slim vulnerabilities (PyPI)
8 vulnerabilities.
-
docling-slimPyPI Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode 5.9 Medium -
docling-slimPyPI Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion 6.5 Medium -
docling-slimPyPI Docling: Crafted DoclingDocument JSON embeds local image files into converted output 4.3 Medium -
docling-slimPyPI Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) 4.3 Medium -
docling-slimPyPI Docling: Plugin entry points are imported before the allow_external_plugins check 6.7 Medium -
docling-slimPyPI Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine 7.5 High -
docling-slimPyPI Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) 4.0 Medium -
docling-slimPyPI Docling: Configured HTTP headers sent to every remote image host named by a document 3.7 Low