docling-core vulnerabilities

3 known vulnerabilities in docling-core from Docling-project. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  docling-core: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-44023Jul 16, 2026Docling-project

  Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided C

• 8.1 High severity

  docling-core: External Control of File Name or Path

  CVE-2026-44019Jul 16, 2026Docling-project

  Docling Core defines core data types and transformations for the document processing application Docling. In versions 2.5.0 and above, prior to 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-

• 9.8 Critical severity

  docling-core: Deserialization of Untrusted Data

  CVE-2026-24009Jan 22, 2026Docling-projectEPSS 1.53%

  Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting