CVE-2026-105745 is a Medium severity flaw in Docling, the document conversion library. From 2.27.0 until 2.131.0, plugin factories import every module in the Docling entry point group before checking allow_external_plugins, so import time code in a third party package runs even when plugins are off. Upgrade to 2.131.0.
What's affected
- Package: docling (pip), from 2.27.0 until 2.131.0.
- Package: docling-slim (pip), from 2.92.0 until 2.131.0, per the advisory.
- Fixed: 2.131.0.
- Condition: a package that registers a Docling plugin entry point is installed, for example an unvetted or compromised dependency, in an environment that relies on allow_external_plugins being off.
- Score: CVSS 6.7, Medium. The project advisory also says Moderate.
How to check if you're exposed
Docling is a Python package, and it also ships as docling-slim, so check both.
pip show docling docling-slim
pip freeze | grep -i docling
grep -ri "docling" requirements*.txt pyproject.toml poetry.lock uv.lock 2>/dev/null
Check services that convert uploaded documents, notebooks, batch jobs and container images. Then check how Docling is configured, because every Docling advisory in this series depends on a specific option or file type, as described above.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
Then review what else is installed next to Docling.
pip list
pip show -f PACKAGE_NAME
Run the second command for any package you do not recognise, and look for an entry points file in its file list. A package that registers a Docling plugin would declare it there. Anything unexpected deserves a closer look, and an unvetted package is reason enough to remove it.
What to do now
- Upgrade docling and docling-slim to 2.131.0 or later.
- Review the installed packages in every environment that runs Docling, and remove any you do not recognise.
- Pin your dependencies with hashes or a lockfile so a compromised release cannot slip in unnoticed.
- Do not treat the log line saying a plugin will not be loaded as proof it was not imported, on affected versions.
- Run conversion jobs under a least privilege account.
- Add dependency monitoring so new advisories on your plugins and on Docling reach you quickly.
Why it matters
The record lists CWE-829, inclusion of functionality from an untrusted control sphere, and CWE-696, incorrect behavior order. The order is the whole bug. Docling filtered plugin modules by name after loading them all, when it should have filtered before.
The advisory notes the log message says a plugin will not be loaded, although its module has already run. That is misleading to defenders: the safe looking setting appears to work while import time code still executes on startup.
Exploiting it needs a hostile package already installed, which is a supply chain scenario rather than a remote attack. That is why the severity is moderate. It is also why the topic matters: a compromised dependency is the standard starting point of supply chain attacks, and a switch that is supposed to contain plugins should hold. The record does not list the CVE as exploited in the wild.
Quick check
Can an outsider exploit this directly?
Not by itself. The advisory describes an installed third party or compromised package whose import time code runs when Docling starts.
What is the fix?
Per the pull request, entry points are filtered by module before loading, so external plugins are skipped without being imported.
Sources
- Docling GitHub security advisory GHSA-9jxx-vjrv-h2rq
- Docling release v2.131.0
- Docling pull request 4413
Last reviewed: 18 October 2026.
