Docling's October Advisories: When RAG Ingestion Reads Your Disk

Between 5 and 7 October 2026, the Docling project published nine security advisories, one of them high. Docling converts PDFs, Office files, HTML and other formats into structured text for AI and retrieval-augmented generation pipelines. That makes its threat model simple: it parses documents from people you don't control.

Several of the bugs let a crafted document read files from the machine doing the conversion and embed them in the output, which then lands in your vector store or goes back to the user. Others are small files that consume gigabytes of memory. Everything is fixed by docling 2.132.0, uploaded to PyPI on 1 October 2026.

What's affected

Packages: docling and docling-slim on PyPI. Fixed versions per advisory:

On by default, reachable by anyone who can submit a document:

• CVE-2026-105751: the OpenDocument backend resolved a draw:image xlink:href as a filesystem path when the part wasn't in the archive. A 452-byte .odt was enough to read an absolute path on the converting host. Only files that decode as images are embedded. Affects 2.107.0 onward, fixed in 2.120.3.
• CVE-2026-105748: the DoclingDocument JSON input format, on by default, accepted image URIs that are local paths. With embedded image export, the CLI default for Markdown and HTML, the image file was read into the output. Fixed in 2.131.0.
• CVE-2026-105749: unbounded rowspan and colspan in the HTML, JATS, ODS and BoxNote backends. The advisory measured a 52-byte file reaching 4.5 GB peak memory during Markdown export, and notes document_timeout does not bound it. Fixed in 2.131.0.
• CVE-2026-105747: the METS-GBS archive member limit was enforced only after enumerating every member. Fixed in 2.131.0.

Depends on your environment or options:

• CVE-2026-105745: allow_external_plugins=False, the default, still imported every installed third-party plugin module before filtering it out, so import-time code ran. This matters if an unvetted or compromised package registers a Docling plugin entry point. Fixed in 2.131.0.
• CVE-2026-105744 (high, 7.5): with the opt-in Tectonic engine for TikZ (LatexBackendOptions(tikz_engine="tectonic")), a .tex file could read and write arbitrary files, and run commands if shell escape was also enabled. Fixed in 2.132.0.
• CVE-2026-105743: with enable_remote_fetch=True, the private address check could be bypassed with DNS rebinding, multi-record answers or a backslash in the URL authority, and HTML render mode had no IP check at all. Fixed in 2.132.0.
• CVE-2026-105742 (low): configured HTTP headers went to every remote image host a document named. Fixed in 2.132.0.
• CVE-2026-105750: in HTML render mode (render_page=True), enable_local_fetch wasn't enforced, so an iframe pointing at a local file was rendered into the page image. Fixed in 2.118.1.

How to check if you're exposed

Check the version in every service and job that converts documents:

pip show docling docling-slim 2>/dev/null | grep -E '^(Name|Version)'

Docling often arrives as a dependency of a RAG framework or document loader rather than directly, so look for it in lockfiles too:

grep -rniE '^(docling|docling-slim)\b' requirements*.txt poetry.lock uv.lock 2>/dev/null
pip show docling 2>/dev/null | grep -i '^required-by'

You can also drop a requirements.txt into the free scan at gold.safeguard.sh/scan, which runs in the browser and checks up to 100 dependencies without uploading the file.

Then check which options you set:

grep -rnE 'enable_remote_fetch|enable_local_fetch|render_page|tikz_engine|allow_external_plugins|ImageRefMode' --include=*.py .

Finally, think about who supplies documents. A pipeline that converts files users upload, emails they send or URLs they paste is exposed to every default-on bug above. One that only converts your own internal documentation is not, though the plugin issue still applies.

What to do now

1. Upgrade docling (or docling-slim) to 2.132.0 or later. 2.140.0 is current.
2. Run conversion in an isolated worker: no cloud credentials, no access to other users' files, read-only filesystem except a scratch directory.
3. Restrict accepted input formats to what your product needs. If users only upload PDFs, don't let .odt, HTML or Docling JSON through.
4. Set memory limits on conversion workers so the span-based DoS kills one job, not the node.
5. Leave remote fetch, render mode and the Tectonic engine off for untrusted input.
6. Audit packages installed alongside Docling for plugin entry points. On affected versions, their import-time code ran whatever allow_external_plugins said.

Why it matters

Document parsing is the oldest attack surface in computing, and RAG put it back at the front of the pipeline. Every format Docling supports brings its own references to external resources, such as image links, archive members, TeX file primitives and iframes. Each one is a path from document content to your filesystem or network.

The output side matters as much as the input. When a parser embeds a local file into a converted document, that content flows into chunking, embeddings and retrieval. A secret read during ingestion can be returned to any user who asks the right question later.

Try it yourself

Find every service in one repository that depends on Docling, directly or through another package, and note its version. A dependency inventory shows the transitive path:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-4xhp-xg4w-8ppm: Local file read via draw:image in the OpenDocument backend (CVE-2026-105751)
• GHSA-p944-4xh2-x776: DoclingDocument JSON embeds local image files (CVE-2026-105748)
• GHSA-cgc7-9qp3-86m3: Unbounded table rowspan and colspan (CVE-2026-105749)
• GHSA-3cr3-8m4c-fpxw: METS-GBS archive member limit (CVE-2026-105747)
• GHSA-9jxx-vjrv-h2rq: Plugin entry points imported before the allow_external_plugins check (CVE-2026-105745)
• GHSA-x3q2-h9hx-4r4j: TikZ with the Tectonic engine (CVE-2026-105744)
• GHSA-pc36-qwjq-x68c: SSRF guard bypass in remote resource fetching (CVE-2026-105743)
• GHSA-p3fw-7699-7926: Configured headers sent to remote image hosts (CVE-2026-105742)
• GHSA-q43m-vhcp-mhvm: enable_local_fetch not enforced in render mode (CVE-2026-105750)
• docling on PyPI