Vulnerability	Vulnerable Version
H Arbitrary Argument Injection Affected versions of this package are vulnerable to Arbitrary Argument Injection via the `DoclingProducer` custom CLI argument handling in `camel-docling`. An attacker can pass untrusted values through the `CamelDoclingCustomArguments` header to make the producer append unintended `docling` flags or path arguments when it launches the external `docling` process. This lets a route that forwards attacker-controlled message content into those headers alter the subprocess invocation, including supplying traversal-prone path values that escape the intended directory and changing how document conversion runs for the user. How to fix Arbitrary Argument Injection? Upgrade `org.apache.camel:camel-docling` to version 4.18.3 or higher.	[,4.18.3)

Arbitrary Argument Injection

Affected versions of this package are vulnerable to Arbitrary Argument Injection via the DoclingProducer custom CLI argument handling in camel-docling. An attacker can pass untrusted values through the CamelDoclingCustomArguments header to make the producer append unintended docling flags or path arguments when it launches the external docling process. This lets a route that forwards attacker-controlled message content into those headers alter the subprocess invocation, including supplying traversal-prone path values that escape the intended directory and changing how document conversion runs for the user.

How to fix Arbitrary Argument Injection?

Upgrade org.apache.camel:camel-docling to version 4.18.3 or higher.

[,4.18.3)

Go back to all versions of this package