docling-slim 2.92.0

Direct Vulnerabilities

Known vulnerabilities in the docling-slim package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M External Control of File Name or Path docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to External Control of File Name or Path via the `DoclingJSONBackend` when processing a `DoclingDocument` JSON input containing `ImageRef` fields with local filesystem paths or `file://` URIs. An attacker who can supply a malicious JSON document can cause the converter to open arbitrary local files on the host, which are then read by enrichment models or embedded-image export stages, exposing their contents. Note: This is only exploitable when the application accepts `InputFormat.JSON_DOCLING` input, which is enabled by default. How to fix External Control of File Name or Path? Upgrade `docling-slim` to version 2.131.0 or higher.	[2.92.0,2.131.0)
M Improper Handling of Highly Compressed Data (Data Amplification) docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the METS-GBS backend's archive processing in `docling/backend/mets_gbs_backend.py`, where `max_member_count` is enforced only after the full member list has been built by `TarFile.getmembers()`. An attacker can supply a TAR archive containing an excessive number of members, causing the process to read all headers before the limit is applied, leading to unbounded resource consumption and a crash. How to fix Improper Handling of Highly Compressed Data (Data Amplification)? Upgrade `docling-slim` to version 2.131.0 or higher.	[2.92.0,2.131.0)
M Time-of-check Time-of-use (TOCTOU) Race Condition docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the HTML backend's remote fetch logic in `html_backend.py` and `image_resource_loader.py`, when remote fetching is enabled. An attacker can supply a document containing URLs that resolve to internal or otherwise restricted network addresses (including IPv4 addresses embedded in IPv6 addresses), causing the backend to issue requests to those addresses without validation. Redirects are followed without per-hop address validation, and configured `HTMLBackendOptions.headers` (which may carry credentials or tokens) are forwarded to cross-origin destinations reached through redirects. Note: This is only exploitable when `enable_remote_fetch=True` is explicitly set, as remote fetching is disabled by default. When a proxy is configured through environment variables, requests go through the proxy, which is then responsible for filtering destinations. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `docling-slim` to version 2.132.0 or higher.	[,2.132.0)
M Incorrect Behavior Order docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Incorrect Behavior Order via `load_from_plugins()` in `docling/models/factories/base_factory.py`, which previously called pluggy's `load_setuptools_entrypoints()` to import all modules registered under the docling entry-point group before checking whether they belonged to the docling namespace. An attacker who can register a malicious third-party package under the docling entry-point group on the target system can cause that package's module to be imported and its code executed, even when `allow_external_plugins=False` is configured. The namespace check ran after import, meaning the guard was ineffective at preventing code execution from untrusted plugins. How to fix Incorrect Behavior Order? Upgrade `docling-slim` to version 2.131.0 or higher.	[2.92.0,2.131.0)
H Denial of Service (DoS) docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Denial of Service (DoS) via oversized `rowspan`/`colspan` values in table cells processed by the HTML, JATS, BoxNote, and OpenDocument backends. An attacker can supply a document containing table cells that declare span values far larger than the actual table dimensions, causing the grid allocation and fill loops to be sized from the declared span rather than from the real table, resulting in unbounded memory and CPU consumption that crashes the process. How to fix Denial of Service (DoS)? Upgrade `docling-slim` to version 2.131.0 or higher.	[2.92.0,2.131.0)
L Exposure of Resource to Wrong Sphere docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the `KserveV2OcrModel` class in `docling/models/stages/ocr/kserve_v2_ocr_model.py`, which contacts a remote KServe v2 inference server without checking the `enable_remote_services` flag. Unlike all other remote engines in the pipeline, this engine unconditionally establishes an outbound connection to the configured inference server, bypassing the authorization gate that is meant to require explicit user opt-in before any remote service contact occurs. An attacker or misconfigured deployment can cause the application to exfiltrate page-crop image data to an unintended remote endpoint. Note: This is only exploitable when the KServe v2 OCR engine (`KserveV2OcrOptions`) is selected as the OCR backend. How to fix Exposure of Resource to Wrong Sphere? Upgrade `docling-slim` to version 2.131.0 or higher.	[2.92.0,2.131.0)
H Files or Directories Accessible to External Parties docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the HTML render path in `html_backend.py`, which implicitly allows arbitrary `file:` scheme requests when rendering HTML documents. An attacker who can supply a malicious HTML file can cause the renderer to fetch arbitrary local files from the filesystem, leaking sensitive data. Note: This is only exploitable when the HTML backend is used with `render_page=True` and a filesystem `Path` input; stream inputs, the default configuration (`render_page=False`), the `docling` CLI, `docling-serve`, and the EPUB, Markdown, XBRL, and email backends are not affected. How to fix Files or Directories Accessible to External Parties? Upgrade `docling-slim` to version 2.118.1 or higher.	[,2.118.1)

Vulnerability

Vulnerable Version

External Control of File Name or Path

docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications.

Affected versions of this package are vulnerable to External Control of File Name or Path via the DoclingJSONBackend when processing a DoclingDocument JSON input containing ImageRef fields with local filesystem paths or file:// URIs. An attacker who can supply a malicious JSON document can cause the converter to open arbitrary local files on the host, which are then read by enrichment models or embedded-image export stages, exposing their contents.

Note: This is only exploitable when the application accepts InputFormat.JSON_DOCLING input, which is enabled by default.

How to fix External Control of File Name or Path?

Upgrade docling-slim to version 2.131.0 or higher.

[2.92.0,2.131.0)

Improper Handling of Highly Compressed Data (Data Amplification)

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the METS-GBS backend's archive processing in docling/backend/mets_gbs_backend.py, where max_member_count is enforced only after the full member list has been built by TarFile.getmembers(). An attacker can supply a TAR archive containing an excessive number of members, causing the process to read all headers before the limit is applied, leading to unbounded resource consumption and a crash.

How to fix Improper Handling of Highly Compressed Data (Data Amplification)?

Upgrade docling-slim to version 2.131.0 or higher.

[2.92.0,2.131.0)

Time-of-check Time-of-use (TOCTOU) Race Condition

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition via the HTML backend's remote fetch logic in html_backend.py and image_resource_loader.py, when remote fetching is enabled. An attacker can supply a document containing URLs that resolve to internal or otherwise restricted network addresses (including IPv4 addresses embedded in IPv6 addresses), causing the backend to issue requests to those addresses without validation. Redirects are followed without per-hop address validation, and configured HTMLBackendOptions.headers (which may carry credentials or tokens) are forwarded to cross-origin destinations reached through redirects.

Note: This is only exploitable when enable_remote_fetch=True is explicitly set, as remote fetching is disabled by default. When a proxy is configured through environment variables, requests go through the proxy, which is then responsible for filtering destinations.

How to fix Time-of-check Time-of-use (TOCTOU) Race Condition?

Upgrade docling-slim to version 2.132.0 or higher.

[,2.132.0)

Incorrect Behavior Order

Affected versions of this package are vulnerable to Incorrect Behavior Order via load_from_plugins() in docling/models/factories/base_factory.py, which previously called pluggy's load_setuptools_entrypoints() to import all modules registered under the docling entry-point group before checking whether they belonged to the docling namespace. An attacker who can register a malicious third-party package under the docling entry-point group on the target system can cause that package's module to be imported and its code executed, even when allow_external_plugins=False is configured. The namespace check ran after import, meaning the guard was ineffective at preventing code execution from untrusted plugins.

How to fix Incorrect Behavior Order?

Upgrade docling-slim to version 2.131.0 or higher.

[2.92.0,2.131.0)

Denial of Service (DoS)

Affected versions of this package are vulnerable to Denial of Service (DoS) via oversized rowspan/colspan values in table cells processed by the HTML, JATS, BoxNote, and OpenDocument backends. An attacker can supply a document containing table cells that declare span values far larger than the actual table dimensions, causing the grid allocation and fill loops to be sized from the declared span rather than from the real table, resulting in unbounded memory and CPU consumption that crashes the process.

How to fix Denial of Service (DoS)?

Upgrade docling-slim to version 2.131.0 or higher.

[2.92.0,2.131.0)

Exposure of Resource to Wrong Sphere

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the KserveV2OcrModel class in docling/models/stages/ocr/kserve_v2_ocr_model.py, which contacts a remote KServe v2 inference server without checking the enable_remote_services flag. Unlike all other remote engines in the pipeline, this engine unconditionally establishes an outbound connection to the configured inference server, bypassing the authorization gate that is meant to require explicit user opt-in before any remote service contact occurs. An attacker or misconfigured deployment can cause the application to exfiltrate page-crop image data to an unintended remote endpoint.

Note: This is only exploitable when the KServe v2 OCR engine (KserveV2OcrOptions) is selected as the OCR backend.

How to fix Exposure of Resource to Wrong Sphere?

Upgrade docling-slim to version 2.131.0 or higher.

[2.92.0,2.131.0)

Files or Directories Accessible to External Parties

Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the HTML render path in html_backend.py, which implicitly allows arbitrary file: scheme requests when rendering HTML documents. An attacker who can supply a malicious HTML file can cause the renderer to fetch arbitrary local files from the filesystem, leaking sensitive data.

Note: This is only exploitable when the HTML backend is used with render_page=True and a filesystem Path input; stream inputs, the default configuration (render_page=False), the docling CLI, docling-serve, and the EPUB, Markdown, XBRL, and email backends are not affected.

How to fix Files or Directories Accessible to External Parties?

Upgrade docling-slim to version 2.118.1 or higher.

[,2.118.1)

docling-slim@2.92.0

Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically