CVE-2026-47214High· 7.1▾ TwilightDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.4%
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.
docling < 2.94.0Upgrade past the affected range:
docling 2.94.0Affected packages:
docling < 2.94.0Patched in:
docling 2.94.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105748Medium· 4.3Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-105749Medium· 6.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-105744High· 7.5Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
CVE-2026-44018Medium· 5.5Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
CVE-2026-44016High· 8.2Docling: Unsafe Playwright-based HTML Rendering
CVE-2026-44017High· 7.5Docling: Unsafe Zip Extraction in EasyOCR Model Download