docling
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 20 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from January 22, 2026 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Docling: KServe v2 OCR engine does not enforce enable_remote_services
Docling: Plugin entry points are imported before the allow_external_plugins check
Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)
Docling: Configured HTTP headers sent to every remote image host named by a document
Monitor docling in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.