CVE-2026-24009: Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage
Impact
A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core >=2.21.0, <2.48.4 and, specifically only if the application uses pyyaml < 5.4 and invokes doclingcore.types.doc.DoclingDocument.loadfromyaml() passing it untrusted YAML data.
Patches
The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching PyYAML deserialization from yaml.FullLoader to yaml.SafeLoader, ensuring that untrusted data cannot trigger code execution.
Workarounds
Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater, which supposedly patches CVE-2020-14343.
References
GitHub Issue: #482 Upstream Advisory: CVE-2020-14343 Fix Release: v2.48.4
Other sources
Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes doclingcore.types.doc.DoclingDocument.loadfromyaml() passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching PyYAML deserialization from yaml.FullLoader to yaml.SafeLoader, ensuring that untrusted data cannot trigger code execution. Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24009?
CVE-2026-24009 is classified as a critical vulnerability due to the potential for Remote Code Execution.
How do I fix CVE-2026-24009?
To resolve CVE-2026-24009, upgrade the Docling Core library to a version that is above 2.48.4.
What systems are affected by CVE-2026-24009?
CVE-2026-24009 affects Docling Core versions between 2.21.0 and 2.48.4.
What exploit is described in CVE-2026-24009?
CVE-2026-24009 describes a Remote Code Execution vulnerability caused by unsafe usage of PyYAML.
Can CVE-2026-24009 lead to data breaches?
Yes, exploiting CVE-2026-24009 could result in unauthorized access to systems and sensitive data.