docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allowimagefileuri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.

Impact

A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core >=2.21.0, <2.48.4 and, specifically only if the application uses pyyaml < 5.4 and invokes doclingcore.types.doc.DoclingDocument.loadfromyaml() passing it untrusted YAML data.

Patches

The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching PyYAML deserialization from yaml.FullLoader to yaml.SafeLoader, ensuring that untrusted data cannot trigger code execution.

Workarounds

Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater, which supposedly patches CVE-2020-14343.

References

GitHub Issue: #482 Upstream Advisory: CVE-2020-14343 Fix Release: v2.48.4