CVE-2026-105745

Katalog CVE

CVSS 7.8 · High EPSS 0,12%

Kerentanan Incorrect Behavior Order pada docling. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0.

Rincian

Terbit di NVD

5 Oktober 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-696: Incorrect Behavior Order
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq patch · advisory vendor
• https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c patch
• https://github.com/docling-project/docling/pull/4413 issue tracking · patch
• https://github.com/docling-project/docling/releases/tag/v2.131.0 release notes