CVE-2026-24009

Katalog CVE

CVSS 9.8 · Critical EPSS 1,6%

Kerentanan Deserialization of Untrusted Data pada docling-core. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution. Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater.

Rincian

Terbit di NVD

22 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/docling-project/docling-core/security/advisories/GHSA-vqxf-v2gg-x3hc mitigasi · patch · advisory vendor
• https://github.com/docling-project/docling-core/commit/3e8d628eeeae50f0f8f239c8c7fea773d065d80c patch
• https://github.com/advisories/GHSA-8q59-q68h-6hv4 not applicable
• https://github.com/docling-project/docling-core/issues/482 issue tracking
• https://github.com/docling-project/docling-core/releases/tag/v2.48.4 product · release notes