cyfenced.com →

[ CVE-2026-105745 · Published 5 Oct 2026 ]

Docling imports plugin entry points before the allow_external_plugins check

CVSS 7.8 EPSS <1%Fix available

[ Description ]Official description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0.

[ Fixes ]Fixes and patches

  • docling 2.131.0Fixed version · GitHub Advisories · pip package docling: upgrade to 2.131.0 or later (affected >= 2.27.0, < 2.131.0)
  • docling-slim 2.131.0Fixed version · GitHub Advisories · pip package docling-slim: upgrade to 2.131.0 or later (affected >= 2.92.0, < 2.131.0)
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
  • Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ Packages ]Affected open-source packages

[ References ]References