Description (CNA)
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| docling-project / docling | affected >= 2.45.0, < 2.91.0 |
CWE
CWE-409, CWE-611, CWE-776
References
- https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv
- https://github.com/docling-project/docling/releases/tag/v2.91.0
ADP enrichment
No English description supplied.
No references supplied.