{"schema":"threatline.record/2","record":{"id":"CVE-2026-105745","aliases":["GHSA-9jxx-vjrv-h2rq","PYSEC-2026-4192","PYSEC-2026-4210"],"summary":"Docling imports plugin entry points before the allow_external_plugins check","details":"### Summary\n\n`allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's `load_setuptools_entrypoints()`, which imports every module registered under docling's plugin entry-point group. Only afterwards does docling filter out modules outside the `docling.` namespace. Import-time code in any installed third-party plugin therefore runs even though external plugins are disabled.\n\n### Details\n\nIn `docling/models/factories/base_factory.py`, `load_from_plugins()` loads all entry points first and applies the `allow_external_plugins` check only to the already-imported modules. The CLI creates these factories when it starts, so running `docling` imports every registered plugin module. A log message says the plugin \"will not be loaded\", although its module has already been imported.\n\n### Affected configurations\n\nEnvironments in which a package registering a docling plugin entry point is installed, for example an unvetted or compromised dependency, and which rely on `allow_external_plugins=False` to keep that code from running.\n\n### Impact\n\nExecution of a third-party plugin module's import-time code in the docling process, contrary to the documented behaviour of `allow_external_plugins=False`.\n\n### Patches\n\nFixed in docling 2.131.0 by [#4413](https://github.com/docling-project/docling/pull/4413). Plugin entry points are now filtered by module name before they are loaded, so with `allow_external_plugins=False` third-party plugin modules are no longer imported.\n\n### Workarounds\n\nUpgrade to 2.131.0. For older versions:\n\nOnly install trusted packages in environments that run docling. Check which packages register docling plugin entry points with `importlib.metadata.entry_points()`.","categories":["Libraries & packages"],"product":"docling","vendor":"docling-project","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-07T20:40:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling"},"range":">= 2.27.0, < 2.131.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-07T20:40:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling-slim"},"range":">= 2.92.0, < 2.131.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105745","source_modified_at":"2026-10-06T14:48:57.716Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"docling","vendor":"docling-project","versions":[{"version":">= 2.27.0, < 2.131.0","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-105745","source_modified_at":"2026-10-06T14:48:57.716Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"docling-slim","vendor":"docling-project","versions":[{"version":">= 2.27.0, < 2.131.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-15T14:55:41.958960612Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"docling","ecosystem":"PyPI","purl":"pkg:pypi/docling"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.27.0"},{"fixed":"2.131.0"}]}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.118.1","2.119.0","2.120.1","2.120.2","2.120.3","2.121.0","2.122.0","2.123.0","2.123.1","2.124.0","2.125.0","2.126.0","2.127.0","2.128.0","2.129.0","2.130.0","2.27.0","2.28.0","2.28.1","2.28.2","2.28.3","2.28.4","2.29.0","2.30.0","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-15T14:55:41.958960612Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"docling-slim","ecosystem":"PyPI","purl":"pkg:pypi/docling-slim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.92.0"},{"fixed":"2.131.0"}]}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.118.1","2.119.0","2.120.1","2.120.2","2.120.3","2.121.0","2.122.0","2.123.0","2.123.1","2.124.0","2.125.0","2.126.0","2.127.0","2.128.0","2.129.0","2.130.0","2.92.0","2.93.0","2.94.0","2.95.0","2.96.0","2.96.1","2.97.0","2.98.0","2.99.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-07T20:40:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling"},"version":"2.131.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-07T20:40:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"docling-slim"},"version":"2.131.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-15T14:55:41.958960612Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"docling","ecosystem":"PyPI","purl":"pkg:pypi/docling"},"version":"2.131.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-9jxx-vjrv-h2rq","source_modified_at":"2026-10-15T14:55:41.958960612Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"docling-slim","ecosystem":"PyPI","purl":"pkg:pypi/docling-slim"},"version":"2.131.0"}],"cvss":6.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.0012,"percentile":0.01738,"score_date":"2026-10-23"},"published_at":"2026-10-05T21:29:23.561Z","modified_at":"2026-10-15T14:55:41.958960612Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T20:40:57Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-105745","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-06T14:48:57.716Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-9jxx-vjrv-h2rq","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-15T14:55:41.958960612Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105745","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105745","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/docling-project/docling/pull/4413","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/docling-project/docling/releases/tag/v2.131.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-06T14:35:59.694379Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T14:55:41.958960612Z","content_hash":"8dabd44ac22164501cf2554f917c570e6d4ea83673aa1182a8e43c5497547aa0"}}