All vulnerabilities
CVE-2026-105745GHSA-9jxx-vjrv-h2rqPYSEC-2026-4192PYSEC-2026-4210

Docling imports plugin entry points before the allow_external_plugins check

docling-project doclingpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.131.0Fixed versionGitHub
Published5 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 2.131.0docling, pipGitHub
  • 2.131.0docling-slim, pipGitHub
  • 2.131.0docling, PyPIOSVpip install "docling>=2.131.0"
  • 2.131.0docling-slim, PyPIOSVpip install "docling-slim>=2.131.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

allow_external_plugins=False (the default, and the CLI default) is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's load_setuptools_entrypoints(), which imports every module registered under docling's plugin entry-point group. Only afterwards does docling filter out modules outside the docling. namespace. Import-time code in any installed third-party plugin therefore runs even though external plugins are disabled.

Details

In docling/models/factories/base_factory.py, load_from_plugins() loads all entry points first and applies the allow_external_plugins check only to the already-imported modules. The CLI creates these factories when it starts, so running docling imports every registered plugin module. A log message says the plugin "will not be loaded", although its module has already been imported.

Affected configurations

Environments in which a package registering a docling plugin entry point is installed, for example an unvetted or compromised dependency, and which rely on allow_external_plugins=False to keep that code from running.

Impact

Execution of a third-party plugin module's import-time code in the docling process, contrary to the documented behaviour of allow_external_plugins=False.

Patches

Fixed in docling 2.131.0 by #4413. Plugin entry points are now filtered by module name before they are loaded, so with allow_external_plugins=False third-party plugin modules are no longer imported.

Workarounds

Upgrade to 2.131.0. For older versions:

Only install trusted packages in environments that run docling. Check which packages register docling plugin entry points with importlib.metadata.entry_points().

Text from GitHub Advisory Database

Affected versions 102

  • docling, pip>= 2.27.0, < 2.131.0GitHub
  • docling-slim, pip>= 2.92.0, < 2.131.0GitHub
  • doclingaffected: >= 2.27.0, < 2.131.0CVE List
  • docling-slimaffected: >= 2.27.0, < 2.131.0CVE List
  • docling, PyPIfrom 2.27.0, fixed in 2.131.0OSV
  • docling, PyPI2.100.0OSV
  • docling, PyPI2.101.0OSV
  • docling, PyPI2.102.0OSV
  • docling, PyPI2.102.1OSV
  • docling, PyPI2.102.2OSV
  • docling, PyPI2.103.0OSV
  • docling, PyPI2.104.0OSV
  • docling, PyPI2.105.0OSV
  • docling, PyPI2.106.0OSV
  • docling, PyPI2.107.0OSV
  • docling, PyPI2.108.0OSV
  • docling, PyPI2.109.0OSV
  • docling, PyPI2.110.0OSV
  • docling, PyPI2.111.0OSV
  • docling, PyPI2.112.0OSV
  • docling, PyPI2.113.0OSV
  • docling, PyPI2.114.0OSV
  • docling, PyPI2.115.0OSV
  • docling, PyPI2.116.0OSV
  • docling, PyPI2.117.0OSV
  • docling, PyPI2.118.0OSV
  • docling, PyPI2.118.1OSV
  • docling, PyPI2.119.0OSV
  • docling, PyPI2.120.1OSV
  • docling, PyPI2.120.2OSV
  • docling, PyPI2.120.3OSV
  • docling, PyPI2.121.0OSV
  • docling, PyPI2.122.0OSV
  • docling, PyPI2.123.0OSV
  • docling, PyPI2.123.1OSV
  • docling, PyPI2.124.0OSV
  • docling, PyPI2.125.0OSV
  • docling, PyPI2.126.0OSV
  • docling, PyPI2.127.0OSV
  • docling, PyPI2.128.0OSV
  • docling, PyPI2.129.0OSV
  • docling, PyPI2.130.0OSV
  • docling, PyPI2.27.0OSV
  • docling, PyPI2.28.0OSV
  • docling, PyPI2.28.1OSV
  • docling, PyPI2.28.2OSV
  • docling, PyPI2.28.3OSV
  • docling, PyPI2.28.4OSV
  • docling, PyPI2.29.0OSV
  • docling, PyPI2.30.0OSV
  • docling, PyPI2.31.0OSV
  • docling, PyPI2.31.1OSV
  • docling, PyPI2.31.2OSV
  • docling, PyPI2.32.0OSV
  • docling, PyPI2.33.0OSV
  • docling-slim, PyPIfrom 2.92.0, fixed in 2.131.0OSV
  • docling-slim, PyPI2.100.0OSV
  • docling-slim, PyPI2.101.0OSV
  • docling-slim, PyPI2.102.0OSV
  • docling-slim, PyPI2.102.1OSV
  • docling-slim, PyPI2.102.2OSV
  • docling-slim, PyPI2.103.0OSV
  • docling-slim, PyPI2.104.0OSV
  • docling-slim, PyPI2.105.0OSV
  • docling-slim, PyPI2.106.0OSV
  • docling-slim, PyPI2.107.0OSV
  • docling-slim, PyPI2.108.0OSV
  • docling-slim, PyPI2.109.0OSV
  • docling-slim, PyPI2.110.0OSV
  • docling-slim, PyPI2.111.0OSV
  • docling-slim, PyPI2.112.0OSV
  • docling-slim, PyPI2.113.0OSV
  • docling-slim, PyPI2.114.0OSV
  • docling-slim, PyPI2.115.0OSV
  • docling-slim, PyPI2.116.0OSV
  • docling-slim, PyPI2.117.0OSV
  • docling-slim, PyPI2.118.0OSV
  • docling-slim, PyPI2.118.1OSV
  • docling-slim, PyPI2.119.0OSV
  • docling-slim, PyPI2.120.1OSV
  • docling-slim, PyPI2.120.2OSV
  • docling-slim, PyPI2.120.3OSV
  • docling-slim, PyPI2.121.0OSV
  • docling-slim, PyPI2.122.0OSV
  • docling-slim, PyPI2.123.0OSV
  • docling-slim, PyPI2.123.1OSV
  • docling-slim, PyPI2.124.0OSV
  • docling-slim, PyPI2.125.0OSV
  • docling-slim, PyPI2.126.0OSV
  • docling-slim, PyPI2.127.0OSV
  • docling-slim, PyPI2.128.0OSV
  • docling-slim, PyPI2.129.0OSV
  • docling-slim, PyPI2.130.0OSV
  • docling-slim, PyPI2.92.0OSV
  • docling-slim, PyPI2.93.0OSV
  • docling-slim, PyPI2.94.0OSV
  • docling-slim, PyPI2.95.0OSV
  • docling-slim, PyPI2.96.0OSV
  • docling-slim, PyPI2.96.1OSV
  • docling-slim, PyPI2.97.0OSV
  • docling-slim, PyPI2.98.0OSV
  • docling-slim, PyPI2.99.0OSV

References 6