| Package | Affected versions | Patched versions |
|---|---|---|
| docling-core | ≥ 2.5.0, < 2.74.1 | 2.74.1 |
In versions >= 2.5.0, < 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit.
In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads.
Patched in docling-core 2.74.1.
The fix blocks local file URIs by default and adds a size limit for decoded inline image data.
Users should upgrade to:
docling-core >= 2.74.1If upgrading is not immediately possible:
file: and data: image references from untrusted inputv2.74.1Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free