CVE-2026-105745: Docling Docling Imports Plugin Entry Points Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9jxx-vjrv-h2rq",
  "modified" : "2026-10-07T20:40:56Z",
  "published" : "2026-10-07T20:40:56Z",
  "aliases" : [ "CVE-2026-105745" ],
  "summary" : "Docling imports plugin entry points before the allow_external_plugins check",
  "details" : "### Summary\n\n`allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's `load_setuptools_entrypoints()`, which imports every module registered under docling's plugin entry-point group. Only afterwards does docling filter out modules outside the `docling.` namespace. Import-time code in any installed third-party plugin therefore runs even though external plugins are disabled.\n\n### Details\n\nIn `docling/models/factories/base_factory.py`, `load_from_plugins()` loads all entry points first and applies the `allow_external_plugins` check only to the already-imported modules. The CLI creates these factories when it starts, so running `docling` imports every registered plugin module. A log message says the plugin \"will not be loaded\", although its module has already been imported.\n\n### Affected configurations\n\nEnvironments in which a package registering a docling plugin entry point is installed, for example an unvetted or compromised dependency, and which rely on `allow_external_plugins=False` to keep that code from running.\n\n### Impact\n\nExecution of a third-party plugin module's import-time code in the docling process, contrary to the documented behaviour of `allow_external_plugins=False`.\n\n### Patches\n\nFixed in docling 2.131.0 by [#4413](https://github.com/docling-project/docling/pull/4413). Plugin entry points are now filtered by module name before they are loaded, so with `allow_external_plugins=False` third-party plugin modules are no longer imported.\n\n### Workarounds\n\nUpgrade to 2.131.0. For older versions:\n\nOnly install trusted packages in environments that run docling. Check which packages register docling plugin entry points with `importlib.metadata.entry_points()`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "docling"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.27.0"
      }, {
        "fixed" : "2.131.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "docling-slim"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.92.0"
      }, {
        "fixed" : "2.131.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-105745"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/docling-project/docling/pull/4413"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/docling-project/docling"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/docling-project/docling/releases/tag/v2.131.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-696", "CWE-829" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-10-07T20:40:56Z",
    "nvd_published_at" : "2026-10-05T22:16:57Z"
  }
}