Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.
Problem types
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-611: Improper Restriction of XML External Entity Reference
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Product status
References
github.com/...ocling/security/advisories/GHSA-r3xg-rg9j-67fv
github.com/docling-project/docling/releases/tag/v2.91.0