Medium 6.7Published Oct 5, 2026

CVE-2026-105745Docling: Plugin entry points are imported before the allow_external_plugins check

Updated under an hour ago (Oct 28, 2026, 6:30 AM ET)

Does this affect you?

It affects docling-project docling and 2 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.12%, higher than 2% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for docling-project docling

Exploited in the last 30 days

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory.py call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed third-party or compromised package can therefore execute import-time code when Docling starts, while the subsequent namespace filter misleadingly reports that the plugin was not loaded. This issue is fixed in 2.131.0.

CVSS: 6.7 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-696, CWE-829
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.12% (percentile 2)
Assigned by: GitHub_M
NVD analysis: Analyzed
Record last updated: Oct 6, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

docling-project docling docling_project:docling (from the name)	from 2.27.0, < 2.131.0	CNA record
docling-project docling-slim docling_project:docling_slim (from the name)	from 2.27.0, < 2.131.0	CNA record
docling docling docling:docling	from 2.27.0 before 2.131.0	NVD

References

References

https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq	x-refsource-confirm, patch, vendor-advisory
https://github.com/docling-project/docling/pull/4413	x-refsource-misc, issue-tracking, patch
https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c	x-refsource-misc, patch
https://github.com/docling-project/docling/releases/tag/v2.131.0	x-refsource-misc, release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.