« Volver al listado

CVE-2026-105742

Estado: AnalizadaMedia (5.3)—

Docling simplifica el procesamiento de documentos analizando formatos diversos y proporcionando integraciones con el ecosistema de IA generativa. Desde la 2.95.0 hasta la 2.132.0, el cargador de recursos de imagen HTML en docling/backend/utils/image_resource_loader.py reenvía las cabeceras configuradas mediante el ajuste HTMLBackendOptions.headers a todas las URL de imágenes remotas indicadas por un documento no confiable cuando enable_remote_fetch=True y fetch_images=True.

Leer descripción completaMostrar menos

El cargador no restringe esas credenciales al origen del documento de origen, lo que permite que las solicitudes que llevan cabeceras personalizadas, como claves de API y cookies, sigan redirecciones de origen cruzado y expongan las credenciales configuradas por quien realiza la llamada al autor de un documento. La configuración predeterminada no se ve afectada porque se requieren la obtención remota y cabeceras configuradas. Este problema se ha corregido en la 2.132.0.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Aplicación expuesta a red que procesa documentos HTML no confiables; carga de imágenes remotas sin validación de origen expone credenciales (API keys, cookies) configuradas en cabeceras HTTP a dominios terceros mediante redirects.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Limit Access to Resource Over NetworkFilter Network TrafficUser TrainingPrivileged Account ManagementNetwork SegmentationEncrypt Sensitive Information

Tecnologías afectadas (1)

Docling — Docling

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-105742",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-105742",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-06T13:54:47.744121Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "docling-project",
          "product": "docling",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.95.0, < 2.132.0"
            }
          ]
        },
        {
          "vendor": "docling-project",
          "product": "docling-slim",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.95.0, < 2.132.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-05T22:16:56.867",
  "references": [
    {
      "url": "https://github.com/docling-project/docling/commit/5e469137f275ffc443306a30d12a3a45bceb80fb",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/docling-project/docling/pull/4420",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/docling-project/docling/releases/tag/v2.132.0",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-p3fw-7699-7926",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        },
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0."
    }
  ],
  "lastModified": "2026-10-07T19:52:37.513",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:docling:docling:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6315BB7-9E47-4EDE-B6FD-609919DAB18C",
              "versionEndExcluding": "2.132.0",
              "versionStartIncluding": "2.95.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}