Update docling to v2.94.0 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
docling (changelog)	2.66.0 → 2.94.0

---

Docling: Unsafe Zip Extraction in EasyOCR Model Download

CVE-2026-44017 / GHSA-cjqg-rq2h-2fvj

More information

Details

Impact

In versions < 2.91.0, The EasyOCR model download functionality extracted ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker could compromise the model download source (via supply chain attack, DNS spoofing, or MITM), they could write arbitrary files to any location writable by the process, potentially achieving:

• Remote code execution by overwriting Python files or system binaries
• Persistent backdoors by modifying startup scripts or SSH keys
• Data corruption or system compromise

Patches

Fixed in version 2.91.0. The extraction process now validates each archive member path using os.path.realpath() to ensure it remains within the target directory, raising a SecurityError for any path traversal attempts.

Workarounds

Ensure model downloads occur over secure, authenticated channels. Use integrity verification (checksums) for downloaded models. Run the application with minimal file system permissions.

References

• Fix release: v2.91.0

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://github.com/docling-project/docling/security/advisories/GHSA-cjqg-rq2h-2fvj
• https://github.com/docling-project/docling/releases/tag/v2.91.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-44017
• https://access.redhat.com/security/cve/CVE-2026-44017
• https://bugzilla.redhat.com/show_bug.cgi?id=2492448
• https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2143.yaml
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44017.json
• https://access.redhat.com/errata/RHSA-2026:60520
• https://github.com/advisories/GHSA-cjqg-rq2h-2fvj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

CVE-2026-44018 / GHSA-r3xg-rg9j-67fv

More information

Details

Impact

The METS-GBS backend's XML parsing and the input document format detection lacked security controls, enabling:

• XML External Entity (XXE) attacks to read local files or cause denial of service
• Decompression bombs (zip bombs) to exhaust memory and disk space
• Unbounded archive extraction consuming system resources

An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes.

Patches

Fixed in version 2.91.0. The fix implements:

• Secure XML parsing with resolve_entities=False, load_dtd=False, and no_network=True
• Configurable limits: 300 MB total extraction size, 10 MB per file, 1000 member count
• Cumulative size tracking across all extractions
• Early termination when limits are exceeded
• Secure format detection of METS-GBS tar archives with _detect_mets_gbs() method: maximum file size (10 MB per file), maximum member count (1000 members), and exception handling to gracefully fail when limits are exceeded

Workarounds

Avoid processing METS-GBS archives from untrusted sources. If necessary, pre-validate archives in an isolated environment with resource limits.

References

• Fix release: v2.91.0

Severity

• CVSS Score: 5.5 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

• https://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fv
• https://github.com/docling-project/docling/releases/tag/v2.91.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-44018
• https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2144.yaml
• https://github.com/advisories/GHSA-r3xg-rg9j-67fv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

CVE-2026-44020 / GHSA-m88r-rg27-5xfg

More information

Details

Impact

The USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could:

• Read arbitrary files from the server filesystem
• Perform Server-Side Request Forgery (SSRF) attacks
• Cause denial of service through entity expansion (Billion Laughs attack)

The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x.

Patches

Fixed in version 2.74.0. The parser now uses defusedxml.sax.make_parser() with secure configuration that blocks external entity resolution (feature_external_ges=False, feature_external_pes=False) while allowing DTD declarations required by USPTO files. This prevents XXE attacks while maintaining compatibility with the USPTO XML format.

Workarounds

Avoid processing USPTO patent XML files from untrusted sources. Implement resource limits (memory, CPU time) when processing patent documents.

References

• Fix release: v2.74.0

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/docling-project/docling/security/advisories/GHSA-m88r-rg27-5xfg
• https://github.com/docling-project/docling/releases/tag/v2.74.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-44020
• https://access.redhat.com/security/cve/CVE-2026-44020
• https://bugzilla.redhat.com/show_bug.cgi?id=2492456
• https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-240.yaml
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44020.json
• https://access.redhat.com/errata/RHSA-2026:60520
• https://github.com/advisories/GHSA-m88r-rg27-5xfg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Docling: Unsafe URI and Path Handling in HTML Backend

CVE-2026-47214 / GHSA-q29v-xc37-wh5m

More information

Details

Impact

The HTML backend did not perform sufficient validation during resource handling:

• Accepted file:// URIs enabling local file system access when enable_local_fetch=True
• Path resolution allowed traversal outside intended directories via ../ sequences and absolute paths
• Did not block internal network resources under enable_remote_fetch=True
• HTTP redirects were not validated, potentially redirecting to unintended schemes
• No resource limits for remote image downloads and data: URIs

Patches

Fixed in versions 2.91.0 (initial fixes) and 2.94.0 (additional improvements). The fixes implement:

• Updated local path treatment: absolute files always blocked, relative paths require enable_local_fetch=True (default: False) and containment within configured base_path for path traversal protection
• file:// scheme stripped & treated as local path (above)
• IP address validation to prevent SSRF
• HTTP redirect validation, connection and read timeouts
• Size limit for both remote images (with streaming download) and base64-decoded data URIs

Workarounds

Keep both enable_local_fetch=False and enable_remote_fetch=False (defaults) when processing untrusted HTML documents.

References

• Initial fixes: v2.91.0
• Additional improvements: v2.94.0

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

References

• https://github.com/docling-project/docling/security/advisories/GHSA-q29v-xc37-wh5m
• https://github.com/docling-project/docling/releases/tag/v2.91.0
• https://github.com/docling-project/docling/releases/tag/v2.94.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-47214
• https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2146.yaml
• https://github.com/advisories/GHSA-q29v-xc37-wh5m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

docling-project/docling (docling)

v2.94.0

Compare Source

Feature

• latex: Add optional Tectonic TikZ rendering (#​3369) (eceedc2)
• Add image_placeholder and use_markdown_images as fields in the BaseChunkerOptions (#​3436) (5fadc6d)
• extraction: Add Granite Vision 4.1 as alternative KVP extraction model (#​3398) (b5f2e53)
• Add 2 stage model dowload from hf and call it for threaded layout model. (#​3267) (336f942)

Fix

• kserve: Provide channel args to allow gRPC to use round_robin scheduling (#​3427) (81afde8)
• cli: Do not convert multiple files on case-insensitive filesystems (#​3468) (52d4887)
• Fail on empty markdown export (#​3429) (ab6aa05)
• Fix OSTL ucel merged incorrectly (#​3453) (038b991)
• service: Improve transport-level connection error handing in client SDK (#​3439) (bcd5509)
• Handle valid JATS contributor name variants (#​3432) (694cf0c)
• docx: Preserve custom numbering text prefix in list markers (#​3425) (0c31706)
• Update service client URL parsing with v1 suffix (#​3415) (64ddeb6)
• client: Make submit_and_retrieve_many accept lazy iterable and yield (#​3405) (aba7f15)
• html: Add redirect validation to image fetching (#​3407) (eb6e1e6)
• html: Improve local file path handling (#​3400) (2bb0fa6)
• markdown: Flush pending list/heading creation on CodeSpan to prevent RecursionError (#​3361) (6b3322e)

Documentation

• cli: Clarify help text (#​3408) (46763a1)
• security: Add GitHub Private Vulnerability Reporting (#​3416) (24af7f6)
• readme: Improve structure and clarity (#​3366) (df5fbc3)

v2.93.0

Compare Source

Feature

• vlm: Upgrade Granite Vision model to 4.1 for table + chart extraction (#​3382) (24f2d14)

Fix

• docx: Fix OMML equation handling and improve type safety (#​3381) (e00735d)

v2.92.0

Compare Source

Feature

• Extend the kserve-triton OCR model to have multi-lingual support (#​3368) (8b67fae)
• docx: Add checkbox parsing support (#​3349) (c455a65)
• Introduce modular docling-slim package (#​3285) (ed32c5e)
• Add ResponseFormat.DOCLANG and parsing branch in VLM pipeline (#​3350) (0f6f8d0)

Fix

• pptx: Skip malformed picture shapes instead of aborting conversion (#​3372) (7294248)
• docx: OMML conversion failures for unsupported limit functions (#​3359) (3df80e7)
• Make VLLM model_impl configurable (#​3358) (a6a37ca)

v2.91.0

Compare Source

Feature

• docx: Extract VML images with v:imagedata elements (#​3343) (2ddaa3b)

Fix

• Strengthen input validation for METS‑GBS processing (#​3336) (c1dbac2)
• EasyOCR model downloading (#​3339) (5e161ac)
• vlm: Remove bogus preamble from VLM chat template (#​3351) (c190ba2)
• html: Refine image URL and size handling (#​3348) (cd0cb69)
• Fixes to html_backend (#​3342) (9813190)

v2.90.0

Compare Source

Feature

• Implement GraniteVisionTableStructureModel for VLM-based table extraction (#​3323) (1569e42)

Fix

• latex: Fully unwrap deeply nested formatting macros (#​3249) (101233e)
• docx: Handle inline formulas in list items (#​3304) (c761512)
• format: Add MD fallback for .txt files in _guess_from_content (#​3311) (3bab6b4)
• Strip soft hyphen when joining merged text elements (#​3232) (8274892)
• pptx: Handle NotImplementedError from shape.shape_type (#​3309) (043ed2d)

Documentation

• Fix nanonets_ocr2 runtime support matrix (#​3317) (8ec14f2)

v2.89.0

Compare Source

Feature

• Explicit TikZ environment handling in LaTeX backend (#​3187) (a15c16e)

Fix

• ocr: Align RapidOCR english assets with 3.8 mobile models (#​3291) (251c8b2)
• docx: Isolate list state in table cells (#​3294) (740c386)
• pipeline: Prevent cache miss due to pipeline options mutation during chart extraction (#​3300) (5b84911)

Documentation

• Add indexed picture placeholder example to serialization notebook (#​3293) (cd2e5b6)

Performance

• markdown: Avoid eager string formatting in Markdown backend debug logs (#​3301) (a64c378)

v2.88.0

Compare Source

Feature

• service: Establish client SDK for docling serve (#​3264) (42157a3)

Fix

• ocr: Support rapidocr 3.8 mobile model naming (#​3277) (6b257ec)

Documentation

• Add agent skill bundle for coding assistants (SKILL.md, pipelines, convert/evaluate) (#​3174) (c23622f)

v2.87.0

Compare Source

Feature

• vlm: Add Nanonets OCR2 onboarding (#​3274) (9970d1e)

Fix

• Transformers v5 compatibility for AUTOMODEL_CAUSALLM VLMs (#​3276) (d431224)
• vlm: Add explicit MLX support for OCR presets (#​3272) (27d3cf4)
• markdown: Normalize repeated leading dash markers (#​3286) (a6aeddf)
• docx: Preserve inline SDT references (#​3280) (6cb1bc0)
• pptx: Respect page_range during conversion (#​3282) (e4fd937)
• vlm: Support tool-calling API responses (#​3271) (9c3ab93)
• pdf: Extend ligature map with Dutch IJ and PUA glyph U+F0A0 (#​3254) (ab5254d)

Documentation

• Add AG2 multi-agent document analysis example (#​3261) (1fed840)

v2.86.0

Compare Source

Feature

• Support for GraniteVision v4 (#​3217) (fd83420)
• Add signature/stamp html block to DC document (#​3251) (9b4b67b)
• vlm: Add PARTIAL_SUCCESS status for VLM pipeline pages (#​3215) (6699642)

Fix

• latex: Discard arguments of filtered spacing commands (#​3245) (6180925)

Documentation

• Chart understanding in README (#​3253) (d5af473)

v2.85.0

Compare Source

Feature

• Add support for Falcon-OCR (#​3237) (d0e19be)
• Add support for LightOnOCR-2-1B (#​3213) (f2affd7)

Fix

• latex: Expand custom macro parameters (#​3223) (77a2505)

v2.84.0

Compare Source

Feature

• Glm ocr (#​3146) (a9265d8)
• Switch to the latest version of DocumentFigureClassifier model v2.5 (#​3171) (d046390)
• Remove the deprecation of extraction (#​3220) (e9a39e8)

v2.83.0

Compare Source

Feature

• Upgrade to transformers v5 (#​3200) (d2c6357)
• OCR model for remote KServe v2 API (#​3189) (8522b00)

Fix

• pdf: Propagate hyperlinks to DoclingDocument text items (#​3131) (524edcc)
• xlsx: Guard last-row bounds in Excel table scan (#​3197) (85ac377)
• Parse LaTeX macros in multicolumn/multirow table cells (#​3204) (89c68f8)
• Handle empty CSV file without crashing (#​3196) (f283484)

Documentation

• Add line-based chunker documentation and examples (#​3210) (3a64f41)

v2.82.0

Compare Source

Feature

• Implementation of HTML backend with headless browser (#​2969) (1c74a9b)

Fix

• omml: Correct LaTeX output for fractions, math operators, and functions (#​3122) (e36125b)
• Manage PDFium backend resource lifecycles to avoid SIGSEGV/SIGTRAP crashes (#​3180) (a0fc3c9)
• docx: Split multiple OMML equations into separate formula items (#​3123) (90d6dd4)
• Let user params override engine defaults in API VLM engine (#​3116) (fdf5e20)
• vlm: Handle content_filter finish reason in API responses (#​3051) (f0e3d1d)
• cli: Avoid generating images for non-image exports (#​3127) (5473e07)
• Honor picture description batching and scale options (#​3132) (9abf0fd)

Documentation

• Fix Erroneous vLLM VLM pipeline engine option params causing empty/bad responses (#​3167) (fffd445)

v2.81.0

Compare Source

Feature

• Route plain-text and Quarto/R Markdown files to the Markdown backend (#​3161) (96d7c7e)

Fix

• docx: Missing list items after numbered header (#​2665) (#​2678) (2f7c09e)
• Avoid thread-unsafe close of pypdfium backend (#​3160) (afb4bb6)
• Handle external image relationships in MsWordDocumentBackend (#​3114) (8ae0974)
• Handle PermissionError for directory input on Windows CLI (#​3149) (a39317a)
• Avoid in-place mutation of pipeline options breaking cache key (#​3115) (412af62)
• Preserve torch_dtype in get_engine_config and add it to CodeFormulaV2 (#​3117) (53a5f80)
• Release image backend resources after frame extraction (#​3134) (1e841eb)

v2.80.0

Compare Source

Feature

• Add the VllmCudaGraphMode (#​3125) (f950679)

v2.79.0

Compare Source

Feature

• Add fact metadata and linkbase relationships for XBRL (#​3084) (7952efe)

Fix

• Use OCR cells with TableFormer v2 (#​3107) (93f6fee)
• Add self-consistency check in the table-structure model (#​3105) (2a0e11f)
• Correct typos in log messages and add missing error log (#​3097) (198d0af)
• Don't force cast to float32 in API Kserve v2 inputs (#​3101) (fef01f8)

v2.78.0

Compare Source

Feature

• Add support for TableFormer v2 (#​3013) (4ccd1d4)
• Add gRPC transport for KServe v2 API engine (#​3074) (3d90778)

Fix

• html: Fix broken document tree and quadratic complexity in rich table cells (#​3025) (80f75b8)
• Loosen dependency for pandas3 (#​3095) (5188180)
• Add parse timeout to legacy LaTeX documents (#​3019) (1192714)
• msword: Skip GroupItem targets without comments attribute (#​3080) (ee16285)

Documentation

• Fix code in rag langchain chunker tokenizer (#​2993) (d113e61)
• Update code snippet to use modern pipeline options syntax (#​3087) (95b759e)
• Set HuggingFaceEndpoint task for Mixtral examples (#​2945) (5d3ac38)

v2.77.0

Compare Source

Feature

• Track vlm_inference time for mlx_model pipeline (#​3060) (38c4bb2)
• Add configurable graph_optimization_level for ONNX Runtime engines (#​3071) (cfc6636)

Fix

• docx: Preserve URL fragments and query params in hyperlinks (#​3050) (cd9dd10)
• Detect Office Open XML formats from ZIP contents when filename has no extension (#​3073) (56f06fe)
• readingorder: Assign FURNITURE content_layer to footer/header in container groups (#​3044) (f7cb304)
• docx: Handle list items immediately after numbered headings (#​3070) (56eb127)
• rapidocr: ORT thread configuration for RapidOCR backend (#​3062) (68336c2)

Documentation

• Add examples and fix docstring bug in DocumentConverter (#​3064) (653940e)
• Add docstrings to PipelineOptions classes (#​3065) (8b99085)

v2.76.0

Compare Source

Feature

• Export to WebVTT format (#​3036) (d276e60)

Fix

• xlsx: Handle OneCellAnchor images in Excel backend (#​3045) (859c302)
• Normalize Unicode ligatures in PDF text extraction (#​3057) (6198e69)
• ocr: Update RapidOCR torch GPU config key (#​3049) (477359b)
• Convert PIL images to RGB before picture description (#​3014) (90ce93d)
• msword: Use outlineLvl for heading levels and clamp to minimum 1 (#​2916) (a3d2b4b)

Documentation

• Add metaxy integration (#​3058) (7aacc6c)
• Removes merge conflict artifacts (#​3055) (672125c)
• Add audio & video processing guide (#​3038) (1321b39)
• Add XBRL conversion example notebook and update feature listings (#​3039) (1eb5c21)

v2.75.0

Compare Source

Feature

• Create a backend parser for XBRL instance reports (#​3017) (334ba6e)
• Unified model-family inference engines (including image-classification) and KServe v2 API support (#​2979) (0353293)

Fix

• Skip ASR segments when length is zero (#​2998) (6b824f8)
• docx: Guard against None hyperlink address in _get_paragraph_elements (#​2367) (#​3022) (236216e)

v2.74.0

Compare Source

Feature

• Introduce docling-parse v5 and deprecate old docling-parse backends (#​2872) (bf417e6)

Fix

• Security vulnerabilities with XML External Entity and related attacks (#​3009) (576bada)
• csv: Set default delimiter by default (#​3005) (a1b0e3f)
• Improved deserialization of engine_options (#​3008) (dbba6ea)

v2.73.1

Compare Source

Fix

• asciidoc: Handle commas in image alt text (#​2983) (86b6912)
• Use timezone-aware datetime (#​2947) (e2870f9)
• Add failed pages to DoclingDocument for page break consistency (#​2939) (1f91482)

v2.73.0

Compare Source

Feature

• Inference engines abstraction for object detection model family with HF Transformers and ONNX runtime (#​2959) (14e474c)
• Added support for parsing LaTeX (.tex) documents (#​2890) (e6ccb8b)
• Introduce pluggable VLM runtime system with preset-based configuration (#​2919) (d4c8713)

Fix

• Restore expected behavior for artifacts_path and accelerator_options in VLM engines (#​2961) (9721321)
• Allow offline chart extraction model artifacts (#​2957) (ae4fdbb)

Documentation

• Add LaTeX and WebVTT as supported types (#​2974) (704ef0a)

v2.72.0

Compare Source

Feature

• Add chart extraction models (#​2848) (fe45c71)

Fix

• backend: Improve Excel table bounds detection and flatten merged cells (#​2778) (3110c43)
• pptx: Handle picture shapes with external image references (#​2914) (5e452a2)

Documentation

• Add granite vision for charts (#​2946) (a5ad8f2)

v2.71.0

Compare Source

Feature

• Webvtt and source tracker (#​2787) (0602a7c)
• Add support for Word document comments extraction (#​2834) (b6ca094)

Fix

• Allow newer typer versions (#​2930) ([6f205ae](https://redirect.github.com/docling-project/docling/commit/6f205ae2119fe694abaf200df5662837

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Toronto)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.