High severity7.1NVD Advisory· Published Jun 26, 2026· Updated Jul 2, 2026
CVE-2026-47214
CVE-2026-47214
Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
doclingPyPI | < 2.94.0 | 2.94.0 |
Affected products
3cpe:2.3:a:docling:docling:*:*:*:*:*:python:*:*+ 1 more
- cpe:2.3:a:docling:docling:*:*:*:*:*:python:*:*range: <2.94.0
- (no CPE)range: >=2.91.0, <2.94.0
Patches
Vulnerability mechanics
References
6- github.com/docling-project/docling/releases/tag/v2.94.0nvdPatchWEB
- github.com/advisories/GHSA-q29v-xc37-wh5mghsaADVISORY
- github.com/docling-project/docling/security/advisories/GHSA-q29v-xc37-wh5mnvdVendor AdvisoryMitigationPatchWEB
- nvd.nist.gov/vuln/detail/CVE-2026-47214ghsaADVISORY
- github.com/docling-project/docling/releases/tag/v2.91.0ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2146.yamlghsaWEB
News mentions
1- Docling Project: Eight High-Severity Vulnerabilities Disclosed TogetherVypr Intelligence · Jun 3, 2026