PYSEC-2026-1313

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/docling-core/PYSEC-2026-1313.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1313
Aliases
Published
2026-07-07T16:03:19.816786Z
Modified
2026-07-07T17:46:38.921284013Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage
Details

Impact

A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core >=2.21.0, <2.48.4 and, specifically only if the application uses pyyaml < 5.4 and invokes docling_core.types.doc.DoclingDocument.load_from_yaml() passing it untrusted YAML data.

Patches

The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching PyYAML deserialization from yaml.FullLoader to yaml.SafeLoader, ensuring that untrusted data cannot trigger code execution.

Workarounds

Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater, which supposedly patches CVE-2020-14343.

References

  • GitHub Issue: #482
  • Upstream Advisory: CVE-2020-14343
  • Fix Release: v2.48.4
References

Affected packages

PyPI / docling-core

Package

Name
docling-core
View open source insights on deps.dev
Purl
pkg:pypi/docling-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.21.0
Fixed
2.48.4

Affected versions

2.*
2.21.0
2.21.1
2.21.2
2.22.0
2.23.0
2.23.1
2.23.2
2.23.3
2.24.0
2.24.1
2.25.0
2.26.0
2.26.1
2.26.2
2.26.3
2.26.4
2.27.0
2.28.0
2.28.1
2.29.0
2.30.0
2.30.1
2.31.0
2.31.1
2.31.2
2.32.0
2.33.0
2.33.1
2.34.0
2.34.1
2.34.2
2.35.0
2.36.0
2.37.0
2.38.0
2.38.1
2.38.2
2.39.0
2.40.0
2.41.0
2.42.0
2.43.0
2.43.1
2.44.0
2.44.1
2.44.2
2.45.0
2.46.0
2.47.0
2.48.0
2.48.1
2.48.2
2.48.3

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/docling-core/PYSEC-2026-1313.yaml"