Docling Core YAML Deserialization Remote Code Execution Vulnerability (CVE-2026-24009)
Executive & SecOps Summary
SECOPS ASSESSMENTdocling-core versions from v2.21.0 prior to v2.48.4, specifically when paired with pyyaml versions prior to v5.4
Remote attackers can execute arbitrary Python code on the target server by supplying malicious YAML data to the load_from_yaml() method
Upgrade docling-core to version v2.48.4 or later, or ensure the installed PyYAML version is v5.4 or greater
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade docling-core to version v2.48.4 or later. The patched version mitigates the issue by switching the deserialization loader from yaml.FullLoader to yaml.SafeLoader.
# Upgrade docling-core using pip
pip install --upgrade 'docling-core>=2.48.4'
# Upgrade using poetry
poetry add 'docling-core>=2.48.4'2. Temporary Workaround & Hardening Configuration
If you cannot immediately upgrade docling-core, you must ensure that the installed version of PyYAML is upgraded to v5.4 or greater to block the underlying deserialization vector.
# Force upgrade PyYAML to a secure version
pip install --upgrade 'pyyaml>=5.4'3. Log Audit & IoC Verification Commands
Use the following commands to audit your environment for vulnerable package versions and locate potentially insecure code patterns.
# Verify installed package versions
pip show docling-core pyyaml
# Scan codebase for occurrences of the vulnerable load_from_yaml method
grep -rn 'load_from_yaml' ./Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-24009) is an insecure deserialization flaw in docling-core, a library defining core data types for the Docling document processing application. The root cause lies in the library's use of PyYAML for parsing YAML data. In affected versions, docling-core utilizes yaml.FullLoader to deserialize YAML documents. When combined with an outdated PyYAML version (prior to v5.4), this exposes the application to the well-known PyYAML RCE vulnerability (CVE-2020-14343).
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by passing untrusted, specially crafted YAML payloads to the docling_core.types.doc.DoclingDocument.load_from_yaml() method. Because yaml.FullLoader is used under the hood in vulnerable configurations, the parser will resolve arbitrary Python object tags (such as !!python/object/new). This allows the attacker to instantiate arbitrary classes and execute system commands in the context of the running application process without authentication.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical), this vulnerability poses a severe threat to infrastructure security. Successful exploitation grants the attacker full remote code execution (RCE) capabilities. This can lead to complete system compromise, unauthorized access to sensitive data, lateral movement within the cloud or enterprise network, and potential deployment of ransomware or malware.
Official Vendor Advisories & References
Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution. Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater.
Frequently Asked SecOps Questions (CVE-2026-24009)
FAQQ1. How critical is CVE-2026-24009 and is it actively exploited in the wild?
CVE-2026-24009 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 1.5%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-24009?
Primary impacted vendors include docling-project, pyyaml across docling-core, pyyaml. Scope summary: docling-core versions >= 2.21.0 and < 2.48.4, only if the environment uses pyyaml < 5.4
Q3. What temporary mitigations or workarounds exist for CVE-2026-24009 before patching?
[Mitigation] Upgrade docling-core to version v2.48.4 or later, or ensure the installed PyYAML version is v5.4 or greater Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-24009
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (docling-project)
View Category →Apache MINA 3.0 JavaNativeMessageDecoder Deserialization Remote Code Execution Vulnerability (CVE-2026-118636)
[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
GitLab CE/EE Unauthenticated Arbitrary File Read Vulnerability (CVE-2026-85706)
[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.
Google Brotli Decoder Remote Code Execution (RCE) and Memory Corruption Vulnerability (CVE-2026-111497)
[Affected Scope] All web servers, browsers, Node.js environments, and backend applications using Google Brotli library versions 1.0.3 through 1.2.0
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.