CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-01-22
Docling Core YAML Deserialization Remote Code Execution Vulnerability (CVE-2026-24009)
[Affected Scope] docling-core versions from v2.21.0 prior to v2.48.4, specifically when paired with pyyaml versions prior to v5.4
[Impact] Remote attackers can execute arbitrary Python code on the target server by supplying malicious YAML data to the load_from_yaml() method
[Mitigation] Upgrade docling-core to version v2.48.4 or later, or ensure the installed PyYAML version is v5.4 or greater