CVE-2026-105742 | docling-project docling/docling-slim up to 2.131.x HTML image resource loader image_resource_loader.py headers cross-domain policy

October 5, 2026 Yanac

A vulnerability, which was classified as problematic, has been found in docling-project docling and docling-slim up to 2.131.x. The impacted element is an unknown function of the file docling/backend/utils/image_resource_loader.py of the component HTML image resource loader. This manipulation of the argument headers causes permissive cross-domain policy with untrusted domains.

This vulnerability is tracked as CVE-2026-105742. The attack is possible to be carried out remotely. No exploit exists.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More