CVE-2026-105745 | docling-project Docling up to 2.130.x Plugin Factory base_factory.py load_setuptools_entrypoints allow_external_plugins code injection

October 5, 2026 Yanac

A vulnerability was found in docling-project Docling up to 2.130.x and classified as problematic. Affected is the function load_setuptools_entrypoints of the file docling/models/factories/base_factory.py of the component Plugin Factory. Executing a manipulation of the argument allow_external_plugins can lead to code injection.

This vulnerability is registered as CVE-2026-105745. The attack needs to be launched locally. No exploit is available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More