CVE-2026-24009

Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting in version 2.21.0 and prior to version 2.48.4, specifically only if the application uses pyyaml prior to version 5.4 and invokes `docling_core.types.doc.DoclingDocument.load_from_yaml()` passing it untrusted YAML data. The vulnerability has been patched in docling-core version 2.48.4. The fix mitigates the issue by switching `PyYAML` deserialization from `yaml.FullLoader` to `yaml.SafeLoader`, ensuring that untrusted data cannot trigger code execution. Users who cannot immediately upgrade docling-core can alternatively ensure that the installed version of PyYAML is 5.4 or greater.

• CWE-502

• https://github.com/advisories/GHSA-8q59-q68h-6hv4Not Applicable
• https://github.com/docling-project/docling-core/commit/3e8d628eeeae50f0f8f239c8c7fea773d065d80cPatch
• https://github.com/docling-project/docling-core/issues/482Issue Tracking
• https://github.com/docling-project/docling-core/releases/tag/v2.48.4Product, Release Notes
• https://github.com/docling-project/docling-core/security/advisories/GHSA-vqxf-v2gg-x3hcMitigation, Patch, Vendor Advisory

Published

Jan 22, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24002Grist is spreadsheet software using Python as its formula la…9.6
• CVE-2026-24003EVerest is an EV charging software stack. In versions up to …5.3
• CVE-2026-24004Fleet is open source device management software. In versions…5.3
• CVE-2026-24005Kruise provides automated management of large-scale applicat…7.6
• CVE-2026-24006Seroval facilitates JS value stringification, including comp…7.5
• CVE-2026-24007Tuleap is an Open Source Suite for management of software de…4.6
• CVE-2026-2401CWE-532 Insertion of Sensitive Information into Log File vul…5
• CVE-2026-24010Horilla is a free and open source Human Resource Management …8
• CVE-2026-24012Uncontrolled Resource Consumption vulnerability in Apache Io…7.5
• CVE-2026-24013Authentication Bypass by Spoofing vulnerability in Apache Io…9.1
• CVE-2026-24014Apache IoTDB DataNode’s internal RPC interface for creating …9.8
• CVE-2026-24015A vulnerability in Apache IoTDB. This issue affects Apache …9.8