MediumFix available

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Type: advisorySources: OSV

### Summary When the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `enable_local_fetch` option is not enforced. A crafted HTML file can embed an arbitrary local file (for example with ``), and that file's contents appear in the page image attached to the returned `DoclingDocument`. ### Details In render mode, Playwright requests are filtered by `HTMLDocumentBackend._get_browser_request_block_reason`. In affected versions, this check allowed `file:` URLs unconditionally, before reading any option. As a result: - `enable_local_fetch=False` did not block local file access, and - even with `enable_local_fetch=True`, file access was not limited to the source document's directory, unlike the non-render path (`ImageResourceLoader`), which rejects absolute paths and path traversal. Versions 2.82.0–2.90.x did no request filtering in render mode at all. The browser runs with JavaScript disabled (from 2.91.0), so disclosure is passive: only what Chromium renders visibly inside the page viewport ends up in the page image. Only `Path` inputs are affected. They are loaded through a `file://` URL. Stream inputs are loaded with `page.set_content()` into an opaque origin, from which Chromium does not load `file://` subresources. ### Impact An attacker who can submit HTML for conversion can read any text file the conversion process can read (for example `.env` files, credential files, or other users' documents on a shared host) by having it rend

Products: docling-slim
Affected versions: 2.100.0, 2.101.0, 2.102.0, 2.102.1, 2.102.2, 2.103.0, 2.104.0, 2.105.0, 2.106.0, 2.107.0, 2.108.0, 2.109.0, 2.110.0, 2.111.0, 2.112.0, 2.113.0, 2.114.0, 2.115.0, 2.116.0, 2.117.0, 2.118.0, 2.92.0, 2.93.0, 2.94.0, 2.95.0, 2.96.0, 2.96.1, 2.97.0, 2.98.0, 2.99.0
Fixed versions: 2.118.1
CVEs: CVE-2026-105750
Confirmed fixed CVEs: Not specified
Updated in this feed: 30 Oct 2026, 18:15 UTC · Revision 1

Source evidence

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

core-osv · Original source

Published 15 Oct 2026, 10:22 UTC

osv:PYSEC-2026-4215

docling-slim

Fixed versions: 2.118.1

Complete source record

{
  "id": "60dec218954f866a3816dc54031eb1fb297e2a65f2d1eff7e8f0026585195c73",
  "url": "https://osv.dev/vulnerability/PYSEC-2026-4215",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode",
    "summary": "### Summary When the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `enable_local_fetch` option is not enforced. A crafted HTML file can embed an arbitrary local file (for example with ``), and that file's contents appear in the page image attached to the returned `DoclingDocument`. ### Details In render mode, Playwright requests are filtered by `HTMLDocumentBackend._get_browser_request_block_reason`. In affected versions, this check allowed `file:` URLs unconditionally, before reading any option. As a result: - `enable_local_fetch=False` did not block local file access, and - even with `enable_local_fetch=True`, file access was not limited to the source document's directory, unlike the non-render path (`ImageResourceLoader`), which rejects absolute paths and path traversal. Versions 2.82.0–2.90.x did no request filtering in render mode at all. The browser runs with JavaScript disabled (from 2.91.0), so disclosure is passive: only what Chromium renders visibly inside the page viewport ends up in the page image. Only `Path` inputs are affected. They are loaded through a `file://` URL. Stream inputs are loaded with `page.set_content()` into an opaque origin, from which Chromium does not load `file://` subresources. ### Impact An attacker who can submit HTML for conversion can read any text file the conversion process can read (for example `.env` files, credential files, or other users' documents on a shared host) by having it rend",
    "evidence": "osv:PYSEC-2026-4215",
    "products": [
      {
        "name": {
          "value": "docling-slim",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.118.1",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "2.100.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.101.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.102.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.102.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.102.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.103.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.104.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.105.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.106.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.107.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.108.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.109.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.110.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.111.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.112.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.113.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.114.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.115.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.116.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.117.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.118.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.92.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.93.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.94.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.95.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.96.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.96.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.97.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.98.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.99.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "PYSEC-2026-4215",
      "aliases": [
        "CVE-2026-105750",
        "GHSA-q43m-vhcp-mhvm",
        "PYSEC-2026-4196",
        "PYSEC-2026-4215"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.92.0"
                },
                {
                  "fixed": "2.118.1"
                }
              ]
            }
          ],
          "package": {
            "name": "docling-slim",
            "purl": "pkg:pypi/docling-slim",
            "ecosystem": "PyPI"
          },
          "versions": [
            "2.100.0",
            "2.101.0",
            "2.102.0",
            "2.102.1",
            "2.102.2",
            "2.103.0",
            "2.104.0",
            "2.105.0",
            "2.106.0",
            "2.107.0",
            "2.108.0",
            "2.109.0",
            "2.110.0",
            "2.111.0",
            "2.112.0",
            "2.113.0",
            "2.114.0",
            "2.115.0",
            "2.116.0",
            "2.117.0",
            "2.118.0",
            "2.92.0",
            "2.93.0",
            "2.94.0",
            "2.95.0",
            "2.96.0",
            "2.96.1",
            "2.97.0",
            "2.98.0",
            "2.99.0"
          ],
          "database_specific": {
            "source": "https://github.com/pypa/advisory-database/blob/main/vulns/docling-slim/PYSEC-2026-4215.yaml"
          }
        }
      ],
      "modified": "2026-10-15T14:56:09.321370624Z",
      "provider": "osv",
      "references": [
        "https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm",
        "https://github.com/docling-project/docling/pull/3948",
        "https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a",
        "https://github.com/docling-project/docling",
        "https://github.com/docling-project/docling/releases/tag/v2.118.1",
        "https://pypi.org/project/docling-slim",
        "https://github.com/advisories/GHSA-q43m-vhcp-mhvm",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-105750"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2026-105750",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 332687,
  "published_at": "2026-10-15T10:22:46.471738+00:00"
}