{"id":"PYSEC-2026-4210","summary":"Docling imports plugin entry points before the allow_external_plugins check","details":"### Summary\n\n`allow_external_plugins=False` (the default, and the CLI default) is meant to restrict docling to its own model plugins. However, docling's plugin factories call pluggy's `load_setuptools_entrypoints()`, which imports every module registered under docling's plugin entry-point group. Only afterwards does docling filter out modules outside the `docling.` namespace. Import-time code in any installed third-party plugin therefore runs even though external plugins are disabled.\n\n### Details\n\nIn `docling/models/factories/base_factory.py`, `load_from_plugins()` loads all entry points first and applies the `allow_external_plugins` check only to the already-imported modules. The CLI creates these factories when it starts, so running `docling` imports every registered plugin module. A log message says the plugin \"will not be loaded\", although its module has already been imported.\n\n### Affected configurations\n\nEnvironments in which a package registering a docling plugin entry point is installed, for example an unvetted or compromised dependency, and which rely on `allow_external_plugins=False` to keep that code from running.\n\n### Impact\n\nExecution of a third-party plugin module's import-time code in the docling process, contrary to the documented behaviour of `allow_external_plugins=False`.\n\n### Patches\n\nFixed in docling 2.131.0 by [#4413](https://github.com/docling-project/docling/pull/4413). Plugin entry points are now filtered by module name before they are loaded, so with `allow_external_plugins=False` third-party plugin modules are no longer imported.\n\n### Workarounds\n\nUpgrade to 2.131.0. For older versions:\n\nOnly install trusted packages in environments that run docling. Check which packages register docling plugin entry points with `importlib.metadata.entry_points()`.","aliases":["CVE-2026-105745","GHSA-9jxx-vjrv-h2rq","PYSEC-2026-4192"],"modified":"2026-10-15T14:55:41.958960612Z","published":"2026-10-15T10:22:49.066877Z","references":[{"type":"WEB","url":"https://github.com/docling-project/docling/security/advisories/GHSA-9jxx-vjrv-h2rq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105745"},{"type":"WEB","url":"https://github.com/docling-project/docling/pull/4413"},{"type":"WEB","url":"https://github.com/docling-project/docling/commit/0f443b3786e98688a2da3b7c8f56fe5e46af876c"},{"type":"PACKAGE","url":"https://github.com/docling-project/docling"},{"type":"WEB","url":"https://github.com/docling-project/docling/releases/tag/v2.131.0"},{"type":"PACKAGE","url":"https://pypi.org/project/docling-slim"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9jxx-vjrv-h2rq"}],"affected":[{"package":{"name":"docling-slim","ecosystem":"PyPI","purl":"pkg:pypi/docling-slim"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.92.0"},{"fixed":"2.131.0"}]}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.118.1","2.119.0","2.120.1","2.120.2","2.120.3","2.121.0","2.122.0","2.123.0","2.123.1","2.124.0","2.125.0","2.126.0","2.127.0","2.128.0","2.129.0","2.130.0","2.92.0","2.93.0","2.94.0","2.95.0","2.96.0","2.96.1","2.97.0","2.98.0","2.99.0"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/docling-slim/PYSEC-2026-4210.yaml"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"}]}