Background / Root Cause

DoclingDocument.load_from_yaml() deserializes a YAML-serialized DoclingDocument. In vulnerable versions, it loads YAML using an unsafe loader (yaml.FullLoader) when PyYAML is vulnerable, allowing malicious YAML constructors to execute code during parsing (see CVE-2020-14343 for more information).

Tested environment (PoC)

• OS: Ubuntu 24.04
• Python: 3.12.3
• docling-core: 2.48.3 (vulnerable)
• PyYAML: 5.3.1 (vulnerable)

Reproduction (PoC)

1) Create a virtual environment

2) (Optional) Confirm the vulnerable loader

Run:

In vulnerable versions, load_from_yaml() uses:

3) Run the PoC

Expected behavior:

• repro_docling_load.py raises a ValidationError (expected)
• a local marker file is created: /tmp/docling_cve_poc_marker

This demonstrates execution occurred during YAML parsing, before DoclingDocument.model_validate(...) fails.

Mitigation / Patch verification

Mitigation 1 — Upgrade docling-core (recommended)

Expected:

• check_loader.py shows yaml.SafeLoader
• PoC fails with a YAML constructor error and no marker file is created

Mitigation 2 — Upgrade PyYAML

Upgrading PyYAML to >= 5.4 mitigates the upstream behavior associated with CVE-2020-14343.

Mitigation 3 — Enforce safe loading

If upgrading is not possible, avoid loading untrusted YAML with unsafe loaders. Enforce yaml.SafeLoader when deserializing untrusted YAML.

Notes on downstream docling exposure (dependency mapping)

While this CVE is in docling-core, the most common consumer is docling. A broad dependency range in docling does not prove vulnerability by itself; what matters is the resolved environment (lockfiles / installed packages) and whether YAML import paths are used.

This repo includes collect_versions.py, which maps:

• declared docling-core constraints from pyproject.toml
• pinned docling-core versions from uv.lock (or poetry.lock in older tags)

From the extracted data, the potentially vulnerable docling versions (constraint allows vulnerable + lock pins vulnerable) are:

• >= v2.27.0 and <= v2.57.0

This is a dependency-resolution indicator, not a proof that default docling workflows reach load_from_yaml() on untrusted input.

Repo contents (high-level)

• repro_docling_load.py — minimal PoC runner
• check_loader.py — prints the YAML loader used by load_from_yaml()
• scanner/ — a simple dependency-based scanner (optional direct sink check)
• collect_versions.py — helper to map docling tags to pinned docling-core versions