Remote Code Execution Vulnerability in Docling Core by Docling
CVE-2026-24009

8.1HIGH

Key Information:

Vendor: Docling-project
Status: Docling-core
Vendor: CVE Published:; 22 January 2026

🔔 Create Docling-project Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-24009?

The vulnerability in Docling Core relates to the use of PyYAML for processing untrusted YAML data in versions prior to 2.48.4. This flaw allows a remote code execution attack if load_from_yaml() is invoked with compromised data. The issue is mitigated in version 2.48.4 by using yaml.SafeLoader instead of the vulnerable loader. Users are advised to upgrade immediately or ensure that PyYAML is updated to version 5.4 or later to prevent exploitation.

Affected Version(s)

docling-core >= 2.21.0, < 2.48.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

docling-core-CVE-2026-24009
Created by BiranPeretz