Executive brief
Docling, a tool used for processing and converting various document formats for AI applications, contains a security flaw in how it handles USPTO patent files. An attacker could provide a specially crafted patent document that, when processed, allows them to read sensitive files from the server, trigger internal network requests, or crash the system. This could lead to data theft or significant service disruptions for organizations using Docling to automate document analysis.
Technical details
Docling versions 2.13.0 through 2.73.x are vulnerable to XML External Entity (XXE) attacks within the USPTO patent XML parsers (ICE v4.x, Grant v2.5, and Application v1.x). The vulnerability stems from the use of the standard 'xml.sax.parseString()' function without disabling external entity resolution. A remote, unauthenticated attacker can exploit this by submitting a malicious XML file containing external entity references or recursive entity expansions (Billion Laughs attack). Successful exploitation can result in the disclosure of local files, Server-Side Request Forgery (SSRF), or a Denial of Service (DoS) via resource exhaustion. The issue is resolved in version 2.74.0 by migrating to 'defusedxml.sax.make_parser()' with secure configurations.
Affected products
- docling-project Docling >= 2.13.0, < 2.74.0
Timeline
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE-2026-44020 published to NVD
- 2026-06-24: patched: Fixed in version 2.74.0