Nixpkgs security tracker
5.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Local (L)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Local (L)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
Activity log
- Created suggestion
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.
References
-
https://github.com/docling-project/docling/releases/tag/v2.91.0 x_refsource_MISC
Affected products
- ==>= 2.45.0, < 2.91.0
Matching in nixpkgs
pkgs.docling
SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications
-
nixos-unstable -
- nixos-unstable-small 2.118.0
pkgs.docling-serve
Running Docling as an API service
-
nixos-unstable -
- nixos-unstable-small 1.29.0
pkgs.python313Packages.docling
SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications
-
nixos-unstable -
- nixos-unstable-small 2.118.0
pkgs.python314Packages.docling
SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications
-
nixos-unstable -
- nixos-unstable-small 2.118.0
pkgs.python313Packages.docling-mcp
Making docling agentic through MCP
-
nixos-unstable -
- nixos-unstable-small 1.3.3
pkgs.python314Packages.docling-mcp
Making docling agentic through MCP
-
nixos-unstable -
- nixos-unstable-small 1.3.3
pkgs.python313Packages.docling-core
Python library to define and validate data types in Docling
pkgs.python313Packages.docling-slim
Modular version of the Docling package
-
nixos-unstable -
- nixos-unstable-small 2.118.0
pkgs.python314Packages.docling-core
Python library to define and validate data types in Docling
pkgs.python314Packages.docling-slim
Modular version of the Docling package
-
nixos-unstable -
- nixos-unstable-small 2.118.0
pkgs.python313Packages.docling-parse
Simple package to extract text with coordinates from programmatic PDFs
-
nixos-unstable -
- nixos-unstable-small 7.8.1
pkgs.python313Packages.docling-serve
Running Docling as an API service
-
nixos-unstable -
- nixos-unstable-small 1.29.0
pkgs.python314Packages.docling-parse
Simple package to extract text with coordinates from programmatic PDFs
-
nixos-unstable -
- nixos-unstable-small 7.8.1
pkgs.python314Packages.docling-serve
Running Docling as an API service
-
nixos-unstable -
- nixos-unstable-small 1.29.0
pkgs.python313Packages.docling-jobkit
Running a distributed job processing documents with Docling
-
nixos-unstable -
- nixos-unstable-small 3.2.0
pkgs.python314Packages.docling-jobkit
Running a distributed job processing documents with Docling
-
nixos-unstable -
- nixos-unstable-small 3.2.0
pkgs.python313Packages.docling-ibm-models
Docling IBM models
pkgs.python314Packages.docling-ibm-models
Docling IBM models
pkgs.pkgsRocm.python3Packages.docling-core
Python library to define and validate data types in Docling
pkgs.pkgsRocm.python3Packages.docling-ibm-models
Docling IBM models
pkgs.python313Packages.llama-index-readers-docling
Llama-index readers docling integration
-
nixos-unstable -
- nixos-unstable-small 0.4.2
pkgs.python314Packages.llama-index-readers-docling
Llama-index readers docling integration
-
nixos-unstable -
- nixos-unstable-small 0.4.2
pkgs.python313Packages.llama-index-node-parser-docling
Llama-index node_parser docling integration
pkgs.python314Packages.llama-index-node-parser-docling
Llama-index node_parser docling integration
-
nixos-unstable -
- nixos-unstable-small 0.4.2
pkgs.pkgsRocm.python3Packages.llama-index-node-parser-docling
Llama-index node_parser docling integration
Package maintainers
-
@happysalada Raphael Megzari <raphael@megzari.com>
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>
-
@codgician codgician <codgician@outlook.com>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>