CVE-2026-47214: Docling HTML backend unsafe URI and path handling

Summary

CVE-2026-47214 affects Docling, a document processing library that parses diverse formats and integrates with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling, mapped to CWE-73 (External Control of File Name or Path) and CWE-400 (Uncontrolled Resource Consumption). NIST has not yet provided an NVD assessment.

Mitigation

Fixed in 2.94.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• doclingPyPINo LLM dependency detected · 9 tracked dependents

Related items

• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
• HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database
• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News