The vulnerability arises from Docling Core's use of PyYAML's FullLoader to deserialize user-supplied YAML documents. When the application calls load_from_yaml with untrusted data, an attacker can embed arbitrary Python objects that will be instantiated during parsing, leading to remote code execution. The issue is identified as CWE-502: Deserialization of Untrusted Data. Successful exploitation allows an attacker to run arbitrary code with the privileges of the running process.

The affected product is Docling Core, maintained by the docling-project, as part of the Docling document processing ecosystem. Vulnerable versions span from 2.21.0 up to, but not including, 2.48.4. Systems running any of these releases that load external YAML files via the load_from_yaml() method are susceptible.

The CVSS score of 8.1 reflects high severity; the EPSS score indicates very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector remains remote and can be triggered without authentication if the application processes malicious YAML files, for example through an open API or upload endpoint. The patch replaces FullLoader with SafeLoader, eliminating the unsafe deserialization path.