pypi python-doctr vulnerabilities

Latest pypi python-doctr CVEs

Newest publication first

1. CVE-2026-112304 docTR through 1.1.0 Unsafe Deserialization RCE via load_pretrained_params()

   Published 2026-10-19

   High·CVSS 7.7

   docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.