docling-project/docling

Summary

The repository contains one critical finding related to the use of a curl command that explicitly allows TLS 1.2 but is part of a shell script download pattern that could be manipulated. While the command itself enforces TLS 1.2 (not 1.0/1.1), the use of 'curl | sh' for installing external dependencies presents a supply chain risk. This is a LaTeX backend engine component with moderate business impact if compromised.