Marker converts documents into Markdown, JSON, HTML or chunks ready for an AI pipeline. Feed it a PDF, an image, a Word, PowerPoint or Excel file, an HTML page or an EPUB, and it returns text in reading order with tables formatted as tables, equations as LaTeX, code as code blocks, links and references preserved, images saved alongside, and page headers and footers removed. It works in any language.
Under the hood it uses Datalab's Surya vision model for layout and OCR, served locally through vLLM on an NVIDIA GPU or llama.cpp on a CPU or Apple Silicon Mac, and starts that server for you on first use. A balanced mode re-reads whole pages when their embedded text is bad; a fast mode suited to CPUs keeps model use minimal. Add --use_llm to have a language model merge tables across pages, fix inline math and pull values out of forms. There is a command for single files, one for whole folders, a Python API, and a small web app for trying settings.
The code is Apache 2.0, with about 40,600 stars, at v2.0.0 when scanned. The model weights carry a modified OpenRAIL-M licence: free for research, personal use and startups under 5 million dollars in funding or revenue.
- Repository: github.com/datalab-to/marker
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Python. Stars: 40.6K. Forks: 2,936. Last push: Oct 19, 2026.
- Scan: safe, Oct 22, 2026, commit 1749c21
Who it is for
Developers building retrieval or training pipelines from PDFs, researchers turning papers into editable text, and anyone who has fought with copy and paste out of a multi-column PDF.
Getting started
1. Install (Python 3.10 or newer with PyTorch; use marker-pdf[full] for Office and EPUB files)
pip install marker-pdf2. On a Mac or CPU, install the llama.cpp server the OCR model runs on (NVIDIA users need Docker instead)
brew install llama.cpp3. Convert one file
marker_single paper.pdf --output_format markdown4. Convert a whole folder
marker ./pdfsThe first run downloads the models. Use --page_range to test on a few pages, --force_ocr for scans with bad embedded text, and --disable_ocr for clean digital PDFs when you want speed over completeness.
Safety scan
We cloned datalab-to/marker at commit 1749c21 on Oct 22, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns, no committed binaries and no install hooks across 265 files and about 94,000 lines (most of it JSON test data; the Python is about 17,000 lines).
- The hosts in the code are the optional LLM services (Gemini by default, plus OpenAI, OpenRouter and Azure) and models.datalab.to for model downloads. With --use_llm off, documents are processed only on your machine.
- 117 known advisories (5 critical) in uv.lock, the pinned development environment. The criticals are in certifi, GitPython and Pillow image decoding. pip install marker-pdf resolves newer versions within its ranges, which avoids most of them.
- Licensing is split: the code is Apache 2.0, the model weights are free for research, personal use and smaller companies, and larger commercial users need a licence from Datalab.
- 4 workflows. One uses pull_request_target for the CLA bot and does not check out the pull request; none of the 5 third-party actions is pinned to a commit. Licence present; no security policy, Dependabot or CodeQL.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 4 workflows. 1 uses pull_request_target, none check out the pull request head. 5 of 5 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 5 distinct hosts referenced from source; most often github.com, openrouter.ai, api.openai.com, models.datalab.to. No URLs to bare IP addresses. |
| Known vulnerabilities | 117 advisories across 257 pinned packages: 5 critical, 69 high, 39 moderate, 4 low. uv.lock: 257 packages, 117 advisories. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (24 of 117)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-6q48-6c7w-9gw2 | critical | certifi@2026.6.17 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| GHSA-284h-m62q-gf8w | critical | gitpython@3.1.53 | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any… |
| GHSA-332p-7hrc-92wf | critical | pillow@10.4.0 | Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO |
| GHSA-8g5g-8vmr-9782 | critical | pillow@10.4.0 | Pillow: Heap buffer overflow in ImagingJpegDecode |
| GHSA-w889-685w-c8fh | critical | pillow@10.4.0 | Pillow: Argument Injection in Ghostscript call, potentially leading into RCE |
| GHSA-2g87-pp6c-29x5 | high | aiohttp@3.14.1 | aiohttp: Multiple instances of excessive or unbounded memory/CPU use |
| GHSA-5wr8-gcqf-gqf3 | high | aiohttp@3.14.1 | aiohttp server lacks an initial request/header timeout |
| GHSA-9xw5-w5jj-pvcg | high | aiohttp@3.14.1 | AIOHTTP: File descriptor exhaustion in multipart requests |
| GHSA-cq5v-8q36-5273 | high | aiohttp@3.14.1 | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) |
| GHSA-g6cj-pr64-35w5 | high | cryptography@49.0.0 | cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing |
| GHSA-27vj-qcqg-25rc | high | fsspec@2026.4.0 | fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution |
| GHSA-239g-whfq-7xj9 | high | gitpython@3.1.53 | GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution |
| GHSA-3f7w-8rr8-f37f | high | gitpython@3.1.53 | GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file over… |
| GHSA-4gmw-gg2m-w46p | high | gitpython@3.1.53 | GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file over… |
| GHSA-6p8h-3wgx-97gf | high | gitpython@3.1.53 | GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone … |
| GHSA-7833-fr7j-v32q | high | gitpython@3.1.53 | GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigPars… |
| GHSA-8mcc-hrx5-hvxc | high | gitpython@3.1.53 | GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory … |
| GHSA-94p4-4cq8-9g67 | high | gitpython@3.1.53 | GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pg… |
| GHSA-9rj7-rf2p-w77r | high | gitpython@3.1.53 | GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks |
| GHSA-fjr4-x663-mwxc | high | gitpython@3.1.53 | GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled… |
| GHSA-g5vv-9gxw-82hx | high | gitpython@3.1.53 | GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex - commit author/committer f… |
| GHSA-hmq2-w58f-27jc | high | gitpython@3.1.53 | GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitP… |
| GHSA-jm78-9fvv-mhgr | high | gitpython@3.1.53 | GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/… |
| GHSA-r9mr-m37c-5fr3 | high | gitpython@3.1.53 | GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command exe… |
Workflows worth a look
- .github/workflows/cla.yml: pull_request_target
By the numbers
| Stars | 40.6K |
|---|---|
| Forks | 2,936 |
| Contributors | 29 |
| Commits | 1,402 |
| Open issues | 385 |
| Open pull requests | 109 |
| Releases | 72 |
| Latest release | v2.0.0 |
| Licence | Apache-2.0 |
| Main language | Python |
| Project age | 2 years |
| Last push | Oct 19, 2026 |
| Tracked files | 265 |
| Lines of code | 93.8K |
| Checkout size | 14 MB |
Lines by language: JSON 66.1K, Python 16.6K, Markdown 10.7K, YAML 165, Shell 89, TOML 80.
Questions
Is Marker free?
The code is free under Apache 2.0. The model weights are free for research, personal use and organisations under 5 million dollars in funding or revenue; above that, commercial use needs a licence from Datalab, which also sells a hosted API.
How does Marker compare with Docling or MarkItDown?
MarkItDown is a lightweight converter that mostly extracts existing text. Docling and Marker both run layout and OCR models, so they handle scans, tables and equations. Marker is strong on equations and optional LLM cleanup; Docling's code is MIT-licensed with permissively licensed default models, which is simpler for commercial use.
Does Marker need a GPU?
No. Its fast mode runs on a CPU or an Apple Silicon Mac through llama.cpp, which is fine for occasional documents. For large batches or the most accurate balanced mode, an NVIDIA GPU with vLLM is far faster.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.