CVE-2026-105744: Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikzengine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikzengineallowshellescape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
doclingto a version that resolves this vulnerability.Fixed in 2.132.0
Event History
Frequently Asked Questions
Which deployments are affected?
Docling versions from 2.94.0 until 2.132.0 are affected only when callers explicitly configure LatexBackendOptions(tikz_engine="tectonic") and render untrusted TikZ content. The default configuration does not enable Tectonic rendering and is not affected.
What level of attacker access is required?
An attacker needs to cause the converter to render crafted, untrusted TikZ content, including the TikZ body or document preamble. No prior privileges are required, but user interaction is required according to the supplied severity vector.
What can an attacker do without shell escape enabled?
Crafted TeX can use unrestricted file primitives such as \openin and \openout to read files available to the converter and create or overwrite files writable by the converter. Shell command execution requires the separate tikz_engine_allow_shell_escape option to be enabled.
How can I determine whether my environment is exposed?
Check whether your Docling version is earlier than 2.132.0 and whether application code opts into LatexBackendOptions(tikz_engine="tectonic"). Environments that also set tikz_engine_allow_shell_escape have the additional command-execution exposure.
What should be done if an immediate upgrade is not possible?
Do not render untrusted TikZ with the opt-in Tectonic engine, and ensure tikz_engine_allow_shell_escape is disabled. Upgrade to Docling 2.132.0 when possible.