CVE-2026-105744 in Docling
Summary
by MITRE • 10/06/2026
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Docling library serves as a critical tool for document processing by parsing diverse formats and integrating with the generative AI ecosystem. However, versions ranging from 2.94.0 to 2.132.0 contain a significant security vulnerability related to the handling of LaTeX content when using specific backend configurations. Specifically, when users opt into LatexBackendOptions with the tectonic engine set to "tectonic", the system invokes docling/backend/latex/engines/tectonic.py to compile TikZ bodies and document preambles. This process lacks adequate sanitization or restriction of TeX file primitives such as \openin and \openout, which are standard commands in LaTeX for reading from and writing to external files respectively.
This architectural flaw allows crafted input to interact directly with the underlying operating system's file structure. An attacker providing malicious TikZ code can exploit these unrestricted primitives to read arbitrary files that are accessible to the converter process. Furthermore, the vulnerability permits the creation or overwriting of writable files on the host system. This capability transforms a document parsing function into a potential vector for unauthorized data exfiltration and local file manipulation, undermining the integrity and confidentiality of the environment in which Docling operates.
The severity of this issue is further amplified by an optional configuration setting known as tikz_engine_allow_shell_escape. When this option is enabled, it permits shell commands to be executed through TeX processing mechanisms. This effectively elevates the vulnerability from a file access risk to a remote code execution vector, allowing for arbitrary command execution on the host system with the privileges of the user running the Docling application. It is important to note that the default configuration does not enable Tectonic rendering by default, meaning systems using standard settings are generally not affected unless explicitly configured otherwise.
This vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), as well as CWE-78, the improper neutralization of special elements used in an OS command (OS Command Injection) when shell escape is enabled. In terms of MITRE ATT&CK mapping, this behavior corresponds to techniques involving file and directory discovery for data exfiltration, as well as execution via system commands if shell access is granted. The flaw represents a classic case of insufficient input validation where untrusted content is processed by an interpreter with broad system capabilities without appropriate sandboxing or restriction mechanisms.
To mitigate this risk, organizations using Docling must ensure they are running version 2.132.0 or later, which includes the necessary fixes to restrict these dangerous primitives and prevent unauthorized file operations. For environments that cannot immediately upgrade, it is imperative to verify that the tikz_engine_allow_shell_escape option remains disabled and that the tectonic engine is not utilized unless absolutely necessary. Additionally, implementing strict input validation on any LaTeX content before passing it to the parser can provide an additional layer of defense against such injection attacks.