{"vulnerability": "cve-2026-105744", "sightings": [{"uuid": "edddd8c7-3e70-4bb4-a1bf-a3fc5143ae49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105744", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx5ymoh3ak2e", "content": "\ud83d\udfe0 CVE-2026-105744 - High (7.5)\n\nDocling simplifies document processing by parsing diverse formats and providing integrations with...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105744/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-05T22:46:00.290650Z"}, {"uuid": "eb14bb3d-6621-4e05-b2a0-deb82982a351", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105744", "type": "published-proof-of-concept", "source": "https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j", "content": "", "creation_timestamp": "2026-10-01T11:54:36.000000Z"}, {"uuid": "706c86b3-724a-4b99-9c77-8b4ab54c427b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105744", "type": "seen", "source": "https://gist.github.com/alon710/71c3324590931dd5b7e79350fdbda213", "content": "# CVE-2026-105744: CVE-2026-105744: Arbitrary File Read and Remote Code Execution in Docling Tectonic Engine\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105744\n\n## Summary\nDocling, a tool for parsing and processing diverse document formats, is vulnerable to arbitrary file read, arbitrary file write, and potential remote code execution (RCE) in versions 2.94.0 through 2.131.0. The vulnerability occurs when applications configure Docling to use the Tectonic engine for rendering TikZ diagrams into images. Because the compilation did not restrict hazardous TeX primitives or sandbox the environment, an attacker can supply crafted documents containing malicious TikZ definitions to access or modify local files and execute arbitrary commands under the privileges of the processing application.\n\n## TL;DR\nA high-severity vulnerability in Docling's optional Tectonic rendering engine allows remote attackers to read arbitrary files, overwrite critical server assets, or execute arbitrary commands via crafted LaTeX inputs containing malicious TikZ macros.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-73, CWE-1188\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.00304 (Percentile: 21.27%)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Docling Document Parsing Applications running Tectonic rendering\n- Docling Slim installations with Tectonic engine enabled\n- **docling**: >= 2.94.0, < 2.132.0 (Fixed in: `2.132.0`)\n- **docling-slim**: >= 2.94.0, < 2.132.0 (Fixed in: `2.132.0`)\n\n## Mitigation\n\n- Upgrade the Docling installation to version 2.132.0 or newer.\n- Avoid enabling Tectonic rendering unless required.\n- Isolate document processing within restricted sandbox environments (Docker with read-only filesystems or gVisor).\n\n**Remediation Steps:**\n1. Run 'pip install --upgrade docling docling-slim' to update package dependencies.\n2. Verify that configurations utilizing LatexBackendOptions explicitly avoid setting 'tikz_engine' to 'tectonic' or 'tikz_engine_allow_shell_escape' to True unless securely sandboxed.\n\n## References\n\n- [Official Vendor Advisory (GHSA)](https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j)\n- [Fix Commit (GitHub)](https://github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-105744)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105744) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T07:30:31.000000Z"}]}