GHSA-X3Q2-H9HX-4R4J

Vulnerability from github – Published: 2026-10-07 20:42 – Updated: 2026-10-07 20:42
VLAI
Summary
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Details

Summary

When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (LatexBackendOptions(tikz_engine="tectonic")), the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can read files the process can read and write files at paths the process can write. If the caller also sets tikz_engine_allow_shell_escape=True, the document can run shell commands through \write18.

Details

docling/backend/latex/engines/tectonic.py writes the picture source into a temporary document and runs the tectonic binary on it. _resolve_local_dependency only decides which files are staged into the temporary directory. It does not limit what TeX opens at compile time, so:

  • \input{/abs/path}, \verbatiminput{...} and \openin read arbitrary files, and their content can be typeset into the rendered picture that ends up in the conversion output. For an in-memory DocumentStream, staging is skipped entirely.
  • \immediate\openout / \write create or overwrite files outside the temporary directory. Neither needs shell escape. Tectonic's --untrusted flag does not block them either.

Separately, the TectonicEngine constructor defaults to allow_shell_escape=True. The LaTeX backend always passes tikz_engine_allow_shell_escape explicitly (default False), so this default only affects code that instantiates TectonicEngine directly.

Affected configurations

  • Affected: callers that set tikz_engine="tectonic", have a tectonic binary available (on PATH or in the docling cache), and convert untrusted LaTeX.
  • Not affected: the default configuration (tikz_engine=None). docling does not install tectonic automatically, and the CLI exposes no option to enable it.

Impact

Disclosure of local files readable by the process, and creation or overwrite of files writable by the process. Writing to startup or configuration files can lead to code execution. With shell escape enabled, commands run directly.

Proof of concept

\documentclass{article}
\usepackage{tikz}
\begin{document}
\begin{tikzpicture}
  \immediate\openout15=/tmp/docling-tectonic-poc.txt
  \immediate\write15{written by the input document}
  \immediate\closeout15
  \node {x};
\end{tikzpicture}
\end{document}

Converting this file with LatexBackendOptions(tikz_engine="tectonic") creates /tmp/docling-tectonic-poc.txt.

Patches

Mitigated in docling 2.132.0 by #4419:

  • TectonicEngine now defaults to allow_shell_escape=False, and without shell escape Tectonic runs with --untrusted and --only-cached.
  • Before compiling, docling checks the generated document and every staged file. It skips rendering, and keeps the diagram as TikZ code, when the source uses the \openin, \openout, \XeTeXpicfile or \XeTeXpdffile primitives, or names an absolute, home, drive-letter or parent-directory path in \input, \include, \includegraphics, \InputIfFileExists or \graphicspath.

This check is best-effort. It reads the source text, and TeX can open files in ways a text check cannot see, for example through package commands or names built by macros. As documented in the pipeline options reference, untrusted LaTeX rendered with tikz_engine="tectonic" should still be processed in an isolated environment.

Workarounds

Upgrade to 2.132.0. For older versions:

  • Do not enable tikz_engine="tectonic" for untrusted input, or run the conversion in an OS-level sandbox (container, no host mounts, read-only filesystem, no network).
  • Never set tikz_engine_allow_shell_escape=True for untrusted input.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.94.0"
            },
            {
              "fixed": "2.132.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.94.0"
            },
            {
              "fixed": "2.132.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-105744"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:42:05Z",
    "nvd_published_at": "2026-10-05T22:16:57Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nWhen the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions(tikz_engine=\"tectonic\")`), the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX\u0027s file primitives. A crafted `.tex` file can read files the process can read and write files at paths the process can write. If the caller also sets `tikz_engine_allow_shell_escape=True`, the document can run shell commands through `\\write18`.\n\n### Details\n\n`docling/backend/latex/engines/tectonic.py` writes the picture source into a temporary document and runs the `tectonic` binary on it. `_resolve_local_dependency` only decides which files are staged into the temporary directory. It does not limit what TeX opens at compile time, so:\n\n- `\\input{/abs/path}`, `\\verbatiminput{...}` and `\\openin` read arbitrary files, and their content can be typeset into the rendered picture that ends up in the conversion output. For an in-memory `DocumentStream`, staging is skipped entirely.\n- `\\immediate\\openout` / `\\write` create or overwrite files outside the temporary directory. Neither needs shell escape. Tectonic\u0027s `--untrusted` flag does not block them either.\n\nSeparately, the `TectonicEngine` constructor defaults to `allow_shell_escape=True`. The LaTeX backend always passes `tikz_engine_allow_shell_escape` explicitly (default `False`), so this default only affects code that instantiates `TectonicEngine` directly.\n\n### Affected configurations\n\n- Affected: callers that set `tikz_engine=\"tectonic\"`, have a `tectonic` binary available (on `PATH` or in the docling cache), and convert untrusted LaTeX.\n- Not affected: the default configuration (`tikz_engine=None`). docling does not install `tectonic` automatically, and the CLI exposes no option to enable it.\n\n### Impact\n\nDisclosure of local files readable by the process, and creation or overwrite of files writable by the process. Writing to startup or configuration files can lead to code execution. With shell escape enabled, commands run directly.\n\n### Proof of concept\n\n```latex\n\\documentclass{article}\n\\usepackage{tikz}\n\\begin{document}\n\\begin{tikzpicture}\n  \\immediate\\openout15=/tmp/docling-tectonic-poc.txt\n  \\immediate\\write15{written by the input document}\n  \\immediate\\closeout15\n  \\node {x};\n\\end{tikzpicture}\n\\end{document}\n```\n\nConverting this file with `LatexBackendOptions(tikz_engine=\"tectonic\")` creates `/tmp/docling-tectonic-poc.txt`.\n\n### Patches\n\nMitigated in docling 2.132.0 by [#4419](https://github.com/docling-project/docling/pull/4419):\n\n- `TectonicEngine` now defaults to `allow_shell_escape=False`, and without shell escape Tectonic runs with `--untrusted` and `--only-cached`.\n- Before compiling, docling checks the generated document and every staged file. It skips rendering, and keeps the diagram as TikZ code, when the source uses the `\\openin`, `\\openout`, `\\XeTeXpicfile` or `\\XeTeXpdffile` primitives, or names an absolute, home, drive-letter or parent-directory path in `\\input`, `\\include`, `\\includegraphics`, `\\InputIfFileExists` or `\\graphicspath`.\n\nThis check is best-effort. It reads the source text, and TeX can open files in ways a text check cannot see, for example through package commands or names built by macros. As documented in the [pipeline options reference](https://github.com/docling-project/docling/blob/main/docs/reference/pipeline_options.md), untrusted LaTeX rendered with `tikz_engine=\"tectonic\"` should still be processed in an isolated environment.\n\n### Workarounds\n\nUpgrade to 2.132.0. For older versions:\n\n- Do not enable `tikz_engine=\"tectonic\"` for untrusted input, or run the conversion in an OS-level sandbox (container, no host mounts, read-only filesystem, no network).\n- Never set `tikz_engine_allow_shell_escape=True` for untrusted input.",
  "id": "GHSA-x3q2-h9hx-4r4j",
  "modified": "2026-10-07T20:42:05Z",
  "published": "2026-10-07T20:42:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105744"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/pull/4419"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.132.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.