CVE-2026-105744 · GHSA-x3q2-h9hx-4r4j
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
- Risk score
- 73/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
- Affected
- docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
- Fix
- Upgrade docling to 2.132.0; docling-slim to 2.132.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
docling: Amber, patch this week. Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
The flaws
- CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 8.8 · EPSS 0%)
- CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 7.5 · EPSS 0%)
- CVE-2026-105750: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (CVSS 7.5 · EPSS 0%)
- CVE-2026-105749: Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion (CVSS 6.5 · EPSS 0%)
The fix
Upgrade docling: 2.132.0 · 2.120.3 · 2.118.1 · 2.131.0 or later on your release line
Who is exposed: docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
- Same product: Earlier docling warnings. 6 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| docling | pip | >= 2.94.0, < 2.132.0 | 2.132.0 |
| docling-slim | pip | >= 2.94.0, < 2.132.0 | 2.132.0 |
References
- https://github.com/advisories/GHSA-x3q2-h9hx-4r4j
- https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j
- https://nvd.nist.gov/vuln/detail/CVE-2026-105744
- https://github.com/docling-project/docling/pull/4419
- https://github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342
- https://github.com/docling-project/docling/releases/tag/v2.132.0
- https://github.com/advisories/GHSA-x3q2-h9hx-4r4j
Original description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0.
Last activity 5 Oct 2026. Patch Forecast updates every hour.