CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (LatexBackendOptions(tikz_engine="tectonic")), the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX’s file primitives. A crafted .tex file can read files the process can read and write files at paths the process can write. If the caller also sets tikz_engine_allow_shell_escape=True, the document can run shell commands through \write18.
References
- github.com/advisories/GHSA-x3q2-h9hx-4r4j
- github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342
- github.com/docling-project/docling/pull/4419
- github.com/docling-project/docling/releases/tag/v2.132.0
- github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j
- nvd.nist.gov/vuln/detail/CVE-2026-105744
Code Behaviors & Features
Detect and mitigate CVE-2026-105744 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →