CVE-2026-105744: Docling Arbitrary File Read/Write and Command Execution Vulnerability
Summary
CVE-2026-105744: When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (LatexBackendOptions(tikz_engine="tectonic")), the TikZ body and the document preamble from the input file are compiled by Tectonic wi... Affects docling versions >= 2.94.0, < 2.132.0. Fixed in 2.132.0. How to fix ↓
Also tracked for
- docling-slim · PyPI
The same CVE-2026-105744 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docling is an open-source tool designed for converting documents written in LaTeX into various formats. It utilizes different backends for rendering, including the Tectonic engine for TikZ pictures. This functionality allows users to create complex graphics within their documents. However, when configured to use the Tectonic engine with untrusted input, it becomes susceptible to severe security vulnerabilities.
Vulnerability Detail
The vulnerability arises when the LaTeX backend is set to render TikZ pictures using the Tectonic engine. In this configuration, the TikZ body and document preamble are compiled without restrictions on TeX's file primitives. A maliciously crafted .tex file can exploit this to read arbitrary files accessible to the process and write files to any writable path. If shell escape is enabled, it can also execute shell commands through the \write18 command. This poses a significant risk of local file disclosure and unauthorized file creation or modification, potentially leading to code execution.
How To Fix
Latest published version: 2.142.0 as of 22 Oct 2026
pip install --upgrade "docling==2.142.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.132.0
This is the first release that contains the fix.
pip install --upgrade "docling==2.132.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade to the patched version, avoid enabling 'tikz_engine="tectonic"' for untrusted input. Alternatively, run the conversion in a secure environment, such as a container with no host mounts, a read-only filesystem, and no network access.
Conclusion
The CVE-2026-105744 vulnerability in Docling poses significant risks when using the Tectonic engine with untrusted input. Users are strongly advised to upgrade to version 2.132.0 or later to mitigate these risks. For those unable to upgrade, implementing the suggested workarounds can help reduce exposure to this vulnerability.
See every vulnerability recorded for docling →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
An attacker can read arbitrary files and write files to any writable path, potentially leading to code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, you can avoid using 'tikz_engine="tectonic"' for untrusted input and run the conversion in a secure environment.
The consequences include unauthorized access to sensitive files, data leakage, and the possibility of executing arbitrary commands on the host system.
References
Related vulnerabilities
Recent vulnerabilities recorded for docling.
