CVE-2026-105744: Docling Arbitrary File Read/Write and Command Execution Vulnerability
Summary
CVE-2026-105744: When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (LatexBackendOptions(tikz_engine="tectonic")), the TikZ body and the document preamble from the input file are compiled by Tectonic wi... Affects docling-slim versions >= 2.94.0, < 2.132.0. Fixed in 2.132.0. How to fix ↓
Also tracked for
The same CVE-2026-105744 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docling is an open-source tool designed for generating documentation from code and other sources. It supports various backends for rendering documents, including LaTeX. The tool is widely used for its ability to convert untrusted LaTeX documents into visual representations. However, it has a vulnerability when configured to use the Tectonic engine for rendering TikZ graphics, which can lead to severe security risks.
Vulnerability Detail
The vulnerability arises when the LaTeX backend is set to render TikZ pictures using the Tectonic engine. In this configuration, the TikZ body and document preamble are compiled without restrictions on TeX's file primitives. This allows a maliciously crafted .tex file to read arbitrary files accessible to the process and write files to any writable paths. Furthermore, if shell escape is enabled, it can execute shell commands via the \write18 command. The issue is rooted in the way the Tectonic engine handles file operations, which does not adequately restrict access to the filesystem.
How To Fix
Minimum fixed version
2.132.0
This is the first release that contains the fix.
pip install --upgrade "docling-slim==2.132.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For users unable to upgrade to version 2.132.0, avoid enabling the tikz_engine="tectonic" option for untrusted input. Alternatively, run the conversion in a secure OS-level sandbox, ensuring no host mounts, read-only filesystem, and no network access.
Conclusion
The CVE-2026-105744 vulnerability in Docling poses serious risks by allowing arbitrary file access and command execution when using the Tectonic engine for TikZ rendering. Users are advised to upgrade to version 2.132.0 or implement workarounds to mitigate potential threats.
See every vulnerability recorded for docling-slim →
FAQ
CVE-2026-105744 is a vulnerability in the Docling package that allows arbitrary file read/write and command execution when rendering untrusted TikZ with the Tectonic engine.
If your application uses Docling with the Tectonic engine for untrusted LaTeX input, it could lead to unauthorized file access and execution of arbitrary commands, posing a significant security risk.
Versions of Docling prior to 2.132.0 are affected if they use the tikz_engine="tectonic" option with untrusted input.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring installation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for docling-slim.
