Docling: Arbitrary file read/write via untrusted TikZ rendering with Tectonic
Summary
Docling, a Python library for document processing, is affected when the optional LaTeX backend is configured with tikz_engine='tectonic'. The Tectonic engine compiles TikZ content and preambles from untrusted LaTeX files without restricting TeX file primitives, so a crafted file can read files the process can access and create or overwrite writable files. If shell escape is also enabled, commands can be executed through TeX. The default configuration is not affected.
Affected
- docling and docling-slim from 2.94.0 before 2.132.0
- Only when tikz_engine='tectonic' is set, a tectonic binary is available (on PATH or in the docling cache), and untrusted LaTeX is converted
- Default configuration (tikz_engine=None) is not affected
Fixed in
- Fixed in 2.132.0 (commit 38b6fa0, PR #4419), but the advisory states this pre-check can be bypassed
- Fully addressed in 2.142.1 or later (GHSA-h8jf-9f4f-2v9h), which runs Tectonic only when tikz_engine_trusted_input=True is set
Workaround
- Do not enable tikz_engine='tectonic' for untrusted input
- Never set tikz_engine_allow_shell_escape=True for untrusted input
- Run conversions in an isolated environment (container, no host mounts, read-only filesystem, no network)
- Verify that no tectonic binary is installed if the option is not needed
Exploitation
- CISA SSVC: exploitation status 'poc', automatable 'no', technical impact 'total'
- A public proof of concept exists (the advisory includes a test case writing a file to /tmp)
- No evidence of exploitation in the wild found; not confirmed in the CISA KEV catalog
Our recommendation
- Upgrade docling and docling-slim to 2.142.1 or later, which the advisory recommends; 2.132.0 is only a partial fix
- Until upgraded, confirm that tikz_engine='tectonic' and tikz_engine_allow_shell_escape are not used and that no tectonic binary is present
- Process LaTeX uploads from external sources only in an isolated, sandboxed environment
- Monitor for unexpected file creation or changes on the conversion host
- Note: NVD/CNA scoring differs (CVSS 8.8 in the CVE data, 7.5 with AC:H in the advisory); assess with the higher value until the NVD entry is verified
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-x3q2-h9hx-4r4j github.com
- Fix commit 38b6fa0a465d46fdacbbec333f50fa19c4f6b342 github.com
- Pull request #4419 github.com
- Docling release v2.132.0 github.com
- OSV entry GHSA-x3q2-h9hx-4r4j osv.dev
- GitLab Advisory Database entry for docling-slim advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:28.
Original description (NVD)
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0.
NVD references (5)
- https://github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342
- https://github.com/docling-project/docling/pull/4419
- https://github.com/docling-project/docling/releases/tag/v2.132.0
- https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j
- https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.