CVE-2026-105744

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0.

• CWE-22
• CWE-73
• CWE-1188

• https://github.com/docling-project/docling/commit/38b6fa0a465d46fdacbbec333f50fa19c4f6b342
• https://github.com/docling-project/docling/pull/4419
• https://github.com/docling-project/docling/releases/tag/v2.132.0
• https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j
• https://github.com/docling-project/docling/security/advisories/GHSA-x3q2-h9hx-4r4j

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105712gpgtar in GnuPG before 2.5.19 can allow file overwrite via c…3.6
• CVE-2026-10573A denial-of-service security issue exists in 1734 POINT I/O™…6.3
• CVE-2026-105740Langflow is a tool for building and deploying AI-powered age…9.9
• CVE-2026-105741Langflow is a tool for building and deploying AI-powered age…7.1
• CVE-2026-105742Docling simplifies document processing by parsing diverse fo…3.7
• CVE-2026-105743Docling simplifies document processing by parsing diverse fo…4
• CVE-2026-105745Docling simplifies document processing by parsing diverse fo…6.7
• CVE-2026-105746Docling simplifies document processing by parsing diverse fo…2.2
• CVE-2026-105747Docling simplifies document processing by parsing diverse fo…4.3
• CVE-2026-105748Docling simplifies document processing by parsing diverse fo…4.3
• CVE-2026-105749Docling simplifies document processing by parsing diverse fo…6.5
• CVE-2026-10575IBM MQ could allow an authenticated attacker to cause a deni…8.8