CVE-2026-105744 is a High severity file access flaw in Docling, the document conversion library. From 2.94.0 until 2.132.0, rendering untrusted TikZ with the opt-in Tectonic engine lets crafted input read and write files, and run shell commands if shell escape is enabled. Upgrade to 2.132.0. The default configuration is not affected.
What's affected
- Package: docling and docling-slim (pip), from the docling-project.
- Affected: from 2.94.0 until 2.132.0 for both packages, per the advisory.
- Fixed: 2.132.0.
- Condition: LatexBackendOptions with tikz_engine set to tectonic. The record says the default configuration, which does not enable Tectonic rendering, is not affected.
- Extra risk: setting tikz_engine_allow_shell_escape also permits shell commands through TeX.
The record scores this 7.5 High, and the project advisory also labels it High. The advisory says the issue applies when untrusted LaTeX input is converted with that engine, so your exposure depends entirely on whether you enabled it.
How to check if you're exposed
Docling is a Python package, and it also ships as docling-slim, so check both.
pip show docling docling-slim
pip freeze | grep -i docling
grep -ri "docling" requirements*.txt pyproject.toml poetry.lock uv.lock 2>/dev/null
Check services that convert uploaded documents, notebooks, batch jobs and container images. Then check how Docling is configured, because every Docling advisory in this series depends on a specific option or file type, as described above.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
Search your code for the engine setting.
grep -rn "tikz_engine" .
grep -rn "allow_shell_escape" .
No match means the Tectonic path is not in use. A match, especially one that processes files from users or the internet, means you should upgrade now and confirm shell escape is off.
What to do now
- Upgrade docling and docling-slim to 2.132.0 or later.
- If you cannot upgrade yet, stop using the Tectonic TikZ engine on untrusted input.
- Never enable the shell escape option for content you do not control.
- Run document conversion in a sandbox or container with no secrets and a read only filesystem apart from a scratch folder.
- Check the output of past conversions for rendered pictures that contain unexpected text from the host.
- Read the fix pull request, which makes Tectonic run without shell escape by default and skip TikZ that references outside files.
Why it matters
The record lists CWE-22, path traversal, CWE-73, external control of file name or path, and CWE-1188, insecure default initialization of a resource. The advisory explains that Docling stages only some files into a temporary folder, but TeX can open files at compile time without that limit. A hostile document can therefore reach files the converter process can read or write.
The advisory says file content can be typeset into the rendered picture that ends up in the conversion output, which is how a read becomes a leak. With shell escape on, the same input can run commands, which moves the issue from disclosure to code execution.
The record does not list the CVE as exploited in the wild. The case for reachability thinking is strong here: if the option is not set, the vulnerable code never runs, and you can say so with evidence.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected with default settings?
The record says the default configuration, which does not enable Tectonic rendering, is not affected.
What does the fix change?
Per the pull request, Tectonic now runs without shell escape by default, uses an untrusted and cached only mode, and skips TikZ that references outside files.
Sources
- Docling GitHub security advisory GHSA-x3q2-h9hx-4r4j
- Docling release v2.132.0
- Docling pull request 4419
Last reviewed: 18 October 2026.
