EUVD-2026-92804
GHSA-x3q2-h9hx-4r4j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H because exploitation depends on a non-default Tectonic opt-in outside attacker control; PR:N as the attacker only supplies a document, UI:R as an operator must process it; arbitrary file read/write yields C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 2 pypi packages depend on docling (2 direct, 0 indirect)
- 3 pypi packages depend on docling-slim (2 direct, 2 indirect)
Ecosystem-wide dependent count for version 2.94.0 and other introduced versions.
DescriptionNVD
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0.
AnalysisAI
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter process and create or overwrite writable files when the caller has explicitly opted into Tectonic rendering via LatexBackendOptions(tikz_engine="tectonic"); enabling the additional tikz_engine_allow_shell_escape option escalates this to shell command execution through TeX. The default Docling configuration does not enable Tectonic rendering and is not affected, and exploitation further requires a victim or operator to feed the crafted document into the pipeline (UI:R), which is why the practical risk is conditional despite the high CVSS base score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the converter to be explicitly configured with LatexBackendOptions(tikz_engine="tectonic"); the default configuration does not enable Tectonic rendering and is NOT affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditional high-impact flaw rather than a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 2.132.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of docling and docling-slim, confirm whether any run versions 2.94.0 through 2.131.x, and immediately disable LatexBackendOptions(tikz_engine="tectonic") and tikz_engine_allow_shell_escape unless a documented business need requires them; within 7 days, test and deploy the vendor-released patch 2.132.0 to all affected docling and docling-slim instances, prioritizing any pipeline that ingests untrusted LaTeX/TikZ documents or is externally reachable; within 30 days, verify that no affected versions remain, monitor package versions for regressions, and restrict document-conversion workloads from processing untrusted files outside a hardened sandbox.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Docling Slim
View allLocal file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOp
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendO
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaus
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker e
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today