Summary
Docling's optional Tectonic TikZ rendering can process untrusted TeX content without adequately restricting file-access primitives such as \openin and \openout. An attacker who can supply or influence TikZ input may read accessible files, create or overwrite writable files, and, when shell escape is enabled, execute commands through the TeX engine.
Docling's optional Tectonic TikZ rendering can process untrusted TeX content without adequately restricting file-access primitives such as \openin and \openout. An attacker who can supply or influence TikZ input may read accessible files, create or overwrite writable files, and, when shell escape is enabled, execute commands through the TeX engine.
Affected context
The vulnerability affects Docling deployments that explicitly enable the Tectonic backend through LatexBackendOptions(tikz_engine="tectonic") and process attacker-controlled or insufficiently trusted TikZ bodies or document preambles. The default configuration, which does not enable Tectonic rendering, is not affected; risk is increased when the converter has access to sensitive files or writable filesystem locations.
The vulnerability affects Docling deployments that explicitly enable the Tectonic backend through LatexBackendOptions(tikz_engine="tectonic") and process attacker-controlled or insufficiently trusted TikZ bodies or document preambles. The default configuration, which does not enable Tectonic rendering, is not affected; risk is increased when the converter has access to sensitive files or writable filesystem locations.
Exploit preconditions
- Attack surface: TikZ and LaTeX rendering through the optional Tectonic backend
- Required access: Ability to provide or influence content processed as a TikZ body or document preamble
- Trigger point: Compilation of the supplied content by the Tectonic engine
- Why exploitation is possible: TeX file primitives are not sufficiently restricted, allowing input to interact with files available to the converter; enabling shell escape additionally expands the available command-execution capabilities
- Attack surface: TikZ and LaTeX rendering through the optional Tectonic backend
- Required access: Ability to provide or influence content processed as a TikZ body or document preamble
- Trigger point: Compilation of the supplied content by the Tectonic engine
- Why exploitation is possible: TeX file primitives are not sufficiently restricted, allowing input to interact with files available to the converter; enabling shell escape additionally expands the available command-execution capabilities
Why this happens
The underlying issue is the use of a TeX compilation environment that permits file-oriented primitives while processing untrusted document content. TeX commands such as \openin and \openout can access or modify filesystem paths unless the execution environment applies suitable restrictions. This behavior is consistent with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with related characteristics of CWE-73: External Control of File Name or Path and CWE-1188: Insecure Default Initialization of Resource when dangerous rendering capabilities or shell access are insufficiently constrained.
The underlying issue is the use of a TeX compilation environment that permits file-oriented primitives while processing untrusted document content. TeX commands such as \openin and \openout can access or modify filesystem paths unless the execution environment applies suitable restrictions. This behavior is consistent with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with related characteristics of CWE-73: External Control of File Name or Path and CWE-1188: Insecure Default Initialization of Resource when dangerous rendering capabilities or shell access are insufficiently constrained.
Potential impact
- An attacker may read files accessible to the converter process
- An attacker could create or overwrite writable files
- Sensitive credentials or application data may be exposed
- Generated documents or runtime configuration may be tampered with
- Shell escape may permit command execution within the converter environment
- The converter process or adjacent workloads could be compromised
- An attacker may read files accessible to the converter process
- An attacker could create or overwrite writable files
- Sensitive credentials or application data may be exposed
- Generated documents or runtime configuration may be tampered with
- Shell escape may permit command execution within the converter environment
- The converter process or adjacent workloads could be compromised
General mitigation guidance
Mitigation generally focuses on treating TikZ and LaTeX input as active content rather than passive document data.
Common defensive patterns include:
- Keeping Tectonic rendering disabled unless the feature is explicitly required
- Using a sandboxed, least-privileged rendering process with a narrowly scoped filesystem view
- Restricting or disabling TeX file primitives and shell escape capabilities
- Applying strict resource, path, and output-directory policies
- Reducing the trust placed in document bodies and preambles before compilation
- Separating rendering workloads from sensitive application and host resources
- Using read-only filesystems and minimal service permissions where practical
Mitigation generally focuses on treating TikZ and LaTeX input as active content rather than passive document data.
Common defensive patterns include:
- Keeping Tectonic rendering disabled unless the feature is explicitly required
- Using a sandboxed, least-privileged rendering process with a narrowly scoped filesystem view
- Restricting or disabling TeX file primitives and shell escape capabilities
- Applying strict resource, path, and output-directory policies
- Reducing the trust placed in document bodies and preambles before compilation
- Separating rendering workloads from sensitive application and host resources
- Using read-only filesystems and minimal service permissions where practical
How teams detect issues like this
Organizations can look for:
- Static analysis and code review findings involving TeX compilation of externally supplied content
- Configuration checks that identify enabled Tectonic rendering or shell escape
- References to unrestricted file primitives, output directories, or user-controlled document preambles
- Runtime monitoring for unexpected file reads, file creation, overwrites, or child-process launches by converter workloads
- Policy enforcement requiring sandboxed document rendering and least-privilege filesystem access
- Automated security review tools that flag dynamic document compilation and externally controlled paths
Organizations can look for:
- Static analysis and code review findings involving TeX compilation of externally supplied content
- Configuration checks that identify enabled Tectonic rendering or shell escape
- References to unrestricted file primitives, output directories, or user-controlled document preambles
- Runtime monitoring for unexpected file reads, file creation, overwrites, or child-process launches by converter workloads
- Policy enforcement requiring sandboxed document rendering and least-privilege filesystem access
- Automated security review tools that flag dynamic document compilation and externally controlled paths
