Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

QFinch assessment

When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (LatexBackendOptions(tikzengine="tectonic")), the TikZ body and the document preamble from the input file are compiled by Tectonic without any restriction on TeX's file primitives. A crafted .tex file can read files the process can read and write files at paths the process can write. If the caller also sets tikzengineallowshellescape=True, the document can run shell commands through \write18.

Potential impact

Disclosure of local files readable by the process, and creation or overwrite of files writable by the process. Writing to startup or configuration files can lead to code execution. With shell escape enabled, commands run directly.

Technical context

docling/backend/latex/engines/tectonic.py writes the picture source into a temporary document and runs the tectonic binary on it. resolvelocaldependency only decides which files are staged into the temporary directory. It does not limit what TeX opens at compile time, so: - \input{/abs/path}, \verbatiminput{...} and \openin read arbitrary files, and their content can be typeset into the rendered picture that ends up in the conversion output. For an in-memory DocumentStream, staging is skipped entirely. - \immediate\openout / \write create or overwrite files outside the temporary directory. Neither needs shell escape. Tectonic's --untrusted flag does not block them either. Separately, the TectonicEngine constructor defaults to allowshellescape=True. The LaTeX backend always passes tikzengineallowshellescape explicitly (default False), so this default only affects code that instantiates TectonicEngine directly.