74 matches found
CVE-2026-105744
A flaw was found in docling. When configured to process LaTeX documents using the Tectonic engine, the application does not restrict TeX file operations during compilation. An attacker could exploit this vulnerability by submitting crafted document input to read sensitive files or overwrite...
CVE-2026-105744
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...
CVE-2026-105744 Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptionstikzengine="tectonic" invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ bo...
CVE-2026-105744
The Docling library (versions 2.94.0 through 2.132.0 ) is vulnerable to arbitrary file read/write and potential command execution when using the opt-in Tectonic engine to render untrusted TikZ. The root cause lies in docling/backend/latex/engines/tectonic.py, which fails to restrict TeX primitive...
CVE-2018-9090
CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials admin/admin for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured b...
EUVD-2025-177413
Malicious code in orbit-typeorm-nucleosynthesis-tectonic npm...
EUVD-2025-178395
Malicious code in inquirer-flare-sass-loader-tectonic npm...
EUVD-2025-179088
Malicious code in equinox-blueshift-exosphere-tectonic npm...
EUVD-2025-180500
Malicious code in adonis-tectonophysics-tectonic-helmet npm...
EUVD-2025-176030
Malicious code in tectonic-seismology-upgrade-commitizen npm...
EUVD-2025-176032
Malicious code in tectonic-pegasus-axios-nashira npm...
EUVD-2025-179771
Malicious code in changelog-hugo-fusion-tectonic npm...
EUVD-2025-175555
Malicious code in whitedwarf-tectonic-izar-hermes npm...
EUVD-2025-177891
Malicious code in mesosphere-kinetic-ignite-tectonic npm...
MAL-2025-187776 Malicious code in library-capella-tectonic-child-process (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad6929a0d0d976d5d901ed69745f745aa60c1112cc89324dcf4401cade4b817 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186794 Malicious code in equinox-blueshift-exosphere-tectonic (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb960ed72e6f1d7c175342151d10ecb8869ecbc7a1b0cd3a820b2a7d7918ed31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-175517
Malicious code in xanthus-tectonic-levels-xanadu npm...
EUVD-2025-175600
Malicious code in webdriver-mocha-tectonic-leda-antimatter npm...