Please report suspected vulnerabilities privately through GitHub's security advisory interface rather than a public issue.

The project parses PDFs and invokes optional external programs including LaTeX, LibreOffice, Poppler, and dvipng. Treat untrusted input as potentially hostile: use an unprivileged account or container, restrict network access, and apply resource limits. Do not pass unreviewed LaTeX catalogs to a privileged TeX installation.

Only the latest release is supported with security fixes.