GitHub Advisoryadvisory · PyPI

GHSA-w47q-945m-q9pc Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

HIGH Published 2026-08-19 Modified 2026-08-19 Official page ↗
Aliases
CVE-2026-53964
Ecosystem
PyPI
Packages
document-merge-service
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1336
Reviewed
2026-08-19

Affected packages

• PyPI document-merge-service: < 9.1.0 → fixed in 9.1.0

Description

Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the `xltpl` library uses a npn-sandboxed Jinja environment for the processing of the template. Patches It has been patched in v9.1.0 Workarounds Disable the upload/usage of XLSX templates. References Are there any links users can visit to find out more? https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti

Related

Alias · CVE (1)

  • CVE-2026-53964 Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References