HIGH 7.2 GitHub
CVE-2026-53964
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
### Impact
A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the `xltpl` library uses a npn-sandboxed Jinja environment for the processing of the template.
### Patches
It has been patched in [v9.1.0](https://github.c
Affected Products
- pip/document-merge-service < 9.1.0
References
- https://github.com/advisories/GHSA-w47q-945m-q9pc
- https://github.com/adfinis/document-merge-service/security/advisories/GHSA-w47q-945m-q9pc
- https://github.com/adfinis/document-merge-service/releases/tag/v9.1.0
- https://github.com/advisories/GHSA-w47q-945m-q9pc
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-08-19 via GitHub. Affected: pip/document-merge-service < 9.1.0.
vulnfeed aggregates 11644 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.