All vulnerabilities
CVE-2026-53964GHSA-w47q-945m-q9pcPYSEC-2026-3830

document-merge-service: Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

adfinis document-merge-servicePyPILibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.49%Chance of exploitation activity in the next 30 days, higher than 41% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.1.0Fixed versionOSV
Published1 Oct 2026Updated 1 Oct 2026CVE List

What fixes it

  • 9.1.0document-merge-service, PyPIOSVpip install "document-merge-service>=9.1.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.

Text from CVE List

Affected versions 34

  • document-merge-serviceaffected: < 9.1.0CVE List
  • document-merge-service, PyPIfrom first release, fixed in 9.1.0OSV
  • document-merge-service, PyPI5.2.0OSV
  • document-merge-service, PyPI5.2.1OSV
  • document-merge-service, PyPI6.0.0OSV
  • document-merge-service, PyPI6.1.0OSV
  • document-merge-service, PyPI6.1.1OSV
  • document-merge-service, PyPI6.1.2OSV
  • document-merge-service, PyPI6.2.0OSV
  • document-merge-service, PyPI6.2.1OSV
  • document-merge-service, PyPI6.2.2OSV
  • document-merge-service, PyPI6.3.0OSV
  • document-merge-service, PyPI6.3.1OSV
  • document-merge-service, PyPI6.4.0OSV
  • document-merge-service, PyPI6.4.1OSV
  • document-merge-service, PyPI6.4.2OSV
  • document-merge-service, PyPI6.4.3OSV
  • document-merge-service, PyPI6.4.4OSV
  • document-merge-service, PyPI6.4.5OSV
  • document-merge-service, PyPI6.4.6OSV
  • document-merge-service, PyPI6.5.0OSV
  • document-merge-service, PyPI6.5.1OSV
  • document-merge-service, PyPI6.5.2OSV
  • document-merge-service, PyPI6.6.0OSV
  • document-merge-service, PyPI6.6.1OSV
  • document-merge-service, PyPI7.0.0OSV
  • document-merge-service, PyPI7.0.1OSV
  • document-merge-service, PyPI7.0.2OSV
  • document-merge-service, PyPI7.1.0OSV
  • document-merge-service, PyPI8.0.0OSV
  • document-merge-service, PyPI8.0.2OSV
  • document-merge-service, PyPI8.0.3OSV
  • document-merge-service, PyPI8.1.0OSV
  • document-merge-service, PyPI9.0.0OSV

References 2