CVE-2026-0685 is a code injection vulnerability in Edgewall's Genshi Template Engine version 0.7.9. The flaw resides in the expression evaluation component, enabling remote attackers to perform server-side template injection (SSTI). By submitting crafted template expressions, attackers can achieve remote code execution (RCE) on the server running the vulnerable Genshi version. The vulnerability is classified as CWE-94, reflecting improper control over code generation. No CVSS score or vendor remediation information is currently available. The vulnerability was published on 2026-06-26, with a vendor advisory hosted by CERT but lacking patch details.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the server hosting the vulnerable Genshi Template Engine version 0.7.9. This can lead to full system compromise, data breach, or further attacks within the affected environment. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory at https://www.kb.cert.org/vuls/id/244846 for current remediation guidance. Until an official fix is available, avoid processing untrusted template expressions with Genshi version 0.7.9 or consider disabling the vulnerable functionality if possible.