CVE-2026-53964: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine in adfinis document-merge-service
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.
AI Analysis
Technical Summary
The document-merge-service provides an API for managing and merging document templates. Versions before 9.1.0 contain a vulnerability in the handling of XLSX templates where the xltpl library uses a sandboxed Jinja environment that is improperly neutralized, leading to server-side template injection. This allows remote attackers to execute arbitrary code in the server context as the document-merge-server user (UID 901), potentially compromising the container. The issue is fixed in version 9.1.0.
Potential Impact
Successful exploitation results in remote code execution with the privileges of the document-merge-server user, granting significant control over the container hosting the service. This can lead to full compromise of the container environment, impacting confidentiality, integrity, and availability of the service.
Mitigation Recommendations
Upgrade to version 9.1.0 or later where this vulnerability has been patched. No other mitigation or temporary fix is indicated.
CVE-2026-53964: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine in adfinis document-merge-service
Description
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.
CVSS v3.1
Score 7.2high
Affected software
adfinis
document-merge-service
pkg:github/adfinis/document-merge-serviceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The document-merge-service provides an API for managing and merging document templates. Versions before 9.1.0 contain a vulnerability in the handling of XLSX templates where the xltpl library uses a sandboxed Jinja environment that is improperly neutralized, leading to server-side template injection. This allows remote attackers to execute arbitrary code in the server context as the document-merge-server user (UID 901), potentially compromising the container. The issue is fixed in version 9.1.0.
Potential Impact
Successful exploitation results in remote code execution with the privileges of the document-merge-server user, granting significant control over the container hosting the service. This can lead to full compromise of the container environment, impacting confidentiality, integrity, and availability of the service.
Mitigation Recommendations
Upgrade to version 9.1.0 or later where this vulnerability has been patched. No other mitigation or temporary fix is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-11T15:50:01.282Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abebc2da43b0b3b89f67a36
Added to database: 10/01/2026, 20:01:49 UTC
Last enriched: 10/01/2026, 20:16:20 UTC
Last updated: 10/01/2026, 20:31:37 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.