CVE-2026-53964: High severity pip/document-merge-service vulnerability
Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template.
Patches It has been patched in v9.1.0
Workarounds Disable the upload/usage of XLSX templates.
References Are there any links users can visit to find out more?
https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/document-merge-serviceto a version that resolves this vulnerability.Fixed in 9.1.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.1.0 - Configuration
Disable the upload/usage of XLSX templates (xltpl library templates).
document-merge-service upload/usage of XLSX templates = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that process XLSX templates are affected, because XLSX template processing uses the non-sandboxed Jinja environment in the xltpl library. The issue does not describe exposure for other template types.
What does an attacker need to exploit it?
An attacker needs the ability to supply an XLSX template that will be processed by the service. Successful exploitation executes user-supplied code in the document-merge-server context as UID 901.
What should be done if upgrading is not immediately possible?
Disable the upload and use of XLSX templates until the service can be updated. The issue is patched in version 9.1.0.