CVE-2026-53964: 
Python vulnerability analysis and mitigation

CVE-2026-53964 is a server-side template injection (SSTI) vulnerability in the document-merge-service Python package that enables remote code execution (RCE) by authenticated attackers. It affects all versions prior to 9.1.0 and is limited to XLSX template processing, where the xltpl library uses a non-sandboxed Jinja2 environment. The vulnerability was first published on June 11, 2026, and added to the GitHub Advisory Database on August 19, 2026. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The root cause is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). When processing XLSX templates, the xltpl library evaluates Jinja2 template expressions in a non-sandboxed environment, meaning user-supplied template content is executed without restriction in the server's Python runtime. An authenticated attacker with sufficient privileges to upload or submit XLSX templates can embed malicious Jinja2 expressions (e.g., {{ ''.__class__.__mro__[1].__subclasses__() }}) that are evaluated server-side, resulting in arbitrary code execution as the document-merge-server user (UID 901). The fix in v9.1.0 replaces the upstream xltpl library with a maintained fork that addresses the sandboxing issue (GitHub Advisory, v9.1.0 Release).

Successful exploitation grants an attacker arbitrary code execution within the container as the document-merge-server user (UID 901), providing considerable control over the container environment. This includes full confidentiality, integrity, and availability impact — an attacker can read sensitive files, modify data, or disrupt service operation. Depending on the container's configuration and network posture, this could serve as a foothold for lateral movement within the broader infrastructure (GitHub Advisory).

Exploitation requires the attacker to be authenticated with privileges sufficient to upload or use XLSX templates within the document-merge-service. No public exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry is currently available (GitHub Advisory).

1. Authenticate: Obtain valid credentials or a session token with privileges to upload or submit XLSX templates to the document-merge-service instance.
2. Craft malicious XLSX template: Create an XLSX file containing a Jinja2 SSTI payload embedded in a cell or template field, such as {{ ''.__class__.__mro__[1].__subclasses__()[<index>]('id', shell=True, stdout=-1).communicate()[0] }} or a reverse shell payload.
3. Upload the template: Submit the crafted XLSX file to the document-merge-service via its template upload endpoint.
4. Trigger template rendering: Initiate a document merge operation using the malicious XLSX template, causing the server to evaluate the embedded Jinja2 expressions in the non-sandboxed environment.
5. Achieve RCE: The payload executes as the document-merge-server user (UID 901) within the container, enabling command execution, data exfiltration, or establishment of a reverse shell for further access (GitHub Advisory, HackTricks Jinja2 SSTI).

• Logs: Unexpected errors or stack traces from the xltpl library during XLSX template processing; unusual output in application logs related to template rendering (e.g., Python introspection results or OS command output embedded in rendered documents).
• Process: Unusual child processes spawned by the document-merge-service process (e.g., /bin/sh, bash, curl, wget, python) with the UID 901.
• Network: Unexpected outbound connections from the document-merge-service container to external IP addresses, particularly on non-standard ports (indicative of reverse shell activity).
• File System: New or modified files in the container's filesystem created by UID 901 outside of expected application directories; presence of web shells, scripts, or downloaded binaries.

Upgrade document-merge-service to version 9.1.0 or later, which replaces the vulnerable xltpl dependency with a maintained fork that uses a sandboxed Jinja2 environment (v9.1.0 Release). As an immediate workaround for organizations unable to upgrade, disable the upload and usage of XLSX templates entirely within the service configuration (GitHub Advisory). Additionally, apply the principle of least privilege to restrict which users can upload templates, and consider network-level controls to limit outbound connections from the document-merge-service container.