CVE-2026-53964 Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
Remote attackers can execute arbitrary code via server-side template injection in XLSX templates, compromising the server container.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53964?
CVE-2026-53964 is a high-severity code injection vulnerability in adfinis document-merge-service, published on 1 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. This issue has been patched in version 9.1.0.
Weakness: CWE-1336
Which versions are affected by CVE-2026-53964?
3 open source packages ship an affected version, including document-merge-service.
| Package | Affected | Fixed in |
|---|---|---|
document-merge-service PyPI | All versions | 9.1.0 |
document-merge-service PyPI | All versions | 9.1.0 |
document-merge-service PyPI | All versions | 9.1.0 |
How do I fix CVE-2026-53964?
Upgrade document-merge-service to 9.1.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-53964 being exploited?
There is no known exploitation of CVE-2026-53964 in the wild and no public exploit code.
Sources
Also known as GHSA-w47q-945m-q9pc, PYSEC-2026-3830.