high · 7.2CVE-2026-53964Aug 19, 2026

CVE-2026-53964: document-merge-service Remote Code Execution via SSTI in XLSX Templates

Rohit Hatagale
AI Security Researcher, SecureLayer7

An attacker who can upload an XLSX template can embed Jinja2 expressions that run arbitrary shell commands on the server, because the xltpl rendering engine uses an unsandboxed Jinja2 environment.

Packagedocument-merge-service
Ecosystempip
Affected< 9.1.0
Fixed in9.1.0
CVE-2026-53964: document-merge-service Remote Code Execution via SSTI in XLSX Templates

The problem

document-merge-service supports XLSX templates rendered by the xltpl library, which internally uses a plain (non-sandboxed) Jinja2 environment. Any user with template-upload access can place Jinja2 expressions directly into spreadsheet cells.

Because no sandbox is in place, those expressions can walk Python's MRO chain to reach the subprocess class and execute arbitrary OS commands. The process runs as UID 901 (the document-merge-server user), giving an attacker significant control over the container.

Proof of concept

A working proof-of-concept for CVE-2026-53964 in document-merge-service, with the exact payload below.

text
{% if data.__class__.__mro__[1].__subclasses__()[202] %}
whoami: {{ data.__class__.__mro__[1].__subclasses__()[202]("whoami", shell=True, stdout=-1).communicate()[0].strip() }}
uname -a: {{ data.__class__.__mro__[1].__subclasses__()[202]("uname -a", shell=True, stdout=-1).communicate()[0].strip() }}
{% endif %}

The Jinja2 Environment (used by xltpl for XLSX rendering) was not initialized as a SandboxedEnvironment, so template expressions have unrestricted access to Python object internals. Walking __class__.__mro__[1].__subclasses__() reaches subprocess.Popen (index may vary by runtime), and calling it with shell=True executes any OS command.

The prior advisory (CVE-2024-37301) applied the sandboxed-environment fix only to the docx rendering path. The XLSX path via xltpl was left on a standard Environment, reopening the same CWE-1336 root cause. The 9.1.0 patch applies SandboxedEnvironment (or equivalent attribute/method restrictions) to the xltpl code path as well.

Note: the subclass index (202 in the published PoC) is environment-dependent. Attackers enumerate it at runtime.

The fix

Upgrade document-merge-service to 9.1.0 or later. As a workaround, disable upload and use of XLSX templates entirely until the upgrade can be applied.

Reporter not attributed.

References: [1][2][3]

Related research