CVE-2026-53964: Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)

August 19, 2026

A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server’s context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template.

References

github.com/adfinis/document-merge-service/releases/tag/v9.1.0
github.com/adfinis/document-merge-service/security/advisories/GHSA-w47q-945m-q9pc
github.com/advisories/GHSA-w47q-945m-q9pc
nvd.nist.gov/vuln/detail/CVE-2026-53964

Code Behaviors & Features

Detect and mitigate CVE-2026-53964 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →