VYPR
Get started
← All advisories
High severity7.2NVD Advisory· Published Jun 11, 2024· Updated Apr 15, 2026

CVE-2024-37301

CVE-2024-37301

Description

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
document-merge-servicePyPI
< 6.5.26.5.2

Patches

1
a1edd39d33d1

fix: use a sandboxed environment (#763)

https://github.com/adfinis/document-merge-serviceArthur DJun 12, 2024via ghsa
commit
1 file changed · +3 −2
  • document_merge_service/api/jinja.py+3 −2 modified
    @@ -6,7 +6,8 @@
 from django.utils.translation import to_locale
 from docx.shared import Mm
 from docxtpl import InlineImage, Listing
-from jinja2 import Environment, pass_context
+from jinja2 import pass_context
+from jinja2.sandbox import SandboxedEnvironment
 from rest_framework.exceptions import ValidationError
 
 
@@ -98,6 +99,6 @@ def get_jinja_filters():
 
 
 def get_jinja_env():
-    jinja_env = Environment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)
+    jinja_env = SandboxedEnvironment(extensions=settings.DOCXTEMPLATE_JINJA_EXTENSIONS)
     jinja_env.filters.update(get_jinja_filters())
     return jinja_env

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.