CVE-2024-37301 json
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
published 2y ago modified 4mo ago also GHSA-v5gf-r78h-55q6 , PYSEC-2026-1314 , EUVD-2024-2170
- cvss
- 7.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed.
Patch / fix
Is CVE-2024-37301 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2y ago
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | document-merge-service | <6.5.2 |
6.5.2 |
Affected products
- adfinis document-merge-service
- adfinis document_merge_service
Classification
- Weakness
-
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
References
-
github.com
/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074
web
-
github.com
/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-37301
advisory
-
github.com
/adfinis/document-merge-service
package
-
pypi.org
/project/document-merge-service
package
-
github.com
/advisories/GHSA-v5gf-r78h-55q6
advisory
Sources
- CVE List CVE-2024-37301
- GitHub Advisory GHSA-v5gf-r78h-55q6
- NVD CVE-2024-37301
- OSV PYSEC-2026-1314
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.