Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Server-side template injection vulnerability in DataGerry before 3.3.0 that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template. When a user calls GET /rest/docapi/template/ /render/ , the payload is rendered in a non-sandboxed Jinja2 environment, enabling attackers to exploit the cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user.
An authenticated attacker with base.docapi.template.add permission over the network can execute arbitrary operating system commands as the DataGerry web process user (confirmed as root in default Docker deployments).
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch available. Upgrade DataGerry to version 3.3.0 or later.
Immediately upgrade DataGerry to version 3.3.0 or later. Restrict the base.docapi.template.add permission to only trusted users. Apply principle of least privilege to limit the DataGerry web process permissions (avoid running as root). Monitor for suspicious template creation and rendering activity on POST /rest/docapi/template and GET /rest/docapi/template/*/render/* endpoints.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Feedly found the first article mentioning CVE-2026-57853 . See article
NVD published the first details for CVE-2026-57853
A CVSS base score of 8.8 has been assigned.
GitHub Advisories released a security advisory .
CVE-2026-57853 - Exploits & Severity - Feedly
Server-Side Template Injection in DataGerry Affects Docker Deployment
CVE-2026-57853 | DataGerry up to 3.2.x Template Rendering template_data code injection
Be the first to know critical vulnerabilities
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
