Feedly Server-Side Template Injection Vulnerability in DataGerry
Article Content
- •CVE-2026-57853 affects DataGerry versions before 3.3.0.
- •Authenticated attackers can exploit this vulnerability to execute arbitrary OS commands.
- •A patch is available; immediate upgrade is recommended.
A severe server-side template injection vulnerability, CVE-2026-57853, has been identified in DataGerry versions prior to 3.3.0. This flaw allows authenticated attackers with 'base.docapi.template.add' permission to inject arbitrary Jinja2 payloads into the 'template_data' field via a POST request. When rendered through a GET request, the payload executes in a non-sandboxed environment, enabling attackers to run arbitrary OS commands as the DataGerry web process user, typically root in Docker deployments. The vulnerability was published on November 4, 2026, and has a CVSS score of 8.8, indicating a high severity. A patch has been released, and users are urged to upgrade to version 3.3.0 or later. There are currently no reports of public exploitation or proof-of-concept code. Security teams are advised to restrict permissions and monitor for suspicious activity.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (5)
Following this threat?
Track DataGerry and CVE-2026-57853 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which versions are affected?
Is there a patch available?
What actions should we take now?
Continue Reading
Critical RCE Vulnerability in Prefab UI Disclosed A critical remote code execution vulnerability, CVE-2026-120338, was disclosed on November 1, 2026, affecting Prefab UI's Generative UI sandbox. The flaw allows attackers to execute arbitrary Python code by exploiting Deno's permissions, enabling file read/write access on the host server. This vulnerability affects… 
Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…