CVE-2026-0685: Genshi Template Engine SSTI Leading to Remote Code Execution
CVE-2026-0685 is a server side template injection flaw in the expression evaluation component of Genshi Template Engine 0.7.9. According to the record, crafted template expressions allow a remote attacker to achieve remote code execution. The record carries a CVSS 3.1 base score of 9.8 (Critical) but lists no affected version ranges or fixed versions, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-0685 describes a server side template injection (SSTI) weakness in the expression evaluation component of Genshi Template Engine version 0.7.9. The CNA record states that a remote attacker can achieve remote code execution through crafted template expressions. The record was published on 2026-06-26 and its status is Awaiting Analysis.
Impact
- The record describes remote code execution, which would allow an attacker to run code on the affected host within the privileges of the rendering process.
- The CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network reachability, low attack complexity, no privileges or user interaction required, and high confidentiality, integrity and availability impact.
Affected products and versions
- Product named in the record: Genshi Template Engine, version 0.7.9.
- The record's affected list is empty, so other versions cannot be confirmed or excluded from the record alone.
- No fixed version is listed. The absence of a listed fix does not mean that no fix exists.
Exploitation status
The CISA KEV catalog does not list this CVE, so active exploitation is not confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS probability in the record is 0.00926 with a percentile of 0.59446, which is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- Inventory applications that use Genshi and confirm whether version 0.7.9 is in use.
- Check the project repository and the CERT/CC advisory for an updated release or vendor guidance, and apply it once it is verified.
- Until a fix is confirmed, do not render templates built from untrusted input, and keep template authoring separate from user-supplied data.
- Run services that use the template engine with least privilege to limit the impact of any code execution.
Detection guidance
- Review application logs for template rendering errors or unexpected expression content in user-controlled fields.
- Monitor services that render Genshi templates for unexpected child processes, file changes or outbound connections.
Limitations of the available information
The record has no CWE classification, no affected version ranges, no fixed versions and no vendor-confirmed details beyond the description. The CERT/CC and GitHub project references were listed, but their content was not reviewed for this analysis. Technical root cause details are not available in the record.
Frequently asked questions
What is CVE-2026-0685?
It is a server side template injection flaw in the expression evaluation component of Genshi Template Engine version 0.7.9, which the record says can lead to remote code execution through crafted template expressions.
Is CVE-2026-0685 known to be exploited in the wild?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
Which version is fixed?
The record does not list any fixed version. Check the project repository and the CERT/CC advisory for updated guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.