CVE-2026-0685: Genshi Template Engine SSTI RCE Vulnerability

CVE-2026-0685 Overview

CVE-2026-0685 is a server-side template injection (SSTI) vulnerability in the expression evaluation component of the Genshi Template Engine version 0.7.9. Remote attackers can achieve remote code execution (RCE) by supplying crafted template expressions to affected applications. The flaw requires no authentication and no user interaction, and it can be triggered over the network. Applications that render user-influenced input through Genshi templates are directly exposed.

Critical Impact
Unauthenticated attackers can execute arbitrary code on servers that evaluate attacker-controlled Genshi template expressions, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Genshi Template Engine version 0.7.9
Python applications embedding Genshi for server-side template rendering
Web frameworks and tooling that pass untrusted input into Genshi expression contexts

Discovery Timeline

2026-06-26 - CVE-2026-0685 published to the National Vulnerability Database (NVD)
2026-06-26 - Last updated in the NVD database

Technical Details for CVE-2026-0685

Vulnerability Analysis

Genshi is a Python-based templating library used to generate XML, HTML, and other text output. Templates support embedded expressions that are evaluated against a runtime context. In version 0.7.9, the expression evaluation component does not adequately restrict the Python constructs reachable from template expressions. When an application incorporates untrusted input into a Genshi template or into an evaluated expression, an attacker can escape the intended template sandbox and reach arbitrary Python objects. From there, the attacker can traverse object attributes to reach subprocess or import primitives and execute code with the privileges of the rendering process.

Root Cause

The vulnerability stems from unsafe evaluation of template expressions in the Genshi expression parser and evaluator. The evaluator exposes Python object introspection paths that were not intended to be reachable from template context. Because expressions are compiled and executed as Python code against a permissive namespace, attacker-controlled expressions can access built-ins and object graphs sufficient to invoke system commands. This class of flaw maps to server-side template injection leading to remote code execution.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker submits a crafted template expression through any input channel that reaches Genshi's expression evaluator, such as user-controlled template fragments, dynamically constructed templates, or fields rendered inside expression contexts. On evaluation, the crafted expression triggers Python object traversal to reach code execution primitives. Successful exploitation grants command execution in the context of the Genshi-hosting process, enabling data theft, lateral movement, and persistence. Additional technical context is available in the CERT Vulnerability Report #244846 and the Genshi project repository.

Detection Methods for CVE-2026-0685

Indicators of Compromise

Template expressions or HTTP parameters containing Python dunder traversal patterns such as __class__, __mro__, __subclasses__, or __globals__.
Unexpected child processes spawned by the Python interpreter hosting the Genshi application (for example, sh, bash, cmd.exe, or powershell.exe).
Outbound network connections from the application process to unfamiliar hosts shortly after template rendering.
Web server access logs showing long, URL-encoded payloads targeting endpoints that render templates.

Detection Strategies

Inspect application logs and web application firewall (WAF) telemetry for SSTI patterns and Python introspection tokens in request bodies and query strings.
Baseline the process tree of Python workers hosting Genshi and alert on deviations, especially shell or interpreter children.
Perform static analysis of application code for locations where untrusted input flows into Template, TextTemplate, MarkupTemplate, or expression evaluation APIs.

Monitoring Recommendations

Enable verbose request logging on endpoints that render Genshi templates and forward logs to a central analytics platform.
Monitor for outbound egress from application servers to non-approved destinations, particularly on ports commonly used for reverse shells.
Track file system writes by the application process to directories outside its expected working set.

How to Mitigate CVE-2026-0685

Immediate Actions Required

Inventory all applications and services that bundle Genshi and confirm whether version 0.7.9 is present.
Remove or block user-controllable input from being embedded in Genshi template expressions until a fix is applied.
Place a WAF rule in front of exposed endpoints to reject requests containing Python introspection tokens and long expression payloads.

Patch Information

No fixed version has been listed in the NVD entry for CVE-2026-0685 at the time of publication. Monitor the Genshi project repository and the CERT Vulnerability Report #244846 for updated releases, patches, and vendor guidance. Apply the vendor-provided fix as soon as it is available and rebuild all downstream artifacts that embed Genshi.

Workarounds

Refactor application code to render only static, developer-authored templates and pass untrusted input strictly as data variables, never as template source or expression fragments.
Enforce strict allow-list input validation on any field that reaches template rendering, rejecting characters used in Python attribute traversal such as ., _, {, and } where feasible.
Run the Genshi-hosting process under a least-privilege service account with restricted file system and network egress to limit the blast radius of a successful exploit.
Isolate template rendering in a sandboxed process or container with seccomp or AppArmor profiles that block execve of shells and interpreters.

bash

# Configuration example: identify installations of the affected version
pip show genshi | grep -i version
pip list --format=freeze | grep -i "^Genshi==0.7.9"

# Example WAF-style rule (pseudo-config) to block common SSTI probes
# reject requests whose body or query matches Python introspection tokens
block_if request.body ~* "(__class__|__mro__|__subclasses__|__globals__|__import__)"
block_if request.query ~* "(__class__|__mro__|__subclasses__|__globals__|__import__)"