Vendor
The Adfinis document-merge-service is vulnerable to RCE via server-side template injection (SSTI) in XLSX templates due to an improperly sandboxed Jinja2 environment.