What is the CVSS score of CVE-2026-0685?

CVE-2026-0685 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Genshi are affected by CVE-2026-0685?

Edgewall's Genshi template engine (versions 0.7.9 and earlier) contains a critical server-side template injection vulnerability enabling remote code execution on vulnerable systems.

How to fix or mitigate CVE-2026-0685?

Within 24 hours: Scan all systems and applications to identify Genshi usage and document affected versions (0 through 0.7.9), locations, and operational criticality. Create a complete inventory with version numbers and deployment contexts. Within 7 days: Implement strict input validation and encoding for all user-supplied template data, deploy Web Application Firewall rules to detect and block server-side template injection patterns, and restrict template processing to trusted data sources only. Within 30 days: Evaluate feasibility of removing Genshi from critical systems or migrating to alternative template engines (e.g., Jinja2, Mako); implement network segmentation to isolate Genshi-dependent systems; establish monitoring for patch availability from Edgewall project.

Genshi CVE-2026-0685

EUVD-2026-39792 CRITICAL

2026-06-26 certcc

GHSA-4r2j-8c42-5wfc

RCE Red Hat Suse Genshi

9.8

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

SSTI yields code execution with full C/I/A loss; AV:N/PR:N/UI:N assumes an unauthenticated input path reaches the evaluator, which is application-dependent but consistent with the reported vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

9.8 CRITICAL

qualitative

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 18:23 vuln.today

CVSS changed

Jun 26, 2026 - 18:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 26, 2026 - 15:45 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code execution (RCE) via crafted template expressions.

AnalysisAI

Server-side template injection in Edgewall's Genshi template engine (versions 0 through 0.7.9) lets a remote attacker reach the expression-evaluation component and run arbitrary Python code on the host. Because Genshi evaluates template expressions as Python, any application that feeds attacker-controlled input into a Genshi expression can be driven to full remote code execution. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list; EPSS data was not provided.

Technical ContextAI

Genshi is a Python toolkit for stream-based XML/HTML generation and templating, historically associated with the Trac project and other Edgewall software. Its template language embeds Python-style expressions (e.g. ${...}) that the expression-evaluation component compiles and executes against a runtime context. The vulnerability is a classic server-side template injection (SSTI): the CWE was not assigned (N/A) but the root cause class corresponds to code/expression injection (CWE-94 / CWE-1336), where untrusted data crosses into the expression evaluator and is treated as executable code rather than inert data. The CPE 'cpe:2.3:a:edgewall_*genshi*:genshi:*' confirms the affected product is Edgewall Genshi across all versions up to and including 0.7.9.

RemediationAI

No vendor-released patch identified at time of analysis - the provided references point only to the Genshi GitHub repository (https://github.com/edgewall/genshi/) and the CERT/CC advisory (https://www.kb.cert.org/vuls/id/244846), with no tagged fixed release named, so monitor those for an upstream patch and upgrade to it once published. Until then, the most effective compensating control is to ensure no untrusted or user-supplied data is ever placed into Genshi template expressions or used to construct templates dynamically - treat templates as trusted code, not data, accepting the trade-off that any feature relying on user-authored templates must be disabled. Where feasible, sandbox or restrict the Genshi evaluation context and run the rendering process under a least-privilege account with reduced filesystem/network access to limit blast radius if injection occurs; this constrains an attacker but does not close the SSTI itself.

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Module for Package Hub 15 SP7	Not-Affected
SUSE Linux Enterprise Server 16.0	Not-Affected
SUSE Linux Enterprise Server 16.1	Not-Affected
SUSE Linux Enterprise Server for SAP applications 16.0	Not-Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Not-Affected

CVE-2026-0685 vulnerability details – vuln.today

Back

openSUSE Leap 16.0	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Not-Affected
SUSE Linux Enterprise Server 15 SP4-LTSS	Not-Affected
SUSE Linux Enterprise Server 15 SP5-LTSS	Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP4	Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP5	Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6	Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Not-Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Not-Affected
openSUSE Leap 15.3	Not-Affected
openSUSE Leap 15.4	Not-Affected
openSUSE Leap 15.5	Not-Affected
openSUSE Leap 15.6	Not-Affected

Genshi CVE-2026-0685

Severity by source

CVSS VectorVendor: certcc

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique RCE

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code