Tested fixes for CWE-1336 in Express, Flask, Spring Boot and ASP.NET Core: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.
MITRE’s description of CWE-1336: The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Common consequences MITRE lists
- Integrity: Execute Unauthorized Code or Commands
Most server-side template engines can reach the host language’s objects, so template text from a user usually means code execution on the server.
- Render templates that live in the codebase and pass input only as variables.
- Where users author templates, use a logic-less engine or the engine’s sandbox with an allowlist policy, keep it patched, and render in an isolated worker without secrets.
- Test with a harmless probe such as
{{ 7 * 7 }}and assert it comes back as text.
Guides on this site
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Prevent DOM XSS, postMessage abuse and client-side injection
Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.
Practice
- SQL injection lab: Separate SQL structure from data with sqlite3 · Browser lab
- OS command injection lab: Run git without a shell · Browser lab
- SSTI lab: Render a welcome banner without template injection · Browser lab
- XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
- Pickle deserialization lab: Load a session token without pickle · Browser lab
- Parse bounded JSON and XML invoices safely · Local project
- Repair a native parser using sanitizer evidence · Local project
References
- CWE-1336 in the MITRE CWE list (version 4.20)
- OWASP Server-Side Template Injection Prevention Cheat Sheet
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.