SSTI
Server-side template injection
User input becomes part of a template’s source instead of being passed to it as data, so the template engine evaluates it, which in engines such as Jinja2, Twig or FreeMarker often leads to remote code execution (CWE-1336). Render fixed templates and pass user input only as variables.
- Also called
- template injection
- Defined in
- MITRE CWE-1336
- Identifiers
- CWE-1336: Server-side template injection
Covered in
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Prevent DOM XSS, postMessage abuse and client-side injection
Trace attacker-controlled values from the URL, messages and storage to the browser APIs that parse HTML or run code, then close those sinks with safe APIs, a sanitizer, Trusted Types and strict message checks.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities