CWE-1336: Server-Side Template Injection / SSTI
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Also known as Improper Neutralization of Special Elements Used in a Template Engine, Client-Side Template Injection / CSTI.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- lmfdb LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID> 9.3 Critical
- apache software foundation ofbiz Apache OFBiz: renderLink compiles link parameters as FreeMarker source 8.8 High
- apache software foundation ofbiz Apache OFBiz: Authenticated Code Execution Vulnerability 8.8 High
- eosphoros-ai db-gpt eosphoros-ai DB-GPT Jinja2 Template __init__.py FileBasedSkill.get_prompt special elements in template engine 5.3 Medium
- datagerry DataGerry < 3.3.0 SSTI via DocAPI Template Rendering 8.7 High
- quest foglight for databases Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability 7.2 High
- enspirit elo Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter 9.8 Critical
- enspirit elo Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels 9.8 Critical
- aws virtual-engineering-workbench Template injection in the publishing component of awslabs Virtual Engineering Workbench 9.4 Critical
- socfortress copilot SOCFortress CoPilot: Stored case-report template injection permits backend code execution 9.0 Critical
- elated-themes frappe Frappe Framework before 15.111.0 and 16.x before 16.21.0 Server-Side Template Injection via Message Fields 8.7 High
- bricks theme Bricks Theme Unauthenticated Dynamic Data Tag Injection via query_result 7.5 High
- supsysticcom smart popup by supsystic Smart Popup by Supsystic < 2.0.2 - Admin+ SSTI via Popup Text Block 4.9 Medium
- No product listed A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates (the fix for GHSA-9fx4-7cmj-47vg)… 8.8 High
- craftcms cms Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE 8.7 High
- intranda goobi-viewer-core Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS 9.3 Critical
- apache software foundation camel Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers 8.2 High
- msgbyte tianji Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates 9.1 Critical
- red hat migration toolkit for applications 8, migration toolkit for containers, migration toolkit for virtualization +12 more +14 more Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection 8.5 High
- webpros solusvm 2 A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote... 9.4 Critical
- micropyramid bottlecrm BottleCRM through 1.14.5 Server-Side Template Injection via Account Email create_mail 5.3 Medium
- adobe commerce, commerce b2b, magento open source +1 more +3 more Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) 10.0 Critical
- frappe erpnext Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields 8.7 High
- craftcms cms Craft CMS 5.10.2 before 5.10.14 Twig Sandbox Bypass RCE via has some/has every 8.7 High
- thelia CVE-2026-107248 8.8 High
- thelia CVE-2026-103537 5.4 Medium
- thelia CVE-2026-103528 5.4 Medium
- furion .net framework Furion .NET Framework View ViewEngine.cs RunCompile special elements in template engine 5.3 Medium
- wizarrrr wizarr Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE) 9.1 Critical
- drupal inline formatter field Inline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203 5.4 Medium
- drupal linked field Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200 5.4 Medium
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: Improper validation of MkDocs theme configuration in TechDocs 7.7 High
- dell container storage modules Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization... 9.6 Critical
- craftcms cms Authenticated RCE via render-components Entry Type overrides 8.7 High
- fsspec filesystem spec fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution 8.8 High
- gitlab ai gateway Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway 9.9 Critical
- formtools.org form tools formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine 5.3 Medium
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Remote Code Execution through Server-Side Template Injection 7.2 High
- naichen thinkcmf Naichen ThinkCMF Email Template MailController.php templatePut special elements in template engine 5.1 Medium
- zammad Zammad: AI Agent template sanitizer bypass leads to remote code execution 8.6 High
- rejetto hfs2 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection 10.0 Critical
- drupal ai ckeditor AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187 3.5 Low
- drupal webform Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175 9.1 Critical
- solspace craft-freeform Solspace Freeform: Limited Twig template injection via submitted field values 5.3 Medium
- zohocorp manageengine opmanager, manageengine netflow analyzer, manageengine network configuration manager +2 more Remote Code Execution Vulnerability 7.6 High
- openequella openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer 8.6 High
- craftcms cms Craft CMS before 4.18.6 Remote Code Execution via signed cookie 8.7 High
- backstage, linuxfoundation backstage plugin-techdocs-node +1 more Backstage: Improper input validation in TechDocs MkDocs configuration 8.8 High
- polyaxon Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine 8.7 High
- concrete cms cms, concretecms concrete cms +1 more Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values 5.9 Medium
- Show olderLoading…