CWE-1336: Server-Side Template Injection / SSTI
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Also known as Improper Neutralization of Special Elements Used in a Template Engine, Client-Side Template Injection / CSTI.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- bolt coreBolt CMS Server-Side Template Injection via Unsandboxed allow_twig Field Rendering8.8 High
- miguelcobain ember-dynamic-render-templateember-dynamic-render-template Client-Side Template Injection via Unsanitized templateString6.1 Medium
- djangocrm django-crmDjangoCRM - Server-Side Template Injection in Mass Mail Message Rendering8.1 High
- adobe campaign classic, campaign +1 moreAdobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)10.0 Critical
- langgenius difylanggenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine5.3 Medium
- dynatrace-oss dynatrace-mcpDynatrace MCP Server: Workflow template injection via create_workflow_for_notification4.2 Medium
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped enum string values8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template8.3 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template8.3 High
- axway securetransportServer-Side Template Injection in SecureTransport's Apache Velocity mail templates9.4 Critical
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field8.8 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description7.8 High
- koxudaxi datamodel-code-generator`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field7.8 High
- jandedobbeleer oh-my-poshOh My Posh: Arbitrary command execution via template injection in the path segment7.8 High
- microsoft promptyPrompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer10.0 Critical
- quenary tugtainerTugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution9.9 Critical
- jetbrains hubMeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow7.5 High
- gitleaksGitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature8.1 High
- frappe erpnextERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefix8.8 High
- getgrav gravGrav before 2.0.1 XSS via Twig String Concatenation5.1 Medium
- yeswikiYesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates7.1 High
- verbb formieFormie: Server-Side Template Injection in Formie Hidden field defaults9.8 Critical
- craftcms cmsCraft CMS: Potential authenticated Remote Code Execution via referrer redirect8.7 High
- geonetwork core-geonetworkGeoNetwork: Reflected XSS through client-side template injection7.1 High
- fossbillingFOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE9.4 Critical
- gogsGogs: DoS in rendering issue index pattern3.5 Low
- jtl software shopJTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer9.3 Critical
- pimcore gmbh cms/dxpPimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed8.6 High
- tautulliTautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory8.9 High
- jupyter enterprise gatewayJupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution10.0 Critical
- simple sa wirtualna uczelniaServer-Side Template Injection (SSTI) in Wirtualna Uczelnia9.3 Critical
- apache airflowApache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern9.1 Critical
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in...4.5 Medium
- infiniflow ragflowRAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution9.9 Critical
mautic/corePackagistMautic has Server-Side Template Injection (SSTI) in Theme Templates9.9 Critical- oscal-compass compliance-trestlecompliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)7.8 High
- vowpalwabbit vowpal wabbitVowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner5.0 Medium
- dromara lamp-cloudDromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine5.3 Medium
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreAngular template injection in Reports in Guardian/CMC before 26.1.05.1 Medium
- apache ofbizApache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component6.5 Medium
- verbb formieFormie: Pre-authenticated server-side template injection in Hidden fields9.8 Critical
- sanluan publiccmsSanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engine5.3 Medium
- cubecart v6CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE9.1 Critical
- cubecart v6CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE9.1 Critical
- vmware spring aiPrompt Injection via Memory Poisoning in PromptChatMemoryAdvisor8.2 High
- microsoft local-path-provisioner, suse local path provisioner +1 moreLocal Path Provisioner: HelperPod Template Injection8.7 High
- masci banks, red hat exploit intelligence, openshift lightspeed +1 more +3 moreBanks: Critical Remote Code Execution (RCE) via Jinja2 SSTI7.5 High
- seppmail ag secure email gatewayServer-side template injection8.3 High
- openstack ironicIn OpenStack Ironic through 35.x, instance_info['ks_template'] is rendered without sandboxing.3.0 Low
- Show moreLoading…