CWE-1336: Server-Side Template Injection / SSTI
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Also known as Improper Neutralization of Special Elements Used in a Template Engine, Client-Side Template Injection / CSTI.
A kind of CWE-94 Improper Control of Generation of Code.
From the CWE List. © The MITRE Corporation.
Newest
- arma digital media inc. website templateCSTI in Arma Digital's Website Template4.3 Medium
- forgejoForgejo before 16.0.4 allows remote code execution via a crafted template repository because...9.9 Critical
- rapid7 velociraptorVelociraptor VQL injection during notebook restore from backup7.7 High
- tanium complyTanium addressed an unauthorized code execution vulnerability in Comply.7.2 High
- hashgraph guardian, nozomi networks cmc, siemens ruggedcom ape1808 +2 moreInsufficient sanitization of Dashboards in Guardian/CMC before 26.3.05.1 Medium
- adobe commerce, commerce b2b, commerce and magento +3 more +5 moreAdobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)10.0 Critical
- twigphp twigTwig: Sandbox method allowlist bypass via `Markup` subclass8.7 High
- amazon awslabs.dynamodb-mcp-serverCode injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server7.1 High
- ibm security verify access, verify identity access, security verify access container +1 more +3 moreSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access7.5 High
- fleetdm fleet, suse rancher fleet +1 moreFleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing5.3 Medium
- eclipse foundation dittoIn Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }…7.6 High
- quarkus quarkus-qute, red hat build of apache camel 3.33.3.sp1, build of apache camel 4 for quarkus 3 +3 more +5 moreIo.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine8.8 High
- skyvernSkyvern before 1.0.45 Sandbox Escape via TextPromptBlock8.7 High
- yamcsYamcs: Remote Code Execution via instance-template argument YAML injection (createInstance)9.8 Critical
- flextypeFlextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint7.1 High
- silverstripe silverstripe-advancedworkflowSilverstripe Advanced Workflow: Remote code execution via advanced workflow email template7.2 High
- triliumnext triliumTrilium: RCE via `shareTemplate` relation missing `isDangerous` flag — Safe import bypass leading to EJS SSTI (Incomplete Fix of CVE-2026-45668)8.6 High
litellmPyPILiteLLM vulnerable to server-side template injection in the /prompts/test endpoint9.8 Critical- oscal-compass compliance-trestleTrestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)7.8 High
mcp-contextforge-gatewayPyPImcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 EnvironmentNo score- typo3 extension "event management and registration"Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)7.7 High
- typo3 extension "powermail"Server-Side Template Injection in extension "powermail" (powermail)9.5 Critical
- getgrav gravGrav before 4.2.2 Remote Code Execution via Email Twig8.7 High
- dromara ujcmsDromara UJCMS web-file-template Endpoint WebFileTemplateController.java update special elements in template engine5.1 Medium
- phalcon cphalconPhalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)9.2 Critical
- adfinis document-merge-serviceDocument Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)7.2 High
- orval-labs orvalOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via enum-typed default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via array-items default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header-parameter default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: Import-time RCE via query-parameter default -> zod module-level template literal9.3 Critical
- orval-labs orvalOrval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)9.3 Critical
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.14 - Remote Code Execution (RCE) vulnerability9.8 Critical
- xianrendzw easyreportxianrendzw EasyReport SQL Preview Endpoint DesignerController.java previewSqlText special elements in template engine5.3 Medium
- gbif integrated publishing toolkitServer-side template injection in Integrated Publishing Toolkit7.6 High
- getgrav gravgrav-plugin-api before 1.0.15 Twig SSTI via translate endpoint8.6 High
- jumpserverJumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment6.7 Medium
- frappe erpnextERPNext: Server-Side Template Injection leading to Remote Code Execution9.9 Critical
- No product listedOpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine5.3 Medium
- getgrav gravGrav CMS before 2.0.13 Remote Code Execution via Twig8.7 High
- No product listedForm::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_e…9.1 Critical
libhtml-formhandler-perlDebian,perl-HTML-FormHandlerMageia +1 moreHTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data…9.1 Critical- siyuan-note siyuanSiYuan before v3.7.4 SQL Injection via queryBlocks template8.8 High
- owen2345 camaleoncmsCamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action7.5 High
- frappe erpnextERPNext: Possibility of server-side template injection due to missing validation9.9 Critical
- cachethq cachetCachet 2.4.1 Authenticated Server-Side Template Injection RCE8.7 High
- misp cti-transmuteUnauthenticated Stored Vue Template Injection Leads to Cross-Site Scripting in CTI-Transmute5.1 Medium
- wgdashboardWGDashboard Server-Side Template Injection vulnerability9.8 Critical
- unknown datapress (dataverse integration)Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure6.8 Medium
- Show moreLoading…