Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Base Incomplete

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

More detail

In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error.

Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

  2. Implementation

    Use the template engine's sandbox or restricted mode, if available.

Source: MITRE CWE-1336

All Critical High Medium Low Exploited only Public exploit

93 results · Clear filters · Feed

  • Critical 9.1
    CVE-2024-45053

    Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

    Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template I…

    ethyca fides ethyca-fides PyPI
  • Critical 9.9
    CVE-2024-6386 Public exploit EPSS 26%

    WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

    The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible …

    WPML WPML Web / CMS
  • Critical 9.8
    CVE-2024-23692 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Rejetto HTTP File Server 2.3m Unauthenticated RCE

    Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted H…

    rejetto HTTP File Server
    KEV Jul 9, 2024
  • Critical 9.8
    GHSA-83jv-4prm-34g7

    Shopware Remote Code Execution Vulnerability

    Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.

    shopware/shopware Packagist
  • Critical 10.0
    CVE-2024-32651 Public exploit Scanner template EPSS 85%

    Server Side Template Injection in Jinja2 allows Remote Command Execution

    changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run an…

    dgtlmoon changedetection.io changedetection-io PyPI
  • Critical 9.8
    CVE-2024-4040 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated arbitrary file read and remote code execution in CrushFTP

    A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administra…

    CrushFTP CrushFTP
    KEV Apr 24, 2024
  • Critical 9.8
    CVE-2024-24724 Public exploit EPSS 26%

    Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to R…

  • Critical 10.0
    CVE-2023-6709

    Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

    Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.1
    CVE-2023-29297

    Admin-to-admin stored XSS via cache poisoning

    Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privil…

    Adobe Magento Commerce magento/community-edition magento/project-community-edition Web / CMS Packagist
  • Critical 9.1
    CVE-2023-2259

    Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io

    Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

    alfio-event alfio-event/alf.io
  • Critical 9.1
    CVE-2022-0944 Public exploit

    Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

    Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

    sqlpad sqlpad/sqlpad
  • Critical 9.8
    CVE-2021-46703 Public exploit

    Code injection in RazorEngine

    In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that…

    RazorEngine NuGet
  • Critical 9.8
    CVE-2022-22930 EPSS 24%

    RCE in Mingsoft MCMS

    A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.

    net.mingsoft:ms-mcms Maven