Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Base Incomplete

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

More detail

In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error.

Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

  2. Implementation

    Use the template engine's sandbox or restricted mode, if available.

Source: MITRE CWE-1336

All Critical High Medium Low Exploited only Public exploit

51 results · Clear filters · Feed

  • Critical 10.0
    CVE-2025-23211 Public exploit Scanner template

    Tandoor Recipes - SSTI - Remote Code Execution

    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is …

    Tandoor Recipes recipes
  • Critical 9.9
    CVE-2024-12583 Public exploit

    Dynamics 365 Integration <= 1.3.23 - Authenticated (Contributor+) Remote Code Execution and Arbitrary File Read via Twig Server-Side Template Injection

    The Dynamics 365 Integration plugin for WordPress is vulnerable to Remote Code Execution and Arbitrary File Read in all versions up to, and including, 1.3.23 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on …

    alexacrm Dynamics 365 Integration Web / CMS
  • Critical 9.9
    CVE-2024-6386 Public exploit EPSS 26%

    WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection

    The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render function. This makes it possible …

    WPML WPML Web / CMS
  • Critical 9.8
    CVE-2024-23692 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Rejetto HTTP File Server 2.3m Unauthenticated RCE

    Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted H…

    rejetto HTTP File Server
    KEV Jul 9, 2024
  • Critical 10.0
    CVE-2024-32651 Public exploit Scanner template EPSS 85%

    Server Side Template Injection in Jinja2 allows Remote Command Execution

    changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run an…

    dgtlmoon changedetection.io changedetection-io PyPI
  • Critical 9.8
    CVE-2024-4040 Exploited Public exploit Scanner template EPSS 100%

    Unauthenticated arbitrary file read and remote code execution in CrushFTP

    A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administra…

    CrushFTP CrushFTP
    KEV Apr 24, 2024
  • Critical 9.8
    CVE-2024-24724 Public exploit EPSS 26%

    Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to R…

  • High 8.8
    CVE-2024-28116 Public exploit

    Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

    Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the re…

    getgrav grav getgrav/grav Packagist
  • Unscored —
    CVE-2022-25813 Public exploit EPSS 67%

    Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz

    In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in t…

    Apache Software Foundation Apache OFBiz
  • Critical 9.1
    CVE-2022-0944 Public exploit

    Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad

    Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.

    sqlpad sqlpad/sqlpad
  • Critical 9.8
    CVE-2021-46703 Public exploit

    Code injection in RazorEngine

    In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that…

    RazorEngine NuGet