Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Base Incomplete

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

More detail

In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error.

Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

  2. Implementation

    Use the template engine's sandbox or restricted mode, if available.

Source: MITRE CWE-1336

All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.2
    CVE-2026-78164 Public exploit

    Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers

    Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. This issue affects Apache Camel: from 4.0…

    Apache Software Foundation Apache Camel
  • High 8.8
    CVE-2026-104851 Public exploit

    fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution

    fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unrestricted jinja2.Templa…

    fsspec filesystem_spec fsspec fsspec Debian Ubuntu PyPI
  • High 8.8
    CVE-2026-92592 Public exploit

    Craft CMS before 4.18.6 Remote Code Execution via signed cookie

    Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose (Yii…

    craftcms cms
  • High 8.7
    CVE-2026-55794 Public exploit

    Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

    Craft CMS is a content management system (CMS). In versions 5.9.0 and above prior to 5.10.0, control panel users with the ability to edit entries can execute unsandboxed Twig code via the HTTP Referrer header, potentially leading to authenticated RCE. The iss…

    craftcms cms craftcms/cms Packagist
  • High 8.6
    CVE-2026-42203 Public exploit

    LiteLLM: Server-Side Template Injection in /prompts/test endpoint

    LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted templat…

    BerriAI litellm litellm PyPI
  • High 8.7
    CVE-2026-34724 Public exploit

    Zammad has a server-side template injection leading to RCE via AI Agent

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrich…

    zammad zammad
  • High 8.7
    CVE-2026-28797 Public exploit

    RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component

    RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Template Injection (SSTI) vulnerability exists in RAGFlow's Agent workflow Text Processing (StringTransform) and Message components. These compo…

    InfiniFlow RAGFlow
  • High 7.5
    CVE-2026-33154 Public exploit

    dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver

    dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation in the @Jinja resolver. When the jinja2 package is installed, Dynaconf evaluates…

    dynaconf dynaconf dynaconf python-dynaconf Debian Ubuntu PyPI
  • High 7.5
    CVE-2026-28695 Public exploit

    Craft affected by authenticated RCE via Twig SSTI - create() function + Symfony Process gadget

    Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig function exposes Craft::cre…

    craftcms cms craftcms/cms Packagist
  • High 7.8
    CVE-2026-25731 Public exploit

    Calibre Affected by Arbitrary Code Execution via Server-Side Template Injection in Calibre HTML Export

    calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template file via the --template…

    kovidgoyal calibre calibre calibre Debian Ubuntu
  • High 8.8
    CVE-2025-69516 Public exploit

    A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactic…

  • High 8.7
    CVE-2025-66294 Public exploit

    Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditio…

    getgrav grav getgrav/grav Packagist
  • High 7.2
    CVE-2025-62369 Public exploit

    Xibo CMS: Remote Code Execution through module templates

    Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "…

    xibosignage xibo-cms
  • High 8.5
    CVE-2025-49619 Public exploit EPSS 22%

    Skyvern has a Jinja runtime leak

    Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that …

    Skyvern Skyvern skyvern PyPI
  • High 7.3
    CVE-2025-46731 Public exploit

    Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI

    Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access and `ALLOW_ADMIN_CH…

    craftcms cms craftcms/cms Packagist
  • High 8.8
    CVE-2024-28116 Public exploit

    Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

    Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the re…

    getgrav grav getgrav/grav Packagist