Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Base Incomplete

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

More detail

In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error.

Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

  2. Implementation

    Use the template engine's sandbox or restricted mode, if available.

Source: MITRE CWE-1336

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-96392

    AI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code Injection. This issue affects AI CKEditor versions: from 0.0.0 to 1.4.3.

    Drupal AI CKEditor drupal/ai_ckeditor Packagist
  • Low 3.5
    CVE-2026-52796

    Gogs: DoS in rendering issue index pattern

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of service. In internal/markup/markup.go, RenderIssueIndexPattern renders the issue index pattern to a…

    Gogs Gogs gogs.io/gogs Go
  • Low 3.0
    CVE-2026-44916

    In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered wi…

    OpenStack Ironic ironic ironic Debian Ubuntu
  • Low 2.3
    CVE-2025-23376

    Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Spec…

    Dell PowerProtect Data Manager Reporting
  • Low 3.3
    CVE-2025-3841

    wix-incubator jam Jinja2 Template jam.py special elements used in a template engine

    A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown part of the file jam.py of the component Jinja2 Template Handler. The manipulation of the argument con…

    wix-incubator jam
  • Low 3.5
    CVE-2025-26865 Public exploit

    Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

    Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.   It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which …

    Apache Software Foundation Apache OFBiz