Weakness (CWE)
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
More detail
In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error.
Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.
How to prevent it (2 mitigations)
-
Architecture and Design
Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
-
Implementation
Use the template engine's sandbox or restricted mode, if available.
Source: MITRE CWE-1336
320 results · Feed
-
High 7.5
Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote code executions. Ce…
-
High 8.6
Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builde…
-
High 7.2
StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /ship…
-
High 7.2
document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, …
-
Critical 9.8
Rejetto HTTP File Server 2.3m Unauthenticated RCE
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted H…
KEV Jul 9, 2024 -
High 8.8
Unlimited Elements for Elementor <= 1.5.89 - Authenticated(Contributor+) Remote Code Execution via template import
The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.89 via the template import functionality. This makes it possible for authenticated att…
-
Critical 9.8
Shopware Remote Code Execution Vulnerability
Under certain circumstances it is possible to execute an authorized foreign code in Shopware version prior to 5.2.25.
-
High 7.1
Wiki.js Stored XSS through Client Side Template Injection
Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. Th…
-
Medium 4.4
verbb/formie Server-Side Template Injection for variable-enabled settings
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that support Twig. These might be the Submission Title or the Success Message. This code will then be executed …
-
High 7.5
Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execu…
-
Critical 10.0
Server Side Template Injection in Jinja2 allows Remote Command Execution
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run an…
-
Medium 6.8
iris-web vulnerable to Server Side Template Injection in reports
Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in `iris-web` is prone to a Server Side Template Injection (SSTI). Succ…
-
Critical 9.8
Unauthenticated arbitrary file read and remote code execution in CrushFTP
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administra…
KEV Apr 24, 2024 -
Medium 6.3
A improper neutralization of special elements used in a template engine [CWE-1336] in FortiManager versions 7.4.1 and b…
-
Critical 9.8
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to R…
-
High 8.8CVE-2024-28116 Public exploit
Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the re…
-
Medium 5.9
CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). The vulnerability exists within …
-
Medium 5.7
Potential Information Leak in User-Constructed Message Templates in nonebot2
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak (e.g., environment variables) in instances where developers utilize `MessageTemplate` and incorporate user-pr…
-
High 7.1
Ansible: template injection
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection …
-
Critical 10.0
Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
-
High 7.2
Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specia…
-
Medium 6.2
Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint
OctoPrint is a web interface for 3D printers. OctoPrint versions up until and including 1.9.2 contain a vulnerability that allows malicious admins to configure a specially crafted GCODE script that will allow code execution during rendering of that script. An…
-
Critical 9.1
Admin-to-admin stored XSS via cache poisoning
Adobe Commerce versions 2.4.6 (and earlier), 2.4.5-p2 (and earlier) and 2.4.4-p3 (and earlier) are affected by a Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could lead to arbitrary code execution by an admin-privil…
-
High 8.8
Grav Server-side Template Injection (SSTI) via Twig Default Filters
Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Co…
-
High 8.8
Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass
Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple…
-
High 8.8
Grav Server-side Template Injection via Insufficient Validation in filterFilter
Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a st…
-
Critical 9.1
Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
-
High 8.8
Improper Control of Generation of Code in Twig Rendered Views in Shopware
Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting both shopware/core and shopware/platform GitHub repositories, allows remote attackers with access to a Twig environment without the Sandbox extension t…
-
High 7.2
A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 throu…
-
Medium 5.5
NYUCCL psiTurk experiment.py special elements used in a template engine
A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used…
-
Medium 5.0
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
-
Unscored —
Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. Then a party manager needs to list the communications in t…
-
Medium 4.8
On F5 Traffix SDC 5.2.x versions prior to 5.2.2 and 5.1.x versions prior to 5.1.35, a stored Cross-Site Template Inject…
-
Critical 9.1CVE-2022-0944 Public exploit
Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.
-
High 7.1
Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
-
Critical 9.8CVE-2021-46703 Public exploit
Code injection in RazorEngine
In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that…
-
Medium 5.3
Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
-
Critical 9.8CVE-2022-22930 EPSS 24%
RCE in Mingsoft MCMS
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload.
-
High 7.2
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attacker…
-
High 7.2
Craft CMS Vulnerable to Server-Side Template Injection
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Se…