Server-side template injection (SSTI) happens when user input is inserted into a server-side template (such as Jinja2, Twig, Freemarker or Velocity) and the template engine evaluates it.

SSTI is serious because template engines are powerful: an injection often leads to remote code execution on the server.

How it happens

A developer builds a template string from user input, for example to personalise an email or a page title, instead of passing the input as data. An attacker submits template syntax such as {{7*7}}. If the response shows 49, the engine is evaluating their input, and more dangerous expressions can follow.

Why it matters

• Remote code execution on the application server.
• Reading configuration files and secrets.
• A foothold for moving deeper into your infrastructure.

How to prevent it

• Never build templates from user input; pass input as template variables.
• Use logic-less templates or sandboxed modes where your engine supports them.
• Keep template engines updated.
• Run the application with minimal operating-system privileges.

How Vooki Pro helps

• Tests for server-side template injection alongside expression language (EL), XSLT and server-side JavaScript injection.
• Detects outdated frameworks and template engines through version fingerprinting, and expands them into known CVEs.
• Rates findings with CVSS and gives step-by-step reproduction and remediation.
• Groups related findings so a single root cause is not reported dozens of times.

Frequently asked questions

Why is SSTI dangerous?

Template engines can access objects and functions on the server, so an injection often leads to remote code execution, not just data exposure.

How do I prevent SSTI?

Never build templates from user input. Pass user data as template variables, and use sandboxed or logic-less templates where possible.

Related: NoSQL injection: risks for MongoDB and other document databases · Server-side request forgery (SSRF) and cloud metadata attacks