{
  "slug": "server-side-template-injection",
  "url": "https://library.infinity8labs.com/server-side-template-injection/",
  "title": "Server-side template injection (SSTI)",
  "short": "SSTI",
  "aliases": [
    "Template injection",
    "Server template injection",
    "Expression language injection"
  ],
  "summary": "SSTI occurs when untrusted input is interpreted as template source instead of ordinary data. It can expose application objects and secrets and, in many template engines, lead to server-side code execution.",
  "cwe": [
    "CWE-1336"
  ],
  "owasp": "A03:2021 Injection",
  "typical_severity": {
    "min": "high",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
      "url": "https://cwe.mitre.org/data/definitions/1336.html"
    },
    {
      "title": "OWASP Top 10 A03:2021 Injection",
      "url": "https://owasp.org/Top10/A03_2021-Injection/"
    },
    {
      "title": "PortSwigger Web Security Academy: Server-side template injection",
      "url": "https://portswigger.net/web-security/server-side-template-injection"
    },
    {
      "title": "Flask documentation: Templates",
      "url": "https://flask.palletsprojects.com/en/stable/tutorial/templates/"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/server-side-template-injection/#overview",
    "https://library.infinity8labs.com/server-side-template-injection/#impact",
    "https://library.infinity8labs.com/server-side-template-injection/#examples",
    "https://library.infinity8labs.com/server-side-template-injection/#remediation",
    "https://library.infinity8labs.com/server-side-template-injection/#testing",
    "https://library.infinity8labs.com/server-side-template-injection/#references"
  ]
}