Cybersecurity glossary
What is Server-Side Template Injection (SSTI)?
Learn what Server-Side Template Injection (SSTI) is, how user input in templates becomes remote code execution, which engines are affected, and how to prevent SSTI safely.
Definition
Server-Side Template Injection (SSTI) is a vulnerability that occurs when untrusted input is embedded into a server-side template and evaluated by the template engine, allowing attackers to inject template expressions that can lead to information disclosure or remote code execution.
Why SSTI is high impact
Template engines make dynamic pages and emails easy. They become dangerous when applications build template source from user input—subject lines, themes, PDF layouts, or “custom message” fields—rather than injecting data into a fixed template.
Server-Side Template Injection (SSTI) often starts as odd output and ends as shell access. For exploitation depth, see Splorix’s SSTI vulnerability guide. This glossary focuses on the concept and safe design.
How SSTI happens
Application builds a template string
User-controlled text is concatenated into template source instead of bound as data.
Engine parses expressions
Template syntax such as {{ }} or ${} is interpreted by the engine.
Attacker injects engine syntax
Payloads probe evaluation and then access dangerous objects or filters.
Server executes logic
Depending on the engine, this may read files, run commands, or call APIs.
Impact escalates
Successful SSTI commonly becomes remote code execution on the host.
Risky patterns vs safe patterns
| Pattern | Risk | Safer approach |
|---|---|---|
| Template = user string | Direct SSTI | Fixed template; user text as variables only |
| User chooses template file path | Template path traversal / unexpected templates | Allowlist template IDs |
| Render untrusted email HTML as template | Expression evaluation in messages | Treat as plain text or sanitized HTML, not templates |
| Sandbox enabled | Bypass risk remains | Sandbox plus never compile untrusted source |
Common engine families
Python (Jinja2 / Mako)
Expression evaluation and object access can lead to OS command execution if misused.
PHP (Twig / Smarty)
Powerful features and plugins expand the attack surface when templates are dynamic.
Java (FreeMarker / Velocity)
Enterprise engines with rich object models historically exploited for RCE.
Node / others
Server-side Handlebars, Pug, EJS, and similar need the same discipline.
- Never concatenate user input into template source strings.
- Pass untrusted data only as template variables with auto-escaping.
- Allowlist which templates can be selected; do not accept file paths from users.
- Disable dangerous extensions and strict sandbox only as defense in depth.
- Separate logic-heavy rendering from user-authored content workflows.
- Log and alert on template syntax errors that look like probe payloads.
- Include SSTI cases in secure code review for any dynamic templating feature.
- Treat confirmed SSTI as a critical RCE-class finding until proven otherwise.
The practical takeaway
SSTI turns template engines into code interpreters for attacker input. Keep templates under developer control and treat user content as data—never as template source.
If your product lets users customize layouts or messages, verify you are not compiling their text as templates.
Related security terms
Server-Side Template Injection vulnerability guide
Splorix deep dive on SSTI exploitation and remediation.
Remote Code Execution (RCE)
The common end state of successful SSTI.
Cross-Site Scripting (XSS)
Client-side injection contrast: SSTI runs on the server.
Deserialization Attack
Another pattern where untrusted data becomes executable logic.
Frequently asked questions
What is SSTI in simple terms?
SSTI happens when user input is treated as part of a template rather than plain text. Attackers inject expressions the template engine executes.
How is SSTI different from XSS?
XSS runs in the browser. SSTI runs on the server inside the template engine and can often reach system APIs or filesystem access.
Which template engines are commonly affected?
Any engine that evaluates expressions can be abused if misused—Jinja2, Twig, FreeMarker, Velocity, Smarty, Handlebars (server-side), and others.
Why is SSTI so dangerous?
Many engines expose powerful objects. Successful SSTI frequently escalates to remote code execution and full server compromise.
How do you prevent SSTI?
Never concatenate untrusted input into template source. Pass data as variables only, use sandboxing carefully, and prefer logic-less templates where possible.
Can sandbox modes fully protect against SSTI?
Sandboxes help but have a history of bypasses. The primary control is never letting users influence template source code.
How do testers detect SSTI?
They inject probe expressions (for example arithmetic in template syntax) and observe whether the server evaluates them in responses or errors.
References
Explore authoritative guidance and frameworks related to server-side template injection (ssti).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.