CWE-1336— Improper Neutralization of Special Elements Used in a Template Engine (SSTI)

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.— MITRE CWE catalog

325 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-1336page 5 of 7

CVE-2024-36694HIGHCVSS 7.2EG 8.0
2024-12-18
OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.
CVE-2026-85654HIGHCVSS 7.8EG 7.8
2026-09-04
Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.6 might allow a context-dependent actor to execute arbitrary code on the host that deploys the gene…
CVE-2026-57170HIGHCVSS 7.8EG 7.8
2026-08-25
Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse…
CVE-2026-54621HIGHCVSS 7.8EG 7.8
2026-07-28
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/mode…
CVE-2026-54654HIGHCVSS 7.8EG 7.8
2026-07-28
datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnot…
CVE-2026-73505HIGHCVSS 7.8EG 7.8
2026-07-24
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function…
CVE-2026-49382HIGHCVSS 7.8EG 7.8
2026-05-29
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
CVE-2026-46439HIGHCVSS 7.8EG 7.8
2026-05-28
compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively e…
CVE-2026-40320HIGHCVSS 7.8EG 7.8
2026-04-17
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silently interpreting template expressions at r…
CVE-2026-25731HIGHCVSS 7.8EG 7.8
2026-02-06
calibre is an e-book manager. Prior to 9.2.0, a Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows arbitrary code execution when a user converts an ebook using a malicious custom template fil…
CVE-2024-56326HIGHCVSS 7.8EG 7.8
2024-12-23
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To explo…
CVE-2023-5764HIGHCVSS 7.8EG 7.8
2023-12-12
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce t…
CVE-2022-47896HIGHCVSS 5.0EG 7.8
2022-12-22
In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
CVE-2026-19584HIGHCVSS 7.7EG 7.7
2026-09-10
Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malici…
CVE-2026-77129HIGHCVSS 7.7EG 7.7
2026-08-25
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this fi…
CVE-2026-12370HIGHCVSS 7.6EG 7.6
2026-09-23
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Exe…
CVE-2026-82958HIGHCVSS 7.6EG 7.6
2026-09-02
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message header…
CVE-2026-71880HIGHCVSS 7.6EG 7.6
2026-08-18
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection
CVE-2026-118803HIGHCVSS 7.5EG 7.5
2026-10-28
Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to control the urlParams object in the query_result REST endpoint, causing the submitted value to be re-pars…
CVE-2026-13297HIGHCVSS 7.5EG 7.5
2026-09-04
IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.
CVE-2026-47690HIGHCVSS 7.5EG 7.5
2026-07-21
MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permission…
CVE-2026-44209HIGHCVSS 7.5EG 7.5
2026-05-26
Banks generates meaningful LLM prompts using a template language that makes sense. Prior to 2.4.2, banks uses jinja2.Environment() (unsandboxed) to render prompt templates. Applications that pass user-supplied strings as the template argum…
CVE-2026-34202HIGHCVSS 7.5EG 7.5
2026-03-31
ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-chain version 6.0.1, a vulnerability in Zebra's transaction processing logic allows a remote, unauthenticated attacker to cause a Zebra node to panic (…
CVE-2025-66298HIGHCVSS 7.5EG 7.5
2025-12-01
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, having a simple form on site can reveal the whole Grav configuration details (including plugin configuration details) by using the correct POST payload to exploit a Server-Side Tem…
CVE-2024-41950HIGHCVSS 7.5EG 7.5
2024-07-31
Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. Haystack clients that let their users create and run Pipelines from scratch are vulnerable to remote…
CVE-2024-32406HIGHCVSS 7.5EG 7.5
2024-04-26
Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Batch-Issue Exam Tickets function.
CVE-2025-6761HIGHCVSS 7.3EG 7.3
2025-06-27
A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function plugin.buildMobilePopHtml of the file \k3\o2o\bos\webapp\action\DynamicForm 4 A…
CVE-2024-57177HIGHCVSS 7.3EG 7.3
2025-02-10
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged t…
CVE-2026-126234HIGHCVSS 7.2EG 7.2
2026-11-11
A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer Cloud 8.0.0, FortiManager 8.0.0, FortiManager Cloud 8.0.0 may allow an authenticated attacker with restric…
CVE-2026-92196HIGHCVSS 7.2EG 7.2
2026-11-03
Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Data…
CVE-2026-102142HIGHCVSS 7.2EG 7.2
2026-09-30
A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions contained in the stored template body. An authenticated System Administrator could potentially store a crafted template …
CVE-2026-87021HIGHCVSS 7.2EG 7.2
2026-09-09
Tanium addressed an unauthorized code execution vulnerability in Comply.
CVE-2026-54718HIGHCVSS 7.2EG 7.2
2026-08-27
Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side temp…
CVE-2026-53964HIGHCVSS 7.2EG 7.2
2026-08-19
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for use…
CVE-2026-11407HIGHCVSS 7.2EG 7.2
2026-06-17
Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() imple…
CVE-2026-33392HIGHCVSS 7.2EG 7.2
2026-04-17
In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypass
CVE-2026-34724HIGHCVSS 7.2EG 7.2
2026-04-08
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or …
CVE-2026-26026HIGHCVSS 7.2EG 7.2
2026-04-06
GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administrator lead to RCE. This vulnerability is fixed in 11.0.6.
CVE-2026-28784HIGHCVSS 7.2EG 7.2
2026-03-04
Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the Sys…
CVE-2026-28695HIGHCVSS 7.2EG 7.2
2026-03-04
Craft is a content management system (CMS). There is an authenticated admin RCE in Craft CMS 5.8.21 via Server-Side Template Injection using the create() Twig function combined with a Symfony Process gadget chain. The create() Twig functio…
CVE-2026-2969HIGHCVSS 7.2EG 7.2
2026-02-23
A flaw has been found in datapizza-labs datapizza-ai 0.0.2. Affected is the function ChatPromptTemplate of the file datapizza-ai-core/datapizza/modules/prompt/prompt.py of the component Jinja2 Template Handler. This manipulation of the arg…
CVE-2025-14731HIGHCVSS 7.2EG 7.2
2025-12-16
A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser.php of the component Frontend/Template Management Module. This manipulation caus…
CVE-2025-62369HIGHCVSS 7.2EG 7.2
2025-11-04
Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authen…
CVE-2025-57811HIGHCVSS 7.2EG 7.2
2025-08-25
Craft is a platform for creating digital experiences. From versions 4.0.0-RC1 to 4.16.5 and 5.0.0-RC1 to 5.8.6, there is a potential remote code execution vulnerability via Twig SSTI (Server-Side Template Injection). This is a follow-up to…
CVE-2025-46731HIGHCVSS 7.2EG 7.2
2025-05-05
Craft is a content management system. Versions of Craft CMS on the 4.x branch prior to 4.14.13 and on the 5.x branch prior to 5.6.16 contains a potential remote code execution vulnerability via Twig SSTI. One must have administrator access…
CVE-2024-37621HIGHCVSS 7.2EG 7.2
2024-06-17
StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component /shippingOptionConfig/index.blade.php.
CVE-2024-37301HIGHCVSS 7.2EG 7.2
2024-06-11
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, whe…
CVE-2023-46245HIGHCVSS 7.2EG 7.2
2023-10-31
Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious u…
CVE-2022-0944HIGHCVSS 7.2EG 7.2
2022-03-15
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.
CVE-2021-39128HIGHCVSS 7.2EG 7.2
2021-09-16
Affected versions of Atlassian Jira Server or Data Center using the Jira Service Management addon allow remote attackers with JIRA Administrators access to execute arbitrary Java code via a server-side template injection vulnerability in t…

Map vulnerabilities like CWE-1336 to your infrastructure

EchelonGraph correlates every CVE — across CWE-1336 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →