thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Server-Side Template Injection (SSTI)

A vulnerability where user input is embedded into a server-side template as template code rather than data, potentially leading to remote code execution.

Definition

SSTI occurs when applications build templates from strings that include input (for example in Jinja2, Twig, Freemarker). Template engines often expose powerful objects. Mitigations: never construct templates from user input, pass input as context variables, use logic-less or sandboxed templates.

Example

A marketing tool lets users write email templates that are rendered with full Jinja2 privileges.

Exam tip

Pass input as data to fixed templates; sandboxing is defense in depth.

Related terms