What Is Server-Side Template Injection (SSTI)?

Server-side template injection (SSTI) happens when user input is placed into a server-side template that the engine then evaluates — instead of being passed safely as data into a pre-written template. Because template engines can run expressions and reach into application objects, attacker-controlled template syntax frequently escalates to reading secrets or full remote code execution on the server.

How does SSTI arise?#

The mistake is building the template itself from user input:

Dangerous:  render_template_string("Hello " + user_name)
Input:      {{ 7 * 7 }}
Rendered:   Hello 49     ← the engine evaluated the input

That 49 is the tell: the engine executed the expression. From there, attackers navigate the template language to reach objects that run system commands. Contrast the safe pattern, where the template is fixed and input is only ever data passed into it.

Why is SSTI so dangerous?#

Because template engines are powerful by design. Unlike XSS, which runs in a browser sandbox, SSTI runs on the server with the application’s privileges:

	XSS	SSTI
Executes on	Victim’s browser	The server
Typical worst case	Session theft, actions	Remote code execution
Root cause	Input into HTML	Input into a template

How do you prevent it?#

• Never build templates from user input — keep templates static; pass input as bound data only.
• Use logic-less or sandboxed templates where feasible.
• Treat template syntax like code — the same discipline as parameterizing SQL.

SSTI is injection aimed at the template layer, a cousin of command injection. More at the Web Security hub.