CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
baseThe product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (299)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-75650US | critical10.0OT critical | KEV | ||
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of… | ||||
| CVE-2026-41901US | —OT critical | Exploit | ||
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mech… | ||||
| CVE-2026-40478US | —OT critical | — | ||
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression… | ||||
| CVE-2026-40477US | —OT critical | Exploit | ||
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression exec… | ||||
| CVE-2024-23692US | critical9.8OT critical | KEV | ||
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to exe… | ||||
| CVE-2024-4040US | critical10.0OT critical | KEV | ||
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the… | ||||
| CVE-2025-47916US | critical9.8 | Exploit | ||
Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeeditor controller (file: /applica… | ||||
| CVE-2022-25813US | high7.5 | Exploit | ||
In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from th… | ||||
| CVE-2024-6386US | high8.8 | Exploit | ||
The WPML plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.6.12 via Twig Server-Side Template Injection. This is due to missing in… | ||||
| CVE-2025-23211US | critical9.9 | Exploit | ||
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server.… | ||||
| CVE-2026-103849US | critical10.0 | Exploit | ||
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of… | ||||
| CVE-2021-46703US | critical9.8 | Exploit | ||
In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally… | ||||
| CVE-2024-28116US | high8.8 | Exploit | ||
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticat… | ||||
| CVE-2022-22930US | critical9.8 | — | ||
A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. | ||||
| CVE-2025-66294US | high8.8 | Exploit | ||
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection (SSTI) vulnerability exists in Grav that allows authenticated attackers with editor perm… | ||||
| CVE-2026-42203US | high8.8 | Exploit | ||
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-su… | ||||
| CVE-2026-33154US | high8.1 | Exploit | ||
dynaconf is a configuration management tool for Python. Prior to version 3.2.13, Dynaconf is vulnerable to Server-Side Template Injection (SSTI) due to unsafe template evaluation i… | ||||
| CVE-2022-0944US | high7.2 | Exploit | ||
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1. | ||||
| CVE-2025-59340US | critical10.0 | — | ||
jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical… | ||||
| CVE-2026-97359US | critical10.0 | — | ||
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan