Glossary
SERVER-SIDE TEMPLATE INJECTION / SSTI
defined.
An attack where attacker-controlled input is interpreted as part of a server-side template — allowing arbitrary expression evaluation and often full RCE.
A–Z
An attack where attacker-controlled input is interpreted as part of a server-side template — allowing arbitrary expression evaluation and often full RCE.
Modern web frameworks (Jinja2, Twig, Velocity, ERB, Handlebars) compile templates server-side. If user input lands in the template before rendering — not just as a variable — the attacker controls the template syntax. Tooling like tplmap automates exploitation.
See our web application penetration testing, API security testing, network penetration testing, and cloud security audit services for how we test for and defend against this class of issue.
30-minute call with an OSCP-certified engineer. Tailored proposal in 24 hours.