Server-Side Template Injection:
Detection and Prevention

What Is Server-Side Template Injection?

Template engines like Jinja2, Twig, Freemarker, and Velocity allow developers to embed expressions in templates — {{ user.name }} outputs the user's name. These expressions are evaluated server-side with full access to the application context.

SSTI occurs when user-controlled input is rendered directly by the template engine rather than being passed as a safe variable. The distinction is critical:

from jinja2 import Environment

env = Environment()

# SAFE: user input is a variable value — not rendered as template
template = env.from_string("Hello, !")
template.render(name=user_input)  # user_input is data

# VULNERABLE: user input is the template string itself
template = env.from_string(f"Hello, {user_input}!")
template.render()  # user_input is rendered as template code

Jinja2 SSTI

Jinja2 is used in Flask, Django (with Jinja2 backend), Ansible, and many Python applications. The detection probe is simple: if the input {{7*7}} produces 49 in the response, the application is vulnerable.

# Detection probe — renders to 49 if vulnerable
{{7*7}}

# Config object exposure
{{config}}

# Environment access via class chain
{{"".__class__.__mro__[1].__subclasses__()}}

Twig SSTI (PHP)

Twig is the default template engine for Symfony and many PHP frameworks. Detection probe: {{7*7}} renders to 49. Twig's sandbox mode limits available functions, but misconfigured sandboxes can still be escaped.

Detection Techniques

• Arithmetic probes: {{7*7}}, ${7*7}, #{7*7} — if the response contains 49, template is rendering user input
• Engine fingerprinting: Different engines use different syntax. {{7*'7'}} returns 49 in Twig but 7777777 in Jinja2 — tells you which engine is in use
• tplmap: Automated SSTI detection and exploitation tool, similar to sqlmap but for template injection
• SAST: Search for render_template_string, Environment().from_string, or any template rendering function that accepts user input as the template string

Prevention

from jinja2 import Environment, select_autoescape

env = Environment(autoescape=select_autoescape(["html"]))

# CORRECT: template string is from your codebase, not user input
# User input only appears as variable values
template = env.from_string("Hello, ! You searched for: ")
output = template.render(
    name=user.name,      # safe variable
    query=user_query    # safe variable — not template code
)

The rule: the template string must come from your code or a trusted configuration store — never from user input. User input goes only into template variables, where it is treated as data, not code.

If you genuinely need user-defined templates (e.g., email template customisation), use a logic-less template engine like Mustache or Handlebars, which have no expression evaluation capability.