Server-Side Template Injection
Critical · Injection · CWE-94
Description
User input is evaluated inside a server template engine.
Root cause
Concatenating input into templates.
Impact
RCE.
Detection
Template syntax probes.
Mitigation
Sandbox engines; never concat into templates.
Secure coding
Pass variables safely to templates.
Safe lab example
PortSwigger SSTI
Practise related skills in Labs or deepen on Academy library.