Server-Side Template Injection (SSTI)

High Severity Technical Guide

Vulnerability Description

SSTI occurs when user input is concatenated directly into server-side templates (Jinja2, Freemarker, Thymeleaf) rather than passed as parameters, leading to remote code execution.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Never concatenate user input directly into template source code. Use context-aware rendering engines and sanitize data parameters properly.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.