CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Description
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1336 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-8w7q-29mw-gf5c | CVE-2026-106509 | HIGH |
Backstage: Improper validation of MkDocs theme configuration in TechDocs |
2026-10-07 | |
| GHSA-27vj-qcqg-25rc | CVE-2026-104851 | HIGH |
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution |
2026-10-05 | |
| GHSA-mr95-65j8-9mxp | CVE-2026-57170 | HIGH |
Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439) |
2026-09-24 | |
| GHSA-gxrg-x694-283w | CVE-2026-73858 | MODERATE | - |
Solspace Freeform: Limited Twig template injection via submitted field values |
2026-09-23 |
| GHSA-2c4f-86xc-cr74 | CVE-2026-61453 | MODERATE | - |
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation |
2026-09-16 |
| GHSA-6wvf-77m9-58rm | CVE-2026-37004 | CRITICAL |
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint |
2026-09-08 | |
| GHSA-x67c-8pwr-m8g3 | CVE-2026-72807 | HIGH |
SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel |
2026-09-03 | |
| GHSA-fg9p-mrxr-hvq7 | CVE-2026-62681 | CRITICAL |
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) |
2026-09-03 | |
| GHSA-88f2-fpv8-89q2 | CVE-2026-62682 | CRITICAL |
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) |
2026-09-03 | |
| GHSA-w727-8j6c-2rj4 | CVE-2026-72717 | CRITICAL |
Orval: Import-time RCE via schema default -> zod module-level template literal |
2026-09-03 | |
| GHSA-2h9g-j24r-h63g | CVE-2026-71869 | CRITICAL |
Orval: Import-time RCE via array-items default -> zod module-level template literal |
2026-09-03 | |
| GHSA-8j6p-r8jg-mxqh | CVE-2026-71871 | CRITICAL |
Orval: Import-time RCE via header-parameter default -> zod module-level template literal |
2026-09-03 | |
| GHSA-3575-w9fc-c2j6 | CVE-2026-71868 | CRITICAL |
Orval: Import-time RCE via enum-typed default -> zod module-level template literal |
2026-09-03 | |
| GHSA-7p36-fq2r-4h7r | CVE-2026-11407 | HIGH | - |
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed |
2026-09-02 |
| GHSA-p4cg-3328-rvfg | CVE-2026-72716 | CRITICAL |
Orval: Import-time RCE via query-parameter default -> zod module-level template literal |
2026-09-02 | |
| GHSA-5f29-2333-h9c7 | CVE-2026-22244 | HIGH |
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE |
2026-08-31 | |
| GHSA-73mf-m39p-wpm9 | CVE-2026-55559 | CRITICAL |
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) |
2026-08-28 | |
| GHSA-39mm-rwm3-29jp | CVE-2026-54718 | HIGH | - |
silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email template |
2026-08-27 |
| GHSA-hrwp-4hh9-c8r8 | CVE-2026-59989 | CRITICAL | - |
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) |
2026-08-27 |
| GHSA-vwf3-4xxj-qg6h | - | HIGH |
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment |
2026-08-25 | |
| GHSA-w47q-945m-q9pc | CVE-2026-53964 | HIGH |
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes) |
2026-08-19 | |
| GHSA-6xj8-qv9j-xcjq | CVE-2026-73505 | HIGH |
Oh My Posh: Arbitrary command execution via template injection in the path segment |
2026-08-13 | |
| GHSA-m49c-g9wr-hv6v | CVE-2025-59340 | CRITICAL |
jinjava has Sandbox Bypass via JavaType-Based Deserialization |
2026-07-31 | |
| GHSA-xrmj-5g4g-8987 | - | MODERATE |
@dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notification |
2026-07-31 | |
| GHSA-w284-33mx-6g9v | CVE-2026-54666 | HIGH |
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies |
2026-07-29 |