🛡️ Security

Server-Side Template Injection (SSTI)

A vulnerability in which attacker-controlled input reaches a template engine as template syntax rather than as a bound value, letting the attacker write expressions the engine evaluates. Because template engines can reach runtime objects, SSTI commonly escalates to remote code execution, as in the 2026 StyleSmuggler attacks on Magento.

📚 Deep Dive

Learn Article

How Server-Side Template Injection Becomes Remote Code Execution

Template engines are small programs, not passive strings. When user input reaches the template itself instead of a bound value, injection turns into code execution, as the StyleSmuggler flaw showed.

intermediate 5 min read

Back to Glossary