Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Prompt string is rendered again through a template engine (`load_prompt_from_string`) with parameter values after prior template rendering. This second evaluation can allow Server-Side Template Injection (SSTI) if parameters contain template expressions.
Dynamic Twig template string is registered and rendered without enforcing a Twig SandboxExtension security policy. This may lead to Server-Side Template Injection (SSTI) and remote code execution if the input is editor- or user-controlled.
Email subject templates evaluated by vulnerable template engine versions may lead to RCE.
User input is retrieved and sanitized using `escapeHtml` before being passed to `nl2br`. In Magento email templates and other rendering contexts, `escapeHtml` does not strip curly braces `{` and `}`, making the input vulnerable to Server-Side Template Injection (SSTI) if evaluated by the template engine. Validate the input against template directives (e.g.,
Recursive evaluation of templates detected. The output of a `.render()` call is being fed back into a Jinja template loader or parser. If the initial template interpolates untrusted data, this allows an attacker to inject template syntax that will be executed on the second pass, causing a Server-Side Template Injection (SSTI) vulnerability. Render templates
Detected first-character shortcut in a type-name deny-list check (isTypeBlockedForAllPurposes / isTypeBlockedForTypeReference). The conditional `if (c0 != 'c' && c0 != 'j' && c0 != 'o' && c0 != 's') return false;` (or the 'c'/'n'/'j'/'o' variant) short-circuits the actual deny-list lookup based on the assumption that every blocked package starts with one of
Detected an under-specified Thymeleaf expression-opener recognizer that checks only '$', '*', '#', '@', '~' but does NOT also check the preprocessing opener '_' (for "__...__") nor the literal-substitution opener '|' (for "|...|"). This is the CVE-2026-40477 (Thymeleaf <= 3.1.3.RELEASE) SSTI-bypass shape: SpringRequestUtils.containsExpression() fails to flag
Channel/sender ACL check is fail-open: when the configured allow list is empty or missing, the function returns True, granting access to every sender. A remote attacker can deliver messages (e.g. via an unauthenticated email/IMAP poll, webhook, or chat platform) and have them processed as trusted owner input, enabling indirect prompt injection and tool abuse
Unsafe template evaluation detected. Using an unsandboxed Jinja2 `Environment` or passing a raw `str.format` as a delegate allows an attacker to evaluate strings without attribute-access constraints. This can lead to Server-Side Template Injection (SSTI) or Remote Code Execution (RCE) via arbitrary attribute traversal (e.g., `__class__`). Consider using `jin
Rendering a jinja2.Template on potentially user-controlled input without sandboxing enables Server-Side Template Injection (SSTI). The default jinja2.Template class permits attribute access (e.g. __class__, __base__, __subclasses__) that lets attackers reach arbitrary callables and execute OS commands (CVE-2025-23211 in Tandoor Recipes). Replace with jinja2.
A non-sandboxed jinja2.Environment instance is constructed. When such an Environment is later used with from_string()/render() against template strings influenced by user input (e.g., a webhook body, email template, or any stored user-supplied content), the unsandboxed environment permits Jinja2 attribute traversal (__class__, __mro__, __subclasses__, __glob
Template is rendered with gonja's default environment via gonja.FromString / gonja.FromBytes / gonja.FromFile. The default environment ships with an unrestricted filesystem loader, so Jinja2 composition directives in the template body (e.g. {% include "/etc/passwd" %}, {% extends %}, {% import %}, {% from %}) are resolved against the host filesystem. If any
Use of jinja2.Environment (non-sandboxed) to render a template via `.from_string(...).render()` allows Server-Side Template Injection (SSTI) leading to Remote Code Execution when the template string is user-controlled. Jinja2 expressions in a non-sandboxed Environment can traverse Python attributes (e.g. `__init__.__globals__.__builtins__`) and import arbitr
The XWiki rendering verbatim block ({{{ ... }}}) wraps feed output that may contain user-controlled data. Because verbatim only escapes wiki parsing, an attacker who can influence the wrapped content (e.g. via a feed title/description filled from a request parameter) can inject a literal "}}}" to terminate the verbatim block early and then have arbitrary mac
Using `jinja2.Environment` without restrictions to render dynamically provided templates allows for Server-Side Template Injection (SSTI). An attacker can execute arbitrary OS commands by abusing the unrestrained environment. Keep data and templates separate or switch to `jinja2.sandbox.SandboxedEnvironment` if dynamic template inputs are strictly required.
Dynamically creating Jinja2 templates using 'jinja2.Template' without a sandboxed environment can lead to Server-Side Template Injection (SSTI) and arbitrary code execution if the template string is attacker-controlled. Use 'jinja2.sandbox.SandboxedEnvironment' instead.
