The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
Use the template engine's sandbox or restricted mode, if available.
Our security experts can help you identify and remediate CWE-1336 vulnerabilities in your codebase.
Get Security Assessment