CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

High

Description

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Potential Impact

How to Fix

Architecture and Design

Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.

Implementation

Use the template engine's sandbox or restricted mode, if available.

Detection Methods

Related Weaknesses

References

View on MITRE CWE Database →

Need Help Fixing This Vulnerability?

Our security experts can help you identify and remediate CWE-1336 vulnerabilities in your codebase.

Get Security Assessment