SSTI Detection

When to Use

Audit template engines, email template systems, report generators, CMS systems, and any code that compiles templates from user input.

Key Distinction

• User input IN the template string = VULNERABLE (SSTI)
• User input IN template variables/context = SAFE (this is normal template usage)

// VULNERABLE: user input IS the template
ejs.render(userInput, data);

// SAFE: user input is in the data, not the template
ejs.render(templateFromFile, { name: userInput });