Server-Side Template Injection (SSTI)

When it applies

Input flows into a server-side template that is evaluated, not just interpolated as text. Common in email/notification templates, custom dashboards, and any "use variables in your message" feature.

Why it works

Template engines execute expressions. If attacker input becomes part of the template source (rather than a bound variable), the engine evaluates it — and most engines expose object introspection that reaches OS command execution.