ssti-server-side-template-injection
Audited by Socket on Apr 22, 2026
2 alerts found:
SecurityMalwareHIGH risk offensive security skill. Its capabilities are internally consistent with an exploitation playbook, but that stated purpose is to enable AI-driven SSTI exploitation, credential harvesting, and persistence; there is little malware evidence, but the security risk is severe.
This artifact is an offensive SSTI exploitation and fingerprinting payload matrix covering many major template engines. It explicitly includes sandbox-bypass guidance, command-execution (RCE) and sensitive file-read payload examples, and blind/OOB verification using attacker-controlled DNS lookups. Even if not directly executable code at runtime, its inclusion in a dependency meaningfully increases misuse capability and represents a high security risk from a supply-chain perspective.