Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Updated
About CWE-1336
MITRE lists these common consequences: Execute Unauthorized Code or Commands, affecting integrity.
- MITRE name
- Improper Neutralization of Special Elements Used in a Template Engine
- Abstraction
- Base: abstract, but detailed enough to infer detection and prevention methods
- Status
- Incomplete
Also Known As
- Server-Side Template Injection / SSTI
- Client-Side Template Injection / CSTI
Mitigations
- Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
- Use the template engine's sandbox or restricted mode, if available.
Detection
MITRE lists these detection methods: Automated Static Analysis (high).
CWE-1336 in the KEV Catalog
as of 2026-11-12- 3 CISA KEV entries name Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) in their CVE record, tied for 64th among the 194 weaknesses named in the catalog.
- CISA added 2 CWE-1336 entries to the KEV catalog in 2024, 0 in 2025, and 1 so far in 2026.
CWE-1336 Vulnerabilities
6 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-75650KEV Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | Adobe | 10.0 | 99.4% | KEV | 2026-09-07 |
| CVE-2024-23692KEV Rejetto HTTP File Server 2.3m Unauthenticated RCE | Rejetto HTTP File Server 2.3m Unauthenticated RCE | Rejetto | 9.8 | 99.5% | KEV | 2024-05-31 |
| CVE-2024-4040KEV Unauthenticated arbitrary file read and remote code execution in CrushFTP | Unauthenticated arbitrary file read and remote code execution in CrushFTP | CrushFTP | 9.8 | 99.5% | KEV | 2024-04-22 |
| CVE-2026-90970 Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway | Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway | GitLab | 9.9 | 17.5% | 2026-10-02 | |
| CVE-2026-26026 GLPI has a Server-Side Template Injection via Double-Compilation | GLPI has a Server-Side Template Injection via Double-Compilation | glpi-project | 9.1 | 12.0% | 2026-04-06 | |
| CVE-2026-97359 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection | HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection | rejetto | 10.0 | 5.5% | 2026-09-24 |
Frequently Asked Questions
What is CWE-1336?→
CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) is a MITRE CWE entry. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
How many exploited vulnerabilities are classified as CWE-1336?→
This database lists 6 CVE records mapped to CWE-1336 by their CVE Numbering Authority. 3 of them are in the CISA Known Exploited Vulnerabilities catalog, and CISA links 1 to known ransomware campaigns. Examples include CVE-2026-75650, CVE-2024-23692, CVE-2024-4040.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not affiliated with or endorsed by MITRE or CISA.