App Monitoring
Server-Side Template Injection
Also: SSTI, template injection
A flaw where user input is placed inside a server-side template and gets evaluated as template code, often leading to code execution.
In more detail
Template engines turn placeholders like {{name}} into text. If an app builds the template itself from user input, an attacker can write expressions the engine runs, such as {{7*7}}, and escalate to reading files or running commands. The fix is to pass user input only as data to a fixed template, never as part of the template.