Template injection (ARCH3130)

Key typescript.security.template-injection · Severity error · Category security · CWE CWE-1336

Building the template string itself from user input lets attackers inject template-engine expressions, enabling server-side template injection (SSTI) and remote code execution.

Incorrect

import Handlebars from "handlebars";

app.get("/greet", (req, res) => {
  // The template itself is built from user input
  const tpl = Handlebars.compile(`Hello ${req.query.name}`);
  res.send(tpl({}));
});

Correct

import Handlebars from "handlebars";

const tpl = Handlebars.compile("Hello {{name}}"); // fixed template

app.get("/greet", (req, res) => {
  res.send(tpl({ name: req.query.name })); // input is data only
});

Fix

Keep templates static; pass user input only as data, never into the template source.