What is CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine?+
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. Many web applications use template engines that allow developers to insert externally-influenced values into free text or messages in order to generate a full web page, document, message, etc. Such engines include Twig, Jinja2, Pug, Java Server Pages, FreeMarker, Velocity, ColdFusion, Smarty, and many others - including PHP itself. Some CMS (Content Management Systems) also use templates. Template engines often have their own custom command or expression language. If an attacker can influence input into a template before it is processed, then the attacker can invoke arbitrary expressions, i.e. perform injection attacks. For example, in some template languages, an attacker could inject the expression "{{7*7}}" and determine if the output returns "49" instead. The syntax varies depending on the language. In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error. Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.
What are the security consequences of Improper Neutralization of Special Elements Used in a Template Engine?+
If exploited, CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) it can compromise Integrity, leading to outcomes such as Execute Unauthorized Code or Commands.
How do you prevent or mitigate Improper Neutralization of Special Elements Used in a Template Engine?+
Recommended mitigations for CWE-1336 include: Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands. Use the template engine's sandbox or restricted mode, if available.
Which programming languages are affected by Improper Neutralization of Special Elements Used in a Template Engine?+
CWE-1336 commonly affects Java, PHP, Python, JavaScript and Interpreted. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
What are real-world examples of Improper Neutralization of Special Elements Used in a Template Engine?+
MITRE documents real CVEs mapped to CWE-1336, including CVE-2024-34359, CVE-2017-16783, CVE-2020-9437, CVE-2020-12790 and CVE-2021-21244. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
What is the difference between a CWE and a CVE?+
A CWE (Common Weakness Enumeration) like CWE-1336 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.