sast-ssti
Detects Server-Side Template Injection vulnerabilities in codebases using a structured three-phase approach for security assessments.
Install this skill
Security score
The sast-ssti skill was audited on Jun 6, 2026 and we found 16 security issues across 3 threat categories, including 1 critical. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 138 | // Payload: ?template=<%- global.process.mainModule.require('child_process').execSync('id') %> |
Direct command execution function call
| 154 | // Payload: {{ range.constructor("return global.process.mainModule.require('child_process').execSync('id').toString()")() }} |
Direct command execution function call
| 241 | return "user/" + lang + "/welcome"; // path traversal + SSTI if lang is e.g. "__${T(java.lang.Runtime).getRuntime().exec('id')}" |
Direct command execution function call
| 529 | > Example for EJS: ?tmpl=<%- global.process.mainModule.require('child_process').execSync('id') %>] |
Template literal with variable interpolation in command context
| 199 | ```java |
Template literal with variable interpolation in command context
| 237 | ```java |
Template literal with variable interpolation in command context
| 523 | > ``` |
Node child_process module reference
| 138 | // Payload: ?template=<%- global.process.mainModule.require('child_process').execSync('id') %> |
Node child_process module reference
| 154 | // Payload: {{ range.constructor("return global.process.mainModule.require('child_process').execSync('id').toString()")() }} |
Node child_process module reference
| 529 | > Example for EJS: ?tmpl=<%- global.process.mainModule.require('child_process').execSync('id') %>] |
Fetch to external URL
| 42 | - `$smarty->fetch("string:" . user_input)` — Smarty (PHP) |
Fetch to external URL
| 273 | // VULNERABLE: user-controlled template string via fetch("string:...") |
Fetch to external URL
| 275 | $smarty->fetch("string:" . $template); |
Fetch to external URL
| 382 | > - `$smarty->fetch("string:" . $var)` or `$smarty->display("string:" . $var)` |
Access to .env file
| 261 | // Payload: {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} |
Access to .env file
| 527 | > Example for Twig: ?tmpl={{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} |