SSTI Labs — Server-Side Template Injection

Template injection bugs let attackers escalate from limited template expressions to remote code execution. These labs model real Jinja-style sandbox escapes — walking attribute chains from exposed objects to reach hidden config and beyond.

Template injection vulnerabilities show up in any application that interpolates user-supplied data into a template engine. These labs give you the hands-on experience to recognise the bug class and exploit it through the standard escape patterns used in real-world attacks.