What is CWE-1336?
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
Many web applications use template engines that allow developers to insert externally-influenced values into free text or messages in order to generate a full web page, document, message, etc. Such engines include Twig, Jinja2, Pug, Java Server Pages, FreeMarker, Velocity, ColdFusion, Smarty, and many others - including PHP itself. Some CMS (Content Management Systems) also use templates. Template engines often have their own custom command or expression language. If an attacker can influence input into a template before it is processed, then the attacker can invoke arbitrary expressions, i.e. perform injection attacks. For example, in some template languages, an attacker could inject the expression "{{7*7}}" and determine if the output returns "49" instead. The syntax varies depending on the language. In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error. Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same.
CWE-1336 is a base-level weakness in MITRE’s Common Weakness Enumeration. Applicable platforms: Language: Java; Language: PHP; Language: Python; Language: JavaScript; Language: Interpreted; Operating_System: Not OS-Specific.
Source: MITRE CWE (CWE-1336 definition, reproduced verbatim). Counts and linkage below are Threadlinqs data.
Consequences
- Integrity — Execute Unauthorized Code or Commands
Source: MITRE CWE, common consequences.
How CWE-1336 is exploited in the wild
Threadlinqs maps 5 CVEs to CWE-1336, published between 2026-06-18 and 2026-09-16. None of them is in the CISA KEV catalog yet. By CVSS v3 severity the set splits into 2 critical, 1 high, 1 medium. The highest EPSS score in the set is 0.4% (CVE-2026-44181), the modelled probability of exploitation in the next 30 days. 17 tracked threats reference CWE-1336 directly or through a CVE it covers; the most recent is “GitLab AI Gateway critical RCE via prompt template sandbox escape (CVE-2026-90970)” (2026-10-02). Affected products concentrate in Adobe (1), Dromara (1), JTL Software (1), among 5 vendors in total.
Vulnerabilities (CVEs)
All 5 CVEs mapped to CWE-1336, CISA KEV first, then by CVSS score.
- CVE-2026-48323 — CVSS 10 critical · published 2026-08-03
- CVE-2026-54390 — CVSS 9.8 critical · published 2026-06-18
- CVE-2026-92592 — CVSS 8.8 high · published 2026-09-16
- CVE-2026-78140 — CVSS 4.7 medium · EPSS 0.2% · published 2026-08-23
- CVE-2026-44181 — EPSS 0.4% · published 2026-07-16
Affected vendors
Threat activity
17 tracked threats cite CWE-1336:
- GitLab AI Gateway critical RCE via prompt template sandbox escape (CVE-2026-90970)CRITICAL
- Dell Container Storage Modules (CSM) flaws enable unauthenticated admin access and root on Kubernetes nodes (CVE-2026-63688, CVE-2026-63692, CVE-2026-67269, CVE-2026-54472, CVE-2026-61421, CVE-2026-67273)CRITICAL
- Kiteworks 9.5.1 Patches 126 Vulnerabilities Including Critical Account Takeover in Core and Email Protection Gateway (CVE-2026-102147, CVE-2026-102149)CRITICAL
- StyleSmuggler — Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online StoresCRITICAL
- Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in Nvidia's NemoClaw AI Agent Stack and a CVSS 10.0 Adobe Campaign Classic ChainCRITICAL
- AI Agents Persist Through Failed Malware, Rewrite Tools Mid-Attack: SentinelLABS Documents Sandbox Escape, PyPI Supply-Chain Package, and Artifactory Zero-Day AbuseHIGH
- Adobe Campaign Classic Critical Incorrect Authorization Flaw Enables Unauthenticated Remote Code Execution (CVE-2026-48449) Paired With SQL Injection Memory/File Disclosure (CVE-2026-48448)CRITICAL
- Autonomous OpenAI Test Models (GPT-5.6 Sol + Unreleased Pre-Release Model) Breach Hugging Face Production InfrastructureCRITICAL
- OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging FaceCRITICAL
- OpenAI Pre-Release AI Models (GPT-5.6 Sol + Unreleased Model) Autonomously Escape ExploitGym Sandbox and Breach Hugging Face Production InfrastructureHIGH
- OpenAI AI Agents Autonomously Escape Sandbox, Exploit Zero-Days, Compromise Hugging Face Production InfrastructureHIGH
- Hugging Face Breached by Autonomous AI Agent Exploiting Dataset Code-Execution Paths (No CVE Disclosed)HIGH
- Four Chained Exploit Paths in LiteLLM Proxy (Pre-Auth RCE to Master Key Exfiltration) — STAR Labs Pwn2Own ResearchCRITICAL
- JADEPUFFER Agentic Ransomware: Autonomous LLM Agent Exploits Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) for End-to-End Database ExtortionCRITICAL
- Multiple JetBrains Product Vulnerabilities: Account Takeover, Privilege Escalation, and RCE Across Hub, YouTrack, IntelliJ IDEA, Kotlin, GoLand, and TeamCityHIGH
- Microsoft Semantic Kernel Prompt-Injection-to-RCE & Arbitrary File Write — CVE-2026-26030 (InMemoryVectorStore eval) + CVE-2026-25592 (SessionsPythonPlugin)CRITICAL
- AI Prompt Injection Attacks on Enterprise LLMs — CrowdStrike Taxonomy, Agentic Tool Chain Attacks, MCP Poisoning, Indirect Injection via Data Sources, OpenClaw Attack SurfaceHIGH
Mitigations
- Architecture and Design: Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
- Implementation: Use the template engine's sandbox or restricted mode, if available.
Source: MITRE CWE, potential mitigations.
Detection methods (MITRE CWE)
- Automated Static Analysis (effectiveness: High): Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Source: MITRE CWE, detection methods. Threadlinqs detection rules for the threats above are Blue tier and higher.