Client-side template injection
Summary: Client-side template injection occurs when applications using a client-side template framework dynamically embed user input in web pages, and the framework scans the rendered page for template expressions and executes any it finds. An attacker exploits this by supplying a malicious template expression that launches a cross-site scripting attack, which can steal session tokens or login credentials, perform arbitrary actions on the victim's behalf, and log keystrokes.
Why it matters: The source notes that framework sandboxes are not intended as a security control and can normally be bypassed, and that browser XSS filters are typically unable to detect or prevent these attacks - so for applications like online banking, the source says the flaw should always be considered high risk.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026