ssti
Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions {{77}} returning 49, or ${77}, <%= 77 %>. Leads to full RCE via template sandbox escape, Python __class__.__mro__ traversal, and Java reflection cha…