Template injection is a flaw where attacker-controlled input changes how a template is rendered. Many web apps use templates to build pages, emails, reports, or chat responses. If untrusted data is inserted into template syntax instead of plain text, the template engine may evaluate expressions, call helpers, or expose internal data. In severe cases, this becomes server-side template injection, which can lead to data disclosure, command execution, or a path to deeper compromise.
It matters in cyber security because templates often sit inside high-trust systems such as dashboards, dataset pipelines, ticketing tools, and automation platforms. An attacker may exploit a forgotten preview feature, a parsing bug, or unsafe interpolation in a workflow worker. Defenses include strict input encoding, separating data from template code, using safe template APIs, limiting template features, and running renderers with minimal privileges. In incident response, reviewing template inputs and render logs can help identify whether a crafted payload altered execution or only changed displayed content.