SSTI: server-side template injection

An engine like Jinja2, Twig or Freemarker interpolates {{ ... }}. If you concatenate input into the template source, the user controls the expression.

render_template_string("Hello " + name)
# name = {{7*7}}  -> "Hello 49"  (SSTI confirmed)

From there you walk the Python/Java object graph until you reach system primitives:

{{ ''.__class__.__mro__[1].__subclasses__() }}  # toward os.system

Defence

Treat input as data, never as template source: pass variables into the context, do not concatenate them into the template. Use engine sandboxes where available, but do not rely on them alone. The {{7*7}} payload is the canonical detection test.