High
Server-Side / Tool Backend
Server-Side Eval / Template Injection of Fetched Content
If the agent evaluates content it fetched, deliver the payload as content (e.g. a data: URL). `${7*7}` returning 49 means an expression evaluator sits in the path.
Remote Code Execution
LLM05ASI05T11CWE-1336CWE-94
Tells spot it before you commit
- » A tool fetches or ingests content that is later rendered/evaluated server-side.
- » Output reflects computed values, not the literal string you sent.
- » Errors mention a template engine (Jinja, Freemarker, OGNL, SpEL) or Python objects.
Method
- Deliver the probe as content, not as the prompt - e.g. via a
data:URL the agent fetches. - Confirm evaluation with
${7*7}/{{7*7}}; a 49 proves an evaluator is in the path. - Fingerprint the engine, then escalate only in scope. Numbers-only means a hardened calculator (document as sandboxed).
Payloads templates - adapt to authorized scope
data:text/plain,${7*7}
data:text/plain,{{7*7}}
data:text/plain,#{7*7}
data:text/plain,<%= 7*7 %>
Why it works
The agent passes fetched, untrusted content into an evaluator or template engine without sandboxing. Because the payload arrives as data (not the user prompt), it bypasses prompt-level guardrails and lands directly in the sink.
Impact
From expression evaluation to full remote code execution depending on the engine and
sandbox (Jinja {{''.__class__...}}, Freemarker, OGNL, SpEL).
Defenses
- Never evaluate or template untrusted/fetched content; use logic-less rendering.
- Sandbox evaluators; disable attribute access and dangerous builtins.
- Treat tool-fetched content as untrusted data, never as code.
Mappings
OWASP LLM
LLM05 - Improper Output Handling
OWASP ASI
ASI05 - Unexpected Code Execution
Agentic Threats
T11 - Unexpected RCE & Code Attacks
CWE
CWE-1336 - Improper Neutralization of Special Elements Used in a Template EngineCWE-94 - Improper Control of Generation of Code (Code Injection)