# Template injection via re-rendered untrusted names

Untrusted names or fields re-parsed by a template engine or document parser that evaluates expressions

_Area: Web injection and code execution. Seen in 3 disclosed reports; one confirmed bounty: $4,500; latest 2026-09-23. Updated 2026-10-24._

## How it works
A renderer builds a string from untrusted input (a comment, a widget label, a folder name) and then hands the whole composed string back to a template engine or document parser that evaluates expressions. The first pass treats the input as data; the second pass treats it as code. The broken assumption is that "we already escaped/inserted this value, so it is inert." Re-parsing after insertion re-opens evaluation, and any function map, eval, or attribute evaluator reachable from that pass runs attacker-controlled expressions.

## Where it shows up
- A resolve/render pass that runs after untrusted values were concatenated into the template string [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6xj8-qv9j-xcjq.md)
- Template function maps exposing command execution, eval, or file access to rendered content [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6xj8-qv9j-xcjq.md)
- Document/HTML parsers that evaluate attribute values, e.g. color expressions [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md)
- Front-end widgets that eval() stored, user-editable display or config text [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md)
- Content shared across users (screens, reports, prompts) rather than self-only [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md)
- Verbose parser errors echoing input and listing allowed attributes [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md)
- CSP permitting unsafe-inline/unsafe-eval [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md)

## How to review
Trace every value from source to the final render call. The invariant: untrusted data must reach the output as an opaque value, never as part of a string that is subsequently parsed or evaluated. Check whether the composed string is re-parsed after insertion [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6xj8-qv9j-xcjq.md); whether the parser evaluates any attribute or expression [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md); whether stored content is passed to eval() [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md). Confirm escaping happens at the evaluation boundary, not before re-parsing. Check whether the function map or evaluator is restricted and whether the restriction is bypassable [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md).

## Variants seen
- Filesystem folder names re-rendered through Go text/template with cmd() in scope [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6xj8-qv9j-xcjq.md)
- Comment field interpolated into a ReportLab Paragraph/font template whose color evaluator evals [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md)
- Stored BUTTON widget text eval()'d on click, shared cross-user [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md)

## Why fixes fail
Sandboxed or restricted eval is not sufficient: the ReportLab case escaped a restricted eval to reach globals [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md). Blocking one delimiter fails when payloads can be appended after an existing separator [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md).

## Impact and severity
Arbitrary code execution and cloud metadata theft [E1](https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md); cross-user session token theft [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md); command execution on prompt render [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-6xj8-qv9j-xcjq.md). Severity rises with cross-user sharing, reachable function maps, and weak CSP.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Agithub-com-sudistark-bb-writeups-blob-main-2023-cve-2023-33733-rce-via-htmli-in-reportlab-md.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-gvf2-2rh5-mpgf.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-6xj8-qv9j-xcjq.md