# Unsanitized field injection into templates and commands

User-controlled fields concatenated into shell, JSON, templates, or identifiers without escaping or validation

_Area: Smart contract access control and control flow. Seen in 8 disclosed reports; 2 confirmed bounties: $2,000 and $6,000; latest 2026-03-26. Updated 2026-10-23._

## How it works
A value the attacker controls is pasted into a structured string (shell command, JSON document, template expression, or identifier) without escaping. The surrounding syntax treats the attacker's characters as structure rather than data, so the attacker changes what the string means. The broken assumption is that a field is "just a value"; in fact the sink re-parses it.

## Where it shows up
- Undocumented or optional request fields flowing into shell commands, especially where authorization runs after the dangerous step [E4](https://bugbountylibrary.com/r/h1%3A1705717.md).
- String concatenation into JSON (e.g. `abi.encodePacked` building `tokenURI`) with user metadata fields [E5](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AH-03.md).
- Expression evaluators constructed with the "limited" flag off, fed user strings [E2](https://bugbountylibrary.com/r/blog%3Ablog-projectdiscovery-io-hello-lucee-let-us-hack-apple-again.md).
- Template engines that expose constructors or pass context as trailing args [E3](https://bugbountylibrary.com/r/blog%3Amahmoudsec-blogspot-com-2019-04-handlebars-template-injection-and-rce-html.md).
- Identifiers composed from user input plus a delimiter, then validated downstream [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-02.md).
- Managed services that consume user-supplied config (kubeconfig exec plugins) and execute it [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-203177829.md).

## How to review
Trace each user-controlled field to its sink and ask: is it escaped for that exact grammar, or validated against an allowlist? The invariant: no user value may alter the structure of the command, JSON, template, or identifier it is embedded in. Check ordering too — authorization must precede any operation that touches the field [E4](https://bugbountylibrary.com/r/h1%3A1705717.md). For identifiers, confirm the composed value satisfies the downstream validator's character rules before minting [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-02.md). For JSON, confirm escaping of quotes, colons, commas, and that duplicate keys cannot override [E5](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AH-03.md).

## Variants seen
- Shell metacharacters in a consensus request field reaching `dpkg -s` [E4](https://bugbountylibrary.com/r/h1%3A1705717.md).
- JSON key injection via unescaped metadata in an on-chain URI builder [E5](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AH-03.md).
- CFML expression evaluation of cookie and parameter values [E2](https://bugbountylibrary.com/r/blog%3Ablog-projectdiscovery-io-hello-lucee-let-us-hack-apple-again.md).
- Handlebars SSTI escalating through constructor access [E3](https://bugbountylibrary.com/r/blog%3Amahmoudsec-blogspot-com-2019-04-handlebars-template-injection-and-rce-html.md).
- Delimiter collision: caller injects `:` that the stdlib forbids [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-02.md).
- Config-as-code: kubeconfig exec plugin executed by a managed control plane [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-203177829.md).

## Why fixes fail
Escaping one field while another (image vs animationUrl) stays raw leaves the sink open [E5](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AH-03.md). Validating at the caller but not against the downstream validator's rules still aborts or misbehaves [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-02.md). Moving authorization later does not remove the injection [E4](https://bugbountylibrary.com/r/h1%3A1705717.md).

## Impact and severity
Ranges from pre-auth RCE across all nodes [E4](https://bugbountylibrary.com/r/h1%3A1705717.md)[E2](https://bugbountylibrary.com/r/blog%3Ablog-projectdiscovery-io-hello-lucee-let-us-hack-apple-again.md)[E3](https://bugbountylibrary.com/r/blog%3Amahmoudsec-blogspot-com-2019-04-handlebars-template-injection-and-rce-html.md)[E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-203177829.md) to permanently blocked functionality [E6](https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-02.md) and NFT metadata spoofing [E5](https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AH-03.md). Severity rises when the sink is reachable unauthenticated, runs on every node, or silently changes what users see.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-203177829.md
- E2: https://bugbountylibrary.com/r/blog%3Ablog-projectdiscovery-io-hello-lucee-let-us-hack-apple-again.md
- E3: https://bugbountylibrary.com/r/blog%3Amahmoudsec-blogspot-com-2019-04-handlebars-template-injection-and-rce-html.md
- E4: https://bugbountylibrary.com/r/h1%3A1705717.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-12-revolutionprotocol%3AH-03.md
- E6: https://bugbountylibrary.com/r/c4%3A2025-01-initia-move%3AH-02.md