BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback
Rules / Go

Server-Side Template Injection

Description

User input passed directly to template.Parse without sanitization.

How to fix

Use predefined templates and pass user data as template variables.

```go
tmpl := template.Must(template.ParseFiles("page.html"))
tmpl.Execute(w, map[string]string{
    "name": userInput, // Safe - passed as data, not template code
})
```

Learn more: https://shoulder.dev/learn/go/cwe-94/ssti

Applies to

Languages

Scan for this issue

Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=go-ssti .

Real-world examples

Known CVEs in the Code Injection vulnerability class that this rule helps detect.

Related rules