template injection
hiding instructions inside text a system fills in
Many systems build text from templates, filling in values from users. Template injection happens when the system treats a user's value as instructions instead of plain text. The attacker writes code where a name or number should go. If the system runs it, the attacker can run their own code on the server.
Think of it as
A form clerk who obeys anything written in the quantity box, even "open the safe".
Ideas that use this term