> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a05-injection/cst-injection-csti.md). # CST Injection ( CSTI ) ## Client-Side Template Injection Modern frontend frameworks use template engines to bind user data to HTML. While this helps with escaping special characters, it can also enable injection if the template syntax itself is exposed. Below are practical examples for popular frameworks. [**AngularJS**](https://docs.angularjs.org/guide/templates) AngularJS is a common frontend framework. It uses special attributes and syntax to add interactivity, but this can enable HTML/text injections that execute arbitrary JavaScript if not properly handled.\ A key point: these injections only work if an element has an `ng-app` attribute. Once enabled, it opens up multiple attack paths. When this is enabled, however, many possibilities open up. One of the most interesting is template injection using `{{` characters inside a text string, no HTML tags are needed here! This is a rather well-known technique though, so it may be blocked. In cases of HTML injection with strong filters, you may be able to add custom attributes bypassing filters like [DOMPurify](https://github.com/cure53/DOMPurify). See [this presentation by Masato Kinugawa](https://speakerdeck.com/masatokinugawa/how-i-hacked-microsoft-teams-and-got-150000-dollars-in-pwn2own?slide=33) for some AngularJS tricks that managed to bypass Teams' filters. **Example payloads (all trigger `alert`):** ```markup {{constructor.constructor('alert(1)')()}}
...
``` **Note:**\ Older AngularJS versions had a sandbox that limited this, but all versions have sandbox bypasses now — see: [PortSwigger AngularJS sandbox escapes](https://portswigger.net/research/dom-based-angularjs-sandbox-escapes). **Newer versions** of *Angular (v2+)* instead of *AngularJS (v1)* are not vulnerable in this way. **Note**: Injecting content with `.innerHTML` does not always work, because it is only triggered *when AngularJS loads*. If you inject content later from a fetch, for example, it would not trigger even if a parent contains `ng-app`. You may still be able to exploit this by slowing down the AngularJS script loading by **filling up the browser's connection pool**. [See this challenge writeup for details](https://blog.ryotak.net/post/dom-based-race-condition/). [**VueJS**](https://vuejs.org/guide/essentials/template-syntax.html) VueJS template injection is possible via similar constructor tricks: ```markup

{{this.constructor.constructor('alert(1)')()}}

{{this.$el.ownerDocument.defaultView.alert(2)}}

``` [![Logo](https://portswigger.net/content/images/logos/favicon.ico)](https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets)[Incredibly detailed research into VueJS payloads and filter bypasses](https://portswigger.net/research/evading-defences-using-vuejs-script-gadgets) [**HTMX**](https://htmx.org/docs/) HTMX uses attributes for interactivity and can also be abused: ```markup
``` #### Alternative Charsets [Source explaining XSS tricks when a charset definition is missing from a response, abusing ISO-2022-JP](https://www.sonarsource.com/blog/encoding-differentials-why-charset-matters/) **Note**: In this section, some ESC characters are replaced with `\x1b` for clarity. You can copy a real ESC control character from the code block below: ```  ``` If a response contains *any* of the following two lines, it is *safe* from the following attack. ```http Content-Type: text/html; charset=utf-8 ... ``` If the charset is missing, browsers will try to detect the encoding automatically. This can allow unexpected behavior, especially with encodings like **ISO-2022-JP**, which uses escape sequences to switch character sets mid-response. The ISO-2022-JP encoding has the following special escape sequences:
Escape SequenceCopyMeaning
\x1b(B

(B
switch to ASCII (default)
\x1b(J

(J
switch to JIS X 0201 1976 (backslash swapped)
\x1b$@

$@
switch to JIS X 0201 1978 (2 bytes per char)
\x1b$B

$B
switch to JIS X 0201 1983 (2 bytes per char)
These sequences can be used at any point in the HTML context (not JavaScript) and instantly switch how the browser maps bytes to characters. *JIS X 0201 1976* is almost the same as ASCII, except for `\` being replaced with `¥`, and `~` replaced with `‾`. ![](https://book.jorianwoltjer.com/~gitbook/image?url=https%3A%2F%2F3698848315-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F677wrA8ZfiPs1U4l5uR6%252Fuploads%252FdOiOuFJBrFgovk90KxJw%252Fimage.png%3Falt%3Dmedia%26token%3D971a8d2b-a29b-42cb-8759-88ddc30fde51\&width=768\&dpr=4\&quality=100\&sign=a7bf5e18\&sv=1) **1. Negating Backslash Escaping** For example, the **JIS X 0201 1976** charset is similar to ASCII but replaces `\` with `¥` and `~` with `‾`. This means if you inject the escape sequence `\x1b(J` into a script, it switches the encoding so that backslashes no longer behave as expected. This can bypass protections that rely on backslash escaping to sanitize quotes or special characters inside `