SSTI

Server-side template injection payloads and methodology for Jinja2, Nunjucks, Pug, Velocity, Thymeleaf, and Go html/template.

The deciding boundary is where attacker-controlled input enters the rendering flow:

fixed template source + attacker input passed as data
-> the input is rendered as a value
-> not SSTI

attacker input concatenated into template source or passed to parse, compile, or evaluate
-> template syntax inside the input is evaluated
-> SSTI

HTML escaping is a separate boundary. Disabling escaping can turn an inserted value into XSS, but it does not make that value template source.