exploiting-client-side-template-injection

Reflect a probe like {{7*7}} into the input and check whether the page renders 49 instead of the literal string. If the expression is evaluated, the framework compiles your input as a template, confirming CSTI; then select a version-specific payload for code execution.

For AngularJS 1.6 and later, use {{constructor.constructor('alert(1)')()}} since the sandbox was removed. For Vue 2 use {{this.constructor.constructor('alert(1)')()}}, and for Vue 3 enumerate render helpers like _openBlock or _createBlock to reach .constructor.

Yes, CSTI often bypasses script-src CSP because execution happens through the framework's own evaluator rather than inline script tags. AngularJS ng-csp gadgets such as the orderBy filter payload can execute JavaScript without any inline script.

A literal render means the reflection lands in inert HTML, not a framework-compiled region. Check for directive or event sinks like ng-focus, v-html, or dynamic bindings, and note that Vue runtime-only builds do not compile arbitrary template strings client-side.

ACSTIS (angularjs-csti-scanner) crawls pages and selects version-aware AngularJS CSTI payloads with verification. Burp Suite and browser DevTools complement it by reflecting markers, fingerprinting framework versions, and observing payload execution.