What it is
SSTI occurs when an app embeds user input directly into a server-side template instead of passing it as data. Because template engines evaluate expressions, an attacker can read server state and frequently reach the underlying runtime to execute code.
How to test for it
Submit a math expression like {{7*7}} and engine-specific variants, then look for the evaluated result (49) in the response to fingerprint the engine. From there, walk the object graph to reach OS command execution.
How to prevent it
Never pass user input into template source. Use logic-less templates or pass values strictly as bound context data, sandbox the engine where supported, and validate any input that must influence templates against a strict allow-list.