---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable Jelly JS interpolation protection for nested expressions \[Updated in Security Center 2.0\]

# Enable Jelly JS interpolation protection for nested expressions \[Updated in Security Center
2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Manage the interpolation protection on your instance.
Use the glide.ui.jelly.js_interpolation.protect_nested_expressionsproperty to manage interpolation
protection. Interpolation protection ensures that when Jelly expressions are used in JavaScript, that they must be deemed as safe by either falling under certain categories or being marked as SAFE in the expression itself. Without
this mitigation enabled, a bad actor can send a GET parameter to a Jelly page and cause the contents of that parameter to be evaluated as server-side JavaScript with admin privileges. If this property is not set to the recommended
value of true, malicious Jelly expressions interpolated in JavaScript are allowed and a user can execute code using a Jelly template.  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-enable-jelly-js-interpolation-protection-for-nested-expressions__section_qhx_1b1_xwb}

{#sc-enable-jelly-js-interpolation-protection-for-nested-expressions__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.jelly.js_interpolation.protect_nested_expressions |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 9 * CVSS score: Critical * Security risk details: If the property is set to false, then malicious Jelly expressions are allowed. {#sc-enable-jelly-js-interpolation-protection-for-nested-expressions__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-jelly-js-interpolation-protection-for-nested-expressions__table_ajc_b43_3kb}