Tagged template literals are a JavaScript syntax for calling a function with a template string split into text parts and expression values. The tag function receives the raw string segments and substitutions separately, which lets it transform, escape, or inspect the content before producing a result.
How tagged template literals work
Tagged template literals are a JavaScript call pattern where the runtime passes a template as separated string segments and expression values to a function. That split view is the key behaviour: the tag can inspect, rewrite, or combine the pieces before returning a result, rather than receiving one finished string.
Why the raw and cooked string split matters
The tag receives both the literal text fragments and the substitution values, which means the same source text can be treated as data instead of plain concatenated output. In JavaScript, that distinction matters when a program needs to preserve escape sequences, normalise formatting, or apply custom parsing rules before output is generated.
Because the tag sees the pieces separately, it can decide whether interpolation should become text, markup, SQL-like syntax, localisation data, or another structured result. That flexibility is useful, but it also means the tag becomes part of the trust boundary for whatever content it processes.
Security implications of custom tag functions
Security depends on what the tag does with the supplied values. A tag that escapes characters, validates placeholders, or builds a safer representation can reduce injection risk, while a tag that blindly assembles content can preserve the same escaping and trust problems as ordinary string concatenation.
This is especially important when template values come from users, external services, or other untrusted sources. The syntax itself is neutral, but the tag function can either enforce safe handling or become the place where unsafe content is transformed into a dangerous final string.
Common usage patterns and edge cases
Tagged template literals are often used for HTML templating, localisation, domain-specific mini-languages, and data formatting helpers. They are also used to attach metadata to text fragments, because the function can inspect the literal pieces and the substitutions as a structured input rather than as a flat string.
One common edge case is assuming that template literals automatically escape content. They do not. Safety comes from the tag implementation, not from the syntax, so two tagged templates can behave very differently even when they look similar in source code.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V1 — Encoding and Sanitization | Tagged template tags often need output encoding and sanitization to handle substitutions safely. |
| V15 — Secure Coding and Architecture | Custom tag functions create a code path where trust boundaries and string construction must be designed safely. | |
| Recommendation — Use V1 to encode interpolated values before rendering templated output. Review tag implementations for unsafe concatenation and trust-boundary mistakes. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Tags may process external substitutions, so input validation is central to safe handling. |
| SC-28 — Protection of Information at Rest | Tagged templates are often used to build sensitive outputs that should not expose unprotected content. | |
| Recommendation — Validate substituted values before the tag transforms them into output. Protect generated sensitive strings wherever template output is stored or logged. | ||
| CIS Controls v8 | CIS-16 — Application Software Security | Custom template tags are application code that must be developed and reviewed securely. |
| Recommendation — Review tagged template helpers as application code with security requirements. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org