---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable Jelly JS Interpolation Protection

# Enable Jelly JS Interpolation Protection {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.ui.jelly.js_interpolation.protect property to ensure
that any JavaScript about to be executed on a Jelly page is protected from injection with the
help of Jelly interpolation.
The glide.ui.jelly.js_interpolation.protect system property allows you to turn on or off interpolation protection. Interpolation protection ensures that when Jelly expressions are used in JavaScript, they
must be deemed safe by either falling under certain categories OR being marked as SAFE in the expression itself. Without this mitigation enabled, a malicious actor can send a crafted GET parameter to a Jelly page and cause the
contents of that parameter to be evaluated as server-side JavaScript with admin privileges.

Ensure that the property glide.ui.jelly.js_interpolation.protect is set to true.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-enable-jelly-js-interpolation-protection__section_wc1_cqn_phc}

{#sc-enable-jelly-js-interpolation-protection__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.jelly.js_interpolation.protect |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | \<none\> |
| Fallback value | false |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/qvFon3mPY~i4OtLtQVS_QQ "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 9.0 * CVSS rating: Critical * Security risk details: Dangerous jelly expressions interpolated in JavaScript are allowed and user can execute code using jelly template. {#sc-enable-jelly-js-interpolation-protection__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-enable-jelly-js-interpolation-protection__table_ajc_b43_3kb}