vetkit.js.path-traversal.render-view-name
The view name passed to res.render comes from request input. An attacker can render arbitrary template files from disk, which can disclose files or lead to code execution.
Last updated:
Suite: Security
javascript, typescript
The view name passed to res.render comes from request input. An attacker can render arbitrary template files from disk, which can disclose files or lead to code execution.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Map the request value to a fixed allow-list of view names before rendering.
References
Source: packages/engine/rules/sast/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.