vetkit.js.ssti.render-request-locals
The whole request object is passed as template locals to res.render. Template engines read special keys from locals (layout, settings, view options), so request fields can switch layouts, include arbitrary files or reach engine options that execute code.
Last updated:
Suite: Security
javascript, typescript
The whole request object is passed as template locals to res.render. Template engines read special keys from locals (layout, settings, view options), so request fields can switch layouts, include arbitrary files or reach engine options that execute code.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Pass an explicit object with only the fields the view needs, e.g. { name: String(req.query.name) }.
References
Source: packages/engine/rules/sast/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.