Server-Side Template Injection

Server-Side Template Injection (SSTI) happens when user-controlled data is embedded directly into a template string that the server then evaluates. Template engines like Jinja2, Blade, and Twig are designed to execute code — so once an attacker can inject template syntax, they can run arbitrary expressions on the server process.

Traditional code review struggles with SSTI because the vulnerability lives at the boundary between data and code. A variable that looks safe in isolation becomes dangerous when it reaches a render() call without proper escaping. Reviewers often miss it because the template and the data assignment are in different files, or because the framework "auto-escapes" in most contexts but not in the specific code path being reviewed.

PullLight traces data flows across files and flags any render() or eval() call where the argument includes a value that has touched user input — including indirect paths through function parameters, database columns loaded from user-provided IDs, and config values that can be set per-user. It surfaces the full chain in the review comment so engineers can immediately see where the taint originates.