Server-Side Template Injection (SSTI)
Description
Detects user input used directly in template rendering, allowing arbitrary code execution.
How to fix
Use template files with render_template(), not render_template_string().
```python
return render_template('page.html', name=user_name)
```
Learn more: https://shoulder.dev/learn/python/cwe-94/ssti
Applies to
Languages
Frameworks
flask
django
jinja2
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=python-ssti .
Real-world examples
Known CVEs in the Code Injection vulnerability class that this rule helps detect.