Server-side JSON and XML injection happens when data from an untrusted source is not sanitized by the server and written directly to a JSON or XML stream.

This rules detects instances in which data from an untrusted source can be injected into a JSON or XML payload.