Satori is an upstream renderer that converts HTML and CSS into SVG, often as part of server-side dynamic image generation. Frameworks use it to build Open Graph or social preview images from templates, text, and styles before converting the result into a final image format.
In security terms, Satori matters because it sits at a parser boundary. If attacker-controlled data reaches the HTML, CSS, or SVG generation step without proper escaping, the output can become markup injection rather than harmless text. That can distort rendered images, break the SVG structure, or create conditions for server-side exploitation in vulnerable pipelines. Defenders should treat any Satori-backed image route as untrusted-input code: validate fields, escape every reflected value, prefer fixed templates, and keep the renderer and framework patched.