Saturday, October 31, 2026

SSTI Lab: Escape a Template Sandbox to Read a Secret

DocsRender uses a Jinja-style template engine in 'safe mode' — it only means to expose a few basic variables. But the sandbox is incomplete, and in template languages you can often walk from a harmless object, through its attributes, to objects the sandbox never meant to hand you. Lab at a glance: Advanced · 130 XP · about 20 minutes · runs in your browser, no signup or setup. Try it yourself first; the full solution is behind a spoiler…

Read full article →

No comments:

Post a Comment