CVE-2026-11104-Python-SSTI-via-Jinja2-attr-Filter-Bypass

CVE-2026-11104 – 通过 Jinja2 |attr 过滤器绕过实现 Python SSTI 程序代码（Flask） root@kitploit: vulnerableapp.py - Flask with Jinja2 SSTI via 'attr' filter from flask import Flask, request, rendertemplatestring app = Flaskname @app.route'/' def index: name = request.args.get'name', 'World' UNSAFE: directly rende...