← back to room
SSTI

TemplateCraft — Preview

Scenario

The preview engine exposes Python object internals through the template context. Deeper expressions can reach dangerous attributes on built-in types. Trigger the lab's simulated sandbox escape indicator.

Your approach

  1. Start from a working math expression payload.
  2. Traverse object class or MRO attributes allowed by Jinja.
  3. Build a chain that reaches a simulated command or flag helper.
  4. Read the escape flag from the rendered output.
  5. Submit the simulated escape flag.
Email preview