Exploit for Use of Uninitialized Variable in Google Chrome

## https://sploitus.com/exploit?id=35389ED7-5FE1-5AD7-894B-9151F2CF6472
---

## CVE-2026-11104 – Python SSTI via Jinja2 `|attr` Filter Bypass

### Program Code (Flask)

```python
# vulnerable_app.py - Flask with Jinja2 SSTI via 'attr' filter
from flask import Flask, request, render_template_string

app = Flask(__name__)

@app.route('/')
def index():
    name = request.args.get('name', 'World')
    # UNSAFE: directly renders user input as template
    template = f"Hello {name}!"
    return render_template_string(template)

if __name__ == '__main__':
    app.run(port=5000)

```

# CVE-2026-11104 – Server-Side Template Injection via Jinja2 `|attr` Filter

![Severity: Critical](https://img.shields.io/badge/severity-critical-red)

## Overview
A Flask application uses `render_template_string` with user input, allowing server-side template injection. Even if some keywords are blocked, the `|attr` filter can be used to bypass filters and achieve remote code execution.

## Vulnerability Details
- **Type:** SSTI
- **Impact:** Remote code execution, full server compromise.
- **Root Cause:** Untrusted data is placed directly into a Jinja2 template without sandboxing, enabling an attacker to traverse Python object internals and call dangerous functions.

## Exploit Demonstration
1. Start the vulnerable app:
   ```bash
   pip install flask
   python vulnerable_app.py
2. Run the exploit:
   ```bash
   python exploit_ssti_attr.py