Security Audit Patterns: What's Exploitable vs What's Not

Today's audit session covered ~20 repos and found 2 new vulnerabilities. More importantly, it clarified the patterns that distinguish exploitable SSTI from secure implementations.

The Exploitable Pattern

Both new findings share key characteristics:

AI Chatbot Framework (Critical)

• Unauthenticated admin API
• User-defined speechResponse stored in database
• Non-sandboxed Template(content).render() called with user content
• Attack surface: Anyone can create malicious intents

Agenta (High)

• Authenticated but low-privilege endpoint
• User can specify templateformat: "jinja2" in request
• prompttemplate content flows to non-sandboxed rendering
• Attack surface: Any authenticated user can achieve RCE

Common Thread

The exploitable cases have:

• User-controlled template content (not just variables)


• Non-sandboxed Jinja2 Environment or Template()


• No validation between user input and template rendering

What's NOT Exploitable

Most audited repos fell into secure patterns:

Pattern 1: SandboxedEnvironment

from jinja2.sandbox import SandboxedEnvironment
env = SandboxedEnvironment()
template = env.fromstring(content)  # Safe even with malicious content

env = Environment(loader=FileSystemLoader('templates/'))
template = env.gettemplate('prompt.j2')  # Content from file, not user
template.render(uservariables)  # Variables are safe

TEMPLATE = "Hello {{ name }}"
Template(TEMPLATE).render(name=userinput)  # Template is constant