A researcher discovered a zero-day Server-Side Template Injection (SSTI) vulnerability in the Handlebars template engine used in Shopify's Return Magic app, achieving Remote Code Execution by exploiting Object.prototype methods and the Function constructor to bypass sandbox restrictions. The exploit leverages the 'with' helper and Object.prototype.defineProperty() to inject arbitrary code through email workflow templates.
A researcher discovered remote code execution in HubSpot's template engine by exploiting expression language injection in HubL, using reflection to access javax.script.ScriptEngineManager and the Nashorn JavaScript engine to execute arbitrary code. The vulnerability arose from unsafe method calls allowed in the Jinjava-based template parser, which permitted access to Java reflection APIs despite blocking direct access to Runtime and System classes.
Research demonstrating a complete RCE attack chain on DeskPro helpdesk software through multiple chained vulnerabilities: insufficient API access control (leaking JWT secrets and admin config), and insecure deserialization in the template editor. The exploit was demonstrated against Bitdefender's support center, achieving remote code execution from an unauthenticated user registration.