mozilla/nunjucks — pull request #338 by christopher-hegre (2014-12-15 17:52:25+00:00)
Title: Patching serverside script injection

Nunjucks currently has the ability to execute code in serverside Node.js context.

```
{{ a.constructor.__proto__.constructor('process.kill()')() }}
```

This PR will make the runtime skip self invoking constructors created inside Nunjucks templates.

https://github.com/mozilla/nunjucks-docs/issues/17